TROJAN GEN. WIN 32 Résolu

Question

Bonjour,
Mon pc est infecté par Trojan Win32, Avast me permet de le mettre en quarantaine, ce que j'ai fait. 
Lorsque je souhaite charger une page, ce n'est pas la bonne qui est chargée. Je dois m'y reprendre à maintes reprises avant de pouvoir avoir la bonne page.
De plus, dès que je suis sur le net, j'en suis éjectée sous pétexte qu'un problème est survenu et la page est rechargée.
Ci-dessous, le rapport fait par "HijackThis"
D'avance, merci pour votre aide

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:50:57, on 19/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\sySTEM32\SvchoSt.ExE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\CENZANO\Local Settings\Temporary Internet Files\Content.IE5\ETE33S21\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Desktop Zoom] "C:\Program Files\HPQ\Desktop Zoom\hpwinadj.exe"  -s
O4 - HKLM\..\Run: [PreloadApp] "c:\hp\drivers\printers\photosmart\hphprld.exe" c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [TV Now] "C:\Program Files\HPQ\Notebook Utilities\TvNow.exe" /RK
O4 - HKLM\..\Run: [Display Settings] "C:\Program Files\HPQ\Notebook Utilities\hptasks.exe" /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Control Center] "C:\Program Files\ASUS\WLAN Card Utilities\Center.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe" 
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld14.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Destrio5 · Answer

Bonjour,

--> Désinstalle VMN Toolbar.

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

joyauduciel · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by CENZANO at 2009-08-19 22:57:47
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 5 GB (17%) free of 29 GB
Total RAM: 446 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:58:15, on 19/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\sySTEM32\SvchoSt.ExE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\CENZANO\Local Settings\Temporary Internet Files\Content.IE5\EULV1QJE\RSIT[1].exe
C:\Program Files	rend micro\CENZANO.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing)
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Desktop Zoom] "C:\Program Files\HPQ\Desktop Zoom\hpwinadj.exe"  -s
O4 - HKLM\..\Run: [PreloadApp] "c:\hp\drivers\printers\photosmart\hphprld.exe" c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [TV Now] "C:\Program Files\HPQ\Notebook Utilities\TvNow.exe" /RK
O4 - HKLM\..\Run: [Display Settings] "C:\Program Files\HPQ\Notebook Utilities\hptasks.exe" /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Control Center] "C:\Program Files\ASUS\WLAN Card Utilities\Center.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe" 
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld14.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Destrio5 · Answer

---> Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort.

---> Télécharge OTM (OldTimer) sur ton Bureau.

---> Double-clique sur OTM.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}] 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] 
"{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] 
"sysldtray"=-

:files 
C:\Documents and Settings\CENZANO\Application Data\VMNTOOLBAR 
C:\WINDOWS\ld14.exe 
C:\Program Files\vmntoolbar 

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTM.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

joyauduciel · Answer

le dossier "Moved Files" existe bien ainsi que le nom du rapport mais ce dernier est inexistant...

Destrio5 · Answer

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

joyauduciel · Answer

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2551
Windows 5.1.2600 Service Pack 3

20/08/2009 0:59:44
mbam-log-2009-08-20 (00-59-44).txt

Type de recherche: Examen rapide
Eléments examinés: 104417
Temps écoulé: 24 minute(s), 7 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
c:\WINDOWS\pp11.exe (Worm.KoobFace) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Backdoor.Bot) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\WINDOWS\pp11.exe (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\ld14.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

Destrio5 · Answer

--> Relance MBAM, va dans Quarantaine et supprime tout.

--> Désinstalle les programmes suivants :
- Java 6 Update 3
- Java 6 Update 5  
- Java 6 Update 7
- Java SE Runtime Environment 6 Update 1

--> Mets à jour Java.

--> Mets à jour Adobe Reader.

--> Refais un scan RSIT et poste le rapport log.

joyauduciel · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by CENZANO at 2009-08-20 01:45:11
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 5 GB (19%) free of 29 GB
Total RAM: 446 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:45:30, on 20/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\sySTEM32\SvchoSt.ExE
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Documents and Settings\CENZANO\Local Settings\Temporary Internet Files\Content.IE5\ETE33S21\RSIT[1].exe
C:\Program Files	rend micro\CENZANO.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing)
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Desktop Zoom] "C:\Program Files\HPQ\Desktop Zoom\hpwinadj.exe"  -s
O4 - HKLM\..\Run: [PreloadApp] "c:\hp\drivers\printers\photosmart\hphprld.exe" c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [TV Now] "C:\Program Files\HPQ\Notebook Utilities\TvNow.exe" /RK
O4 - HKLM\..\Run: [Display Settings] "C:\Program Files\HPQ\Notebook Utilities\hptasks.exe" /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Control Center] "C:\Program Files\ASUS\WLAN Card Utilities\Center.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe" 
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Destrio5 · Answer

Tu n'as plus d'antivirus ?

joyauduciel · Answer

En fait, je ne suis pas arrivée, tout à l'heure, à simplement désactiver mon anti-virus (avast), je l'avais donc désinstaller le temps des différentes procédures demandées. Visiblement Avast rencontre quelques problèmes donc je suis passée à Avira. J'ai donc bien un anti-virus maintenant...

Destrio5 · Answer

--> Double-clique sur l'icône d'AntiVir (Parapluie) dans la barre des tâches.

--> Dans AntiVir, choisis Outils puis Configuration.

--> Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.

--> Fais un scan complet, clique sur Tout réparer si AntiVir trouve quelque chose et poste le rapport.

Tutoriel sur AntiVir

Destrio5 · Answer

Pour me transmettre le rapport :
--> Clique sur ce lien : http://www.cijoint.fr/
--> Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
--> Clique sur Ouvrir.
--> Clique sur Cliquez ici pour déposer le fichier.
--> Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
--> Copie ce lien dans ta réponse.

joyauduciel · Answer

Je n'arrive pas à trouver ce lien de ce foutu rapport ! Il existe bien dans la liste des rapports d'Avira mais impossible de lui mettre la main dessus ! Et ce même après avoir lancé une recherche ! J'en ai marre !!!! ;-)

Destrio5 · Answer

AntiVir avait trouvé des choses ?

Si oui, tu as cliqué sur Tout réparer ?

joyauduciel · Answer

Oui, l'anti-virus avait trouvé 20 "virus" : "Cheval de Troie" et "HEUR" ;-( et oui, j'ai bien demander de "tout réparer". Le rapport de cette "réparation" existe mais impossible de le trouver ou de le poster !!!! Grrr... ;-)

joyauduciel · Answer

Cela étant le "HEUR" est toujours actif car lorsque je souhaite aller sur le net (et tout particulièrement des sites que j'ai l'habitude de consulter), l'anti-virus m'averti de sa présence et me demande de le mettre "en quarantaine" ce que je fais mais malheureusement je ne peux accéder au site voulu ! ;-((

Destrio5 · Answer

Tu as des pubs sur Internet ?

joyauduciel · Answer

Avira AntiVir Personal
Date de création du fichier de rapport : jeudi 20 août 2009  12:44

La recherche porte sur 1649119 souches de virus.

Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus
Numéro de série         : 0000149996-ADJIE-0000001
Plateforme              : Windows XP
Version de Windows      : (Service Pack 3)  [5.1.2600]
Mode Boot               : Démarré normalement
Identifiant             : SYSTEM
Nom de l'ordinateur     : DORINE

Informations de version :
BUILD.DAT               : 9.0.0.67      17958 Bytes   4/08/2009 14:47:00
AVSCAN.EXE              : 9.0.3.7      466689 Bytes  21/07/2009 12:35:43
AVSCAN.DLL              : 9.0.3.0       49409 Bytes   3/03/2009 09:21:02
LUKE.DLL                : 9.0.3.2      209665 Bytes  20/02/2009 10:35:11
LUKERES.DLL             : 9.0.2.0       13569 Bytes   3/03/2009 09:21:31
ANTIVIR0.VDF            : 7.1.0.0    15603712 Bytes  27/10/2008 11:30:36
ANTIVIR1.VDF            : 7.1.4.132   5707264 Bytes  24/06/2009 08:21:42
ANTIVIR2.VDF            : 7.1.5.88    2668032 Bytes  10/08/2009 00:04:49
ANTIVIR3.VDF            : 7.1.5.138    423936 Bytes  19/08/2009 00:04:50
Version du moteur       : 8.2.1.3

joyauduciel · Answer

AEVDF.DLL               : 8.1.1.1      106868 Bytes  28/07/2009 12:17:15
AESCRIPT.DLL            : 8.1.2.25     459130 Bytes  20/08/2009 00:04:57
AESCN.DLL               : 8.1.2.4      127348 Bytes  23/07/2009 08:59:39
AERDL.DLL               : 8.1.2.4      430452 Bytes  23/07/2009 08:59:39
AEPACK.DLL              : 8.1.3.18     401783 Bytes  28/07/2009 12:17:14
AEOFFICE.DLL            : 8.1.0.38     196987 Bytes  23/07/2009 08:59:39
AEHEUR.DLL              : 8.1.0.155   1921400 Bytes  20/08/2009 00:04:56
AEHELP.DLL              : 8.1.6.0      233846 Bytes  20/08/2009 00:04:53
AEGEN.DLL               : 8.1.1.57     356725 Bytes  20/08/2009 00:04:52
AEEMU.DLL               : 8.1.0.9      393588 Bytes   9/10/2008 13:32:40
AECORE.DLL              : 8.1.7.6      184694 Bytes  23/07/2009 08:59:39
AEBB.DLL                : 8.1.0.3       53618 Bytes   9/10/2008 13:32:40
AVWINLL.DLL             : 9.0.0.3       18177 Bytes  12/12/2008 07:47:30
AVPREF.DLL              : 9.0.0.1       43777 Bytes   3/12/2008 10:39:26
AVREP.DLL               : 8.0.0.3      155905 Bytes  20/01/2009 13:34:28
AVREG.DLL               : 9.0.0.0       36609 Bytes   7/11/2008 14:24:42
AVARKT.DLL              : 9.0.0.3      292609 Bytes  24/03/2009 14:05:22
AVEVTLOG.DLL            : 9.0.0.7      167169 Bytes  30/01/2009 09:36:37
SQLITE3.DLL             : 3.6.1.0      326401 Bytes  28/01/2009 14:03:49
SMTPLIB.DLL             : 9.2.0.25      28417 Bytes   2/02/2009 07:20:57
NETNT.DLL               : 9.0.0.0       11521 Bytes   7/11/2008 14:40:59
RCIMAGE.DLL             : 9.0.0.25    2438913 Bytes  17/06/2009 12:44:26
RCTEXT.DLL              : 9.0.37.0      88321 Bytes  15/04/2009 09:07:05

Configuration pour la recherche actuelle :
Nom de la tâche...............................: Contrôle intégral du système
Fichier de configuration......................: c:\program files\avira\antivir desktop\sysscan.avp
Documentation.................................: élevé
Action principale.............................: interactif
Action secondaire.............................: ignorer
Recherche sur les secteurs d'amorçage maître..: marche
Recherche sur les secteurs d'amorçage.........: marche
Secteurs d'amorçage...........................: C:, 
Recherche dans les programmes actifs..........: marche
Recherche en cours sur l'enregistrement.......: marche
Recherche de Rootkits.........................: marche
Contrôle d'intégrité de fichiers système......: arrêt
Fichier mode de recherche.....................: Tous les fichiers
Recherche sur les archives....................: marche
Limiter la profondeur de récursivité..........: 20
Archive Smart Extensions......................: marche
Heuristique de macrovirus.....................: marche
Heuristique fichier...........................: moyen
Catégories de dangers divergentes.............: +APPL,+GAME,+JOKE,+PCK,+SPR,
Paramètres étendus de recherche...............: 0x00001000

joyauduciel · Answer

Début de la recherche : jeudi 20 août 2009  12:44

La recherche d'objets cachés commence.
'66853' objets ont été contrôlés, '0' objets cachés ont été trouvés.

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Avira\AntiVir Desktop\avscan.exe'
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Avira\AntiVir Desktop\avscan.exe'
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
  Module OK -> 'c:\program files\avira\antivir desktop\avcenter.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\svchost.exe'
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\alg.exe'
Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\wbem\wmiapsrv.exe'
Processus de recherche 'wlcomm.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Windows Live\Contacts\wlcomm.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\svchost.exe'
Processus de recherche 'SeaPort.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe'
Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Java\jre6\bin\jqs.exe'
Processus de recherche 'HPWirelessMgr.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe'
Processus de recherche 'HPConfig.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\HPConfig.exe'
Processus de recherche 'FxSvr2.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Logitech\Video\FxSvr2.exe'
Processus de recherche 'fsssvc.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Windows Live\Family Safety\fsssvc.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\sySTEM32\SvchoSt.ExE'
Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\Ati2evxx.exe'
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Avira\AntiVir Desktop\avguard.exe'
Processus de recherche 'GoogleToolbarNotifier.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe'
Processus de recherche 'msnmsgr.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Windows Live\Messenger\msnmsgr.exe'
Processus de recherche 'msmsgs.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Messenger\msmsgs.exe'
Processus de recherche 'LogitechDesktopMessenger.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe'
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\ctfmon.exe'
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Avira\AntiVir Desktop\avgnt.exe'
Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Java\jre6\bin\jusched.exe'
Processus de recherche 'GoogleQuickSearchBox.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe'
Processus de recherche 'realsched.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe'
Processus de recherche 'fsui.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Windows Live\Family Safety\fsui.exe'
Processus de recherche 'pctsTray.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Spyware Doctor\pctsTray.exe'
Processus de recherche 'LogiTray.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Logitech\Video\LogiTray.exe'
Processus de recherche 'LVCOMSX.EXE' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\LVCOMSX.EXE'
Processus de recherche 'Center.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\ASUS\WLAN Card Utilities\Center.exe'
Processus de recherche 'hpsysdrv.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\windows\system\hpsysdrv.exe'
Processus de recherche 'SynTPEnh.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Synaptics\SynTP\SynTPEnh.exe'
Processus de recherche 'SynTPLpr.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Synaptics\SynTP\SynTPLpr.exe'
Processus de recherche 'ONETOUCH.EXE' - '1' module(s) sont contrôlés
  Module OK -> 'C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE'
Processus de recherche 'carpserv.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\carpserv.exe'
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\Explorer.EXE'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\svchost.exe'
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\Program Files\Avira\AntiVir Desktop\sched.exe'
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\spoolsv.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\svchost.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\svchost.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\svchost.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\svchost.exe'
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\svchost.exe'
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\lsass.exe'
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\services.exe'
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\winlogon.exe'
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\system32\csrss.exe'
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
  Module OK -> 'C:\WINDOWS\System32\smss.exe'
'50' processus ont été contrôlés avec '50' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !

joyauduciel · Answer

La recherche sur les secteurs d'amorçage commence : Secteur d'amorçage 'C:\' [INFO] Aucun virus trouvé ! La recherche sur les renvois aux fichiers exécutables (registre) commence : C:\WINDOWS\system32\ crypt32.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain\DllName C:\WINDOWS\system32\ cryptnet.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet\DllName C:\WINDOWS\system32\ cscdll.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll\DLLName C:\WINDOWS\system32\ dimsntfy.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy\DllName C:\WINDOWS\system32\ wlnotify.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp\DLLName C:\WINDOWS\system32\ wlnotify.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule\DllName C:\WINDOWS\system32\ sclgntfy.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy\DllName C:\WINDOWS\system32\ WgaLogon.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\DllName C:\WINDOWS\system32\ ntsd.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path\Debugger C:\WINDOWS\system32\ Ati2mdxx.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ATIModeChange C:\WINDOWS\system32\ atiptaxx.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AtiPTA C:\WINDOWS\system32\ carpserv.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CARPService c:\hp\drivers\printers\photosmart\ HPHprld.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PreloadApp c:\hp\drivers\printers\photosmart\ setup.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PreloadApp C:\cpqs\scom\ srmclean.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srmclean C:\Program Files\HPQ\One-Touch\ ONETOUCH.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QT4HPOT C:\Program Files\HPQ\Default Settings\ Cpqset.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cpqset c:\WINDOWS\system\ hpsysdrv.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hpsysdrv C:\WINDOWS\system32\ LVCOMSX.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LVCOMSX C:\WINDOWS\system32\ Java.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\MenuText C:\WINDOWS\system32\ Java.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\MenuText C:\Program Files\Windows Live\Writer\ WriterBrowserExtension.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\HotIcon C:\Program Files\Windows Live\Writer\ WriterBrowserExtension.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\Icon C:\Program Files\Skype\Toolbars\Internet Explorer\ favicon.ico [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{77BF5300-1474-4EC7-9980-D32B190E9B07}\Icon C:\Program Files\Skype\Toolbars\Internet Explorer\ favicon.ico [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{77BF5300-1474-4EC7-9980-D32B190E9B07}\HotIcon C:\Program Files\Microsoft Office\OFFICE11\ REFBAR.ICO [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}\Icon C:\Program Files\Microsoft Office\OFFICE11\ REFBARH.ICO [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}\HotIcon C:\Program Files\Messenger\ msmsgs.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\Exec C:\Program Files\Messenger\ msmsgs.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\HotIcon C:\WINDOWS\ Explorer.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} C:\WINDOWS\ Explorer.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} C:\WINDOWS\system32\ IEUDINIT.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}\ComponentID C:\WINDOWS\inf\ unregmp2.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath C:\WINDOWS\system32\ ie4uinit.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}\StubPath C:\WINDOWS\system32\ shmgrate.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\StubPath C:\WINDOWS\system32\ RunDLL32.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{a40f0711-cf0b-46f2-bd94-ab885bdb9f75}\StubPath C:\WINDOWS\system32\ msjava.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\KeyFileName C:\WINDOWS\system32\ Graphics.COM [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} C:\WINDOWS\system32\ Graphics.COM [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} C:\WINDOWS\system32\ Setup.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} C:\WINDOWS\system32\ themeui.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\StubPath C:\WINDOWS\system32\ themeui.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\StubPath C:\WINDOWS\system32\ user.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\StubPath C:\WINDOWS\system32\ user.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\StubPath C:\WINDOWS\inf\ msnetmtg.inf [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}\StubPath C:\WINDOWS\inf\ msnetmtg.inf [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}\StubPath C:\WINDOWS\inf\ msmsgs.inf [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}\StubPath C:\WINDOWS\inf\ msmsgs.inf [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}\StubPath C:\WINDOWS\system32\ msieftp.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}\KeyFileName C:\WINDOWS\inf\ wmp11.inf [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\StubPath C:\WINDOWS\inf\ wmp11.inf [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\StubPath C:\WINDOWS\system32\ regsvr32.exe [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\StubPath C:\WINDOWS\system32\ shell32.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\StubPath C:\WINDOWS\system32\ shell32.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\StubPath c:\WINDOWS\system32\ mscories.dll [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}\StubPath C:\WINDOWS\system32\ Help.EXE [INFO] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} C:\WINDOWS\system32\ ctfmon.exe [INFO] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CTFMON.EXE C:\WINDOWS\system32\ logon.scr [INFO] HKEY_CURRENT_USER\Control Panel\Desktop\Scrnsave.exe C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\ desktop.ini [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup C:\WINDOWS\system32\ desktop.ini [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup C:\WINDOWS\system32\ desktop.ini [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\ Lancement rapide d'Adobe Reader.lnk [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup C:\Program Files\Adobe\Acrobat 7.0\Reader\ reader_sl.exe [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\ Logitech Desktop Messenger.lnk [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ LogitechDesktopMessenger.exe [INFO] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup Le registre a été contrôlé ( '65' fichiers).

joyauduciel · Answer

La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\'
C:\
  4e162000.pac
  boot.ini
  Bootfont.bin
  hiberfil.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
    [REMARQUE]  Ce fichier est un fichier système Windows.
    [REMARQUE]  Il est correct que ce fichier ne puisse pas être ouvert pour la recherche.
  install.dat
  IO.SYS
  LogiSetup.log
  MSDOS.SYS
  NTDETECT.COM
  ntldr
  pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
    [REMARQUE]  Ce fichier est un fichier système Windows.
    [REMARQUE]  Il est correct que ce fichier ne puisse pas être ouvert pour la recherche.
  sqmdata00.sqm
  sqmdata01.sqm
  sqmdata02.sqm
  sqmdata03.sqm
  sqmdata04.sqm
  sqmdata05.sqm
  sqmdata06.sqm
  sqmdata07.sqm
  sqmdata08.sqm
  sqmdata09.sqm
  sqmdata10.sqm
  sqmdata11.sqm
  sqmdata12.sqm
  sqmdata13.sqm
  sqmdata14.sqm
  sqmdata15.sqm
  sqmdata16.sqm
  sqmdata17.sqm
  sqmdata18.sqm
  sqmdata19.sqm
  sqmnoopt00.sqm
  sqmnoopt01.sqm
  sqmnoopt02.sqm
  sqmnoopt03.sqm
  sqmnoopt04.sqm
  sqmnoopt05.sqm
  sqmnoopt06.sqm
  sqmnoopt07.sqm
  sqmnoopt08.sqm
  sqmnoopt09.sqm
  sqmnoopt10.sqm
  sqmnoopt11.sqm
  sqmnoopt12.sqm
  sqmnoopt13.sqm
  sqmnoopt14.sqm
  sqmnoopt15.sqm
  sqmnoopt16.sqm
  sqmnoopt17.sqm
  sqmnoopt18.sqm
  sqmnoopt19.sqm
C:\30bcd657059f25d6b2\amd64\
  filterpipelineprintproc.dll
  msxpsdrv.cat
  msxpsdrv.inf
  msxpsinc.gpd
  msxpsinc.ppd
  mxdwdrv.dll
  xpssvcs.dll
C:\30bcd657059f25d6b2\i386\
  filterpipelineprintproc.dll
  msxpsdrv.cat
  msxpsdrv.inf
  msxpsinc.gpd
  msxpsinc.ppd
  mxdwdrv.dll
  xpssvcs.dll
C:\7ab282bece649149ac5e8a\
  msxml4-KB927978-enu.log
C:\Config.Msi\
  268905.rbs
  268906.rbf
  268907.rbf
  268908.rbf
  268909.rbf
  26890a.rbf
  26890b.rbf
  26890c.rbf
  26890d.rbf
  26890e.rbf
  26890f.rbf
  268910.rbf
  268911.rbf
  268912.rbf
  268913.rbf
  268914.rbf
C:\cpqs\quicksr\
  UIADLL.dll
C:\cpqs\scom\
  CpqCva.dll
  cpqstartmenu.dll
  customerreginfo.dll
  edid.dll
  Help.ico
  memusage.dll
  migrate.dll
  modemcheck.dll
  modemutil.dll
  scdmi.dll
  scdrivers.dll
  scom.dll
  scos.dll
  scpartnumber.dll
  srmclean.exe
C:\Documents and Settings\
  All Users.LOG
  Default User.LOG
C:\Documents and Settings\All Users\
  NCCD.log
  NTUSER.DAT
  NTUSER.DAT.LOG
C:\Documents and Settings\All Users\Application Data\
  desktop.ini
  ezsid.dat
C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0\Replicate\Security\
  directories.acrodata
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\
  addr_file.html
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\CONFIG\
  AVWIN.INI
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\EVENTDB\
  avevtdb.dbe
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\IDX\
  master.idx
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\
  4abc96c9.qua
  4abc9740.qua
  4abc98ea.qua
  4abc9921.qua
  4abd0980.qua
  4abd0987.qua
  4abd2891.qua
  4abd28a8.qua
  4adc964f.qua
  4adc96c8.qua
  4adc973e.qua
  4adc98e7.qua
  4adc9914.qua
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\JOBS\
  produpd.avj
  scanjob.avj
  startupd.avj
  updjob.avj
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES\
  avguard.log
  AVSCAN-20090820-023646-ACD1DEFE.LOG
  AVSCAN-20090820-101620-C7ED45A7.LOG
  AVSCAN-20090820-124414-08197F88.LOG
  AVSCAN-20090820-124414-08310818.LOG
  sched.log
  setup.log
  Upd-2009-08-20-02-04-27.log
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\
  folder.avp
  rootkit.avp
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\REPORTS\
  5e8bda42.avl
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\
  avguard.tmp
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVSCAN-20090820-124414-08182F0B\
  avscan_ext
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVSCAN-20090820-124414-0830C02D\
  avscan_ext
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\All Users\Application Data\EmailNotifier\
  EmailNotifier.exe
  EmailNotifierAPI.dll
  EmailNotifierEN.lng
  EmailNotifierFR.lng
C:\Documents and Settings\All Users\Application Data\Google\Custom Buttons\
  toolbar.google.com_O8Y91YHB24Z6SR0SGYSK.XML
C:\Documents and Settings\All Users\Application Data\Google Updater\
  requested_apps.pbuf
C:\Documents and Settings\All Users\Application Data\Google Updater\history\
  history
C:\Documents and Settings\All Users\Application Data\Google Updater\icons\
  images_acrobat.gif
  images_ar.gif
  images_chrome.gif
  images_desktop.gif
  images_earth.gif
  images_ff.gif
  images_gapps.gif
  images_gpy.gif
  images_ksd.gif
  images_maxthon.gif
  images_ns.gif
  images_picasa.gif
  images_real.gif
  images_sd.gif
  images_skype.gif
  images_ss.gif
  images_talk.gif
  images_toolbar.gif
  images_wps.gif
C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\
  setup option.exe
    [RESULTAT]  Contient le cheval de Troie TR/Dldr.Swizzor.Gen
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\
  CCD.log
  FCD.log
  msxml6.log
  NokiaSoftwareUpdater.log
  NokiaSoftwareUpdaterSetup_en[1].exe
  Third party copyright license and acknowledgement notices.txt
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Installer\
  Configuration.icf
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Installer\CommonCustomActions\
  Sleep.exe
  vcredistExec.exe
      --> vcredist_x86.exe
        [1] Type d'archive: RSRC
        --> Object
          [2] Type d'archive: CAB (Microsoft)
          --> VCREDI~3.EXE
            [3] Type d'archive: RSRC
            --> Object
              [4] Type d'archive: CAB (Microsoft)
              --> vcredis1.cab
                [5] Type d'archive: CAB (Microsoft)
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Installer\Eula\
  Licence_eng.rtf
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Packages\CCD\Setup\
  Nokia_Connectivity_Cable_Driver.msi
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Packages\FCD\Setup\
  Nokia_Flashing_Cable_Driver.msi
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Packages\msxml6\Setup\
  msxml6_x86.msi
C:\Documents and Settings\All Users\Application Data\Installations\{48110A46-A3A4-481E-8230-7873B7F4C696}\Packages\NokiaSoftwareUpdater\Setup\
  NokiaSoftwareUpdater.msi
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\
  ignore.dat
  rules.ref
C:\Documents and Settings\All Users\Application Data\Messenger Plus!\
  global.dat
C:\Documents and Settings\All Users\Application Data\Messenger Plus!\Custom Sounds\
  #22AB1CEBDADE.dat
  #288D5880AF73.dat
  #2EFB90A888E5.dat
  #34391C1CF0F0.dat
  #35C07EAC2364.dat
  #3F189334FC7B.dat
  #46CF02073FA8.dat
  #49581F0C3389.dat
  #4A731772F4FC.dat
  #4B743478456D.dat
  #4FA0B15DAEDA.dat
  #51FE925AB49F.dat
  #66500249CE29.dat
  #74180E5175BE.dat
  #7778320581C9.dat
  #78E0BD2CAC8C.dat
  #7CB83CBD167E.dat
  #86A8981DCBAD.dat
  #87386FE50BC7.dat
  #97D00ADCDEE9.dat
  #A70054DDC5C1.dat
  #D4FC0740E368.dat
  #E888FFE0492E.dat
  BuiltIn34.dat
  BuiltIn35.dat
  BuiltIn37.dat
  BuiltIn43.dat
  BuiltIn44.dat
  BuiltIn50.dat
  BuiltIn53.dat
  BuiltIn57.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\
  6d14e4b1d8ca773bab785d1be032546e_d03a968b-c0ef-4cd8-a857-73781ba05ea0
  d42cc0c3858a58db2db37658219e6400_d03a968b-c0ef-4cd8-a857-73781ba05ea0
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\
  drwtsn32.log
  user.dmp
C:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\
  ppcrlconfig.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\Quick Launch\
  MySpaceIM.lnk
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
  wmplibrary_v_0_12.db
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player\
  DefaultStore_59R.bin
  UserMigratedStore_59R.bin
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\
  rasphone.pbk
  sharedaccess.ini
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\
  qmgr0.dat
  qmgr1.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\
  data.dat
  OPA11.BAK
  opa11.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Search Enhancement Pack\SeaNote\
  SeaNote.xml
C:\Documents and Settings\All Users\Application Data\Microsoft\Search Enhancement Pack\SeaPort\
  SeaNote.cab
  SeaPort.cab
  SearchBoxExt.cab
  SHelper.cab
C:\Documents and Settings\All Users\Application Data\Microsoft\Search Enhancement Pack\Search Box Extension\
  hsconfig.xml
  QueryDat.xml
C:\Documents and Settings\All Users\Application Data\Microsoft\Search Enhancement Pack\Search Helper\
  shelper.xml
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\
  CENZANO.bmp
  guest.bmp
  Propriétaire.bmp
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\
  airplane.bmp
  astronaut.bmp
  ball.bmp
  beach.bmp
  butterfly.bmp
  car.bmp
  cat.bmp
  chess.bmp
  dirt bike.bmp
  dog.bmp
  drip.bmp
  duck.bmp
  fish.bmp
  frog.bmp
  guitar.bmp
  horses.bmp
  kick.bmp
  lift-off.bmp
  palm tree.bmp
  pink flower.bmp
  red flower.bmp
  skater.bmp
  snowflake.bmp
C:\Documents and Settings\All Users\Application Data\Microsoft\WLSetup\
  wltA.tmp
C:\Documents and Settings\All Users\Application Data\Microsoft\WLSetup\Logs\
  2008-10-09_14-58_bec-5ur0o0pc.log
  2008-12-19_14-17_ff8-27y9ptvk.log
  2009-02-18_23-42_bf0-zekkkbst.log
  2009-02-19_05-28_f04-fevmol7j.log
  2009-05-09_12-39_a38-elk0x285.log
  2009-07-08_19-46_414-lqo54zbd.log
C:\Documents and Settings\All Users\Application Data\Microsoft\Works\
  mswkscal.wcd
  wkcalcat.dat
  wklntnts.dat
  wklntsk.dat
C:\Documents and Settings\All Users\Application Data\MSN6\
  au.ini
C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage\data\
  data.dat
C:\Documents and Settings\All Users\Application Data\PC Suite\Settings\
  PCCS.dat
C:\Documents and Settings\All Users\Application Data\SBSI\ORUN\
  bookmrk.CDX
  bookmrk.dbf
  Groups.cdx
  Groups.dbf
  Grpsyll.cdx
  Grpsyll.dbf
  Prgrss2.cdx
  Prgrss2.dbf
  Progress.cdx
  Progress.dbf
  Settings.dbf
  Syllabi2.cdx
  Syllabi2.dbf
  Syllabus.cdx
  Syllabus.dbf
  Usergrp.cdx
  Usergrp.dbf
  Users.cdx
  Users.dbf
  WXPPera.toc
C:\Documents and Settings\All Users\Application Data\Skype\Pictures\
  Angel Skype.png
  Architect Skype.png
  Beach Skype.png
  Behind Skype.png
  Business Skype.png
  Call Me Sweetheart.png
  Call Me.png
  Carnival Skype.png
  Chic Skype.png
  Christmas Skype.png
  College Skype.png
  Desert Skype.png
  Designer Skype.png
  Devil Skype.png
  DIY Skype.png
  DJ Skype.png
  Earbud Skype.png
  Empire Skype.png
  Fax Skype.png
  Geisha Skype.png
  Hula Skype.png
  Make Skype Not War.png
  Metal Skype.png
  Ninja Skype.png
  Party Skype.png
  Pop Skype.png
  Rice Skype.png
  Skypahontas.png
  Skype 502.png
  Skype Aid.png
  Skype Artiste.png
  Skype Beauty.png
  Skype Bling.png
  Skype Boarder.png
  Skype Brrr... .png
  Skype Candy.png
  Skype Cola.png
  Skype Cool Shades.png
  Skype Extreme.png
  Skype Goaaaaal.png
  Skype Headset.png
  Skype in a Bag.png
  Skype Jah.png
  Skype Jyve.png
  Skype Safety.png
  Skype San.png
  Skype Shorty.png
  Skype Smiley.png
  Skype Time.png
  Skype-a-Manger.png
  Skype-ahoy.png
  Skype-in-one.png
  Skype.png
  Skypers of the Caribbean.png
  Star Skype.png
  Sushi Skype.png
  The Skypeness.png
  Travel Skype.png
  Wetsuit Skype.png
  Yin Yang Skype.png

joyauduciel · Answer

C:\Documents and Settings\All Users\Application Data\Skype\Plugins\
  collection.ini
  local_store.dat
  pxml.xml
  _sstore.dat
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\
  0019ED3CC0A745F8891EAEAAE2D3BED9_icon24.png
  0019ED3CC0A745F8891EAEAAE2D3BED9_icon48.png
  04B3EC9B2B5945A1B7AFC5FAFC297401_icon24.png
  04B3EC9B2B5945A1B7AFC5FAFC297401_icon48.png
  04B3EC9B2B5945A1B7AFC5FAFC297401_more.jpg
  04B85A4AD92F471CB8EC199BEBD26C57_icon24.png
  04B85A4AD92F471CB8EC199BEBD26C57_icon48.png
  04B85A4AD92F471CB8EC199BEBD26C57_more.jpg
  073AF5AC136443AEAF82FBD0E6EE23D0_icon24.png
  073AF5AC136443AEAF82FBD0E6EE23D0_icon48.png
  073AF5AC136443AEAF82FBD0E6EE23D0_named_strings.mlsxml
  07B9E799E57E446881426C489ED9764D_icon24.png
  07B9E799E57E446881426C489ED9764D_icon48.png
  07B9E799E57E446881426C489ED9764D_more.jpg
  08ADE748DA334F498231E20B7E0BF69E_icon24.png
  08ADE748DA334F498231E20B7E0BF69E_icon48.png
  08ADE748DA334F498231E20B7E0BF69E_more.jpg
  08D7796607914DFCBDB76A685DCBCD6B_icon24.png
  08D7796607914DFCBDB76A685DCBCD6B_icon48.png
  08D7796607914DFCBDB76A685DCBCD6B_more.jpg
  0B3223A1A4EA4592841023160E190196_icon24.png
  0B3223A1A4EA4592841023160E190196_icon48.png
  0B3223A1A4EA4592841023160E190196_more.jpg
  0E9B418314BC4742BE13D94710A876D6_icon48.png
  1163D2B46CC742E5A3CC9E4157887751_icon24.png
  1163D2B46CC742E5A3CC9E4157887751_icon48.png
  1163D2B46CC742E5A3CC9E4157887751_more.jpg
  1163D2B46CC742E5A3CC9E4157887751_named_strings.mlsxml
  13651BBE51534FF1B250EBE56CDE0987_icon48.png
  13651BBE51534FF1B250EBE56CDE0987_named_strings.mlsxml
  1447D8734FCC4B56BA92FDFD6C2F0C4E_icon24.png
  1447D8734FCC4B56BA92FDFD6C2F0C4E_icon48.png
  1447D8734FCC4B56BA92FDFD6C2F0C4E_more.jpg
  1447D8734FCC4B56BA92FDFD6C2F0C4E_named_strings.mlsxml
  154C62C17BE84FACB2D22300D1A8FD25_icon24.png
  154C62C17BE84FACB2D22300D1A8FD25_icon48.png
  154C62C17BE84FACB2D22300D1A8FD25_more.jpg
  154C62C17BE84FACB2D22300D1A8FD25_named_strings.mlsxml
  15820943763B412CB59AA18ACC0EB6D7_icon24.png
  15820943763B412CB59AA18ACC0EB6D7_icon48.png
  15820943763B412CB59AA18ACC0EB6D7_named_strings.mlsxml
  1597FB434D964733B5D8B2B112EE34C2_icon24.png
  1597FB434D964733B5D8B2B112EE34C2_icon48.png
  1597FB434D964733B5D8B2B112EE34C2_named_strings.mlsxml
  1738568061F344A1A4CB20704FFEDA01_icon24.png
  1738568061F344A1A4CB20704FFEDA01_icon48.png
  177A970D7E05474FBE7059A182672B58_icon24.png
  177A970D7E05474FBE7059A182672B58_icon48.png
  177A970D7E05474FBE7059A182672B58_more.jpg
  177A970D7E05474FBE7059A182672B58_named_strings.mlsxml
  185538D1B9D7403E8163FCDCD905001E_icon24.png
  185538D1B9D7403E8163FCDCD905001E_icon48.png
  185538D1B9D7403E8163FCDCD905001E_more.jpg
  1C858F44FD20414EA6E3ACFBA01EBBD2_icon24.png
  1C858F44FD20414EA6E3ACFBA01EBBD2_icon48.png
  1C858F44FD20414EA6E3ACFBA01EBBD2_more.jpg
  1C858F44FD20414EA6E3ACFBA01EBBD2_named_strings.mlsxml
  20C0EC98121B45AB8E47ACAD00F439B2_icon24.png
  20C0EC98121B45AB8E47ACAD00F439B2_icon48.png
  20C0EC98121B45AB8E47ACAD00F439B2_more.jpg
  215F17483FA345F985AFB7F0D52C6B80_icon24.png
  215F17483FA345F985AFB7F0D52C6B80_icon48.png
  215F17483FA345F985AFB7F0D52C6B80_more.jpg
  215F17483FA345F985AFB7F0D52C6B80_named_strings.mlsxml
  2286118ED27F4185B8E914DB419B9845_icon24.png
  2286118ED27F4185B8E914DB419B9845_icon48.png
  22E1CF92BED041C09C94A28F62FA6E12_icon24.png
  22E1CF92BED041C09C94A28F62FA6E12_icon48.png
  22E1CF92BED041C09C94A28F62FA6E12_more.jpg
  26BF497F320A43C3B0EF4CB5702DDFDA_icon24.png
  26BF497F320A43C3B0EF4CB5702DDFDA_icon48.png
  26BF497F320A43C3B0EF4CB5702DDFDA_more.jpg
  289650C9E52C40FE91D947C6D0EB72DA_icon24.png
  289650C9E52C40FE91D947C6D0EB72DA_icon48.png
  2DA9E410035A495AA15707F5F57B8290_icon24.png
  2DA9E410035A495AA15707F5F57B8290_icon48.png
  2DA9E410035A495AA15707F5F57B8290_more.jpg
  310891C5FB3645A0BEC3A6648A1468C8_icon24.png
  310891C5FB3645A0BEC3A6648A1468C8_icon48.png
  310891C5FB3645A0BEC3A6648A1468C8_more.jpg
  3173E4F7E13640FD8BA83F7B886288F6_icon24.png
  3173E4F7E13640FD8BA83F7B886288F6_icon48.png
  3173E4F7E13640FD8BA83F7B886288F6_more.jpg
  31B95F64831340A6A904F295A4CB064C_icon24.png
  31B95F64831340A6A904F295A4CB064C_icon48.png
  31E6481A7A624C39BB43E8BF6390376C_icon24.png
  31E6481A7A624C39BB43E8BF6390376C_icon48.png
  31E6481A7A624C39BB43E8BF6390376C_more.jpg
  344D33EE48D740E890505EB2FEA27CF9_icon24.png
  344D33EE48D740E890505EB2FEA27CF9_icon48.png
  39B2F533597C4902A09E458E1F529484_icon24.png
  39B2F533597C4902A09E458E1F529484_icon48.png
  39B2F533597C4902A09E458E1F529484_named_strings.mlsxml
  3FC333113C2B4835B62DCD762B266874_icon24.png
  3FC333113C2B4835B62DCD762B266874_icon48.png
  3FC333113C2B4835B62DCD762B266874_more.jpg
  4241BB637A4E428696AA5B176904B25F_icon24.png
  4241BB637A4E428696AA5B176904B25F_icon48.png
  467A7D6F4FB84F3BBA97CE5218E3174C_icon24.png
  467A7D6F4FB84F3BBA97CE5218E3174C_icon48.png
  467A7D6F4FB84F3BBA97CE5218E3174C_more.jpg
  4B0CD40E64684EFBB9596337DF1BFCD9_icon24.png
  4B0CD40E64684EFBB9596337DF1BFCD9_icon48.png
  4B0CD40E64684EFBB9596337DF1BFCD9_more.jpg
  4B5C625A1D594B07BD2A5535186DA00D_icon24.png
  4B5C625A1D594B07BD2A5535186DA00D_icon48.png
  4B5C625A1D594B07BD2A5535186DA00D_more.jpg
  4D05EF472458470DA8EF5F5B1C4258B0_icon24.png
  4D05EF472458470DA8EF5F5B1C4258B0_icon48.png
  4D05EF472458470DA8EF5F5B1C4258B0_more.jpg
  565F009C651A4787952DCE8DCAEC7A2F_icon24.png
  565F009C651A4787952DCE8DCAEC7A2F_icon48.png
  5E79B22DC5314A7F8CA44FD6F346D763_icon24.png
  5E79B22DC5314A7F8CA44FD6F346D763_icon48.png
  5E79B22DC5314A7F8CA44FD6F346D763_named_strings.mlsxml
  5F4F26549C094CDEA4BA0531F053A953_icon24.png
  5F4F26549C094CDEA4BA0531F053A953_icon48.png
  5F4F26549C094CDEA4BA0531F053A953_more.jpg
  6580944A1D1042CAAC209DD9E3B09CDB_icon24.png
  6580944A1D1042CAAC209DD9E3B09CDB_icon48.png
  6580944A1D1042CAAC209DD9E3B09CDB_more.jpg
  70A769DCB31D4D59AE936EAC08D29EE4_icon24.png
  70A769DCB31D4D59AE936EAC08D29EE4_icon48.png
  70A769DCB31D4D59AE936EAC08D29EE4_more.jpg
  71333359BE364048AEB3666CC9793DC2_icon24.png
  71333359BE364048AEB3666CC9793DC2_icon48.png
  71333359BE364048AEB3666CC9793DC2_more.jpg
  7583A6C03F894E7DB7977696F2A303B8_icon24.png
  7583A6C03F894E7DB7977696F2A303B8_icon48.png
  7606D527D0F54914BDC42899342D7164_icon24.png
  7606D527D0F54914BDC42899342D7164_icon48.png
  7606D527D0F54914BDC42899342D7164_more.jpg
  76DD75F4114D4980AA886269FB262203_icon24.png
  76DD75F4114D4980AA886269FB262203_icon48.png
  76DD75F4114D4980AA886269FB262203_more.jpg
  791AA5C0E2B842988FC61FF9DE4B1D06_icon24.png
  791AA5C0E2B842988FC61FF9DE4B1D06_icon48.png
  791AA5C0E2B842988FC61FF9DE4B1D06_more.jpg
  791AA5C0E2B842988FC61FF9DE4B1D06_named_strings.mlsxml
  794AA91C407043A88DAD4B086A865B2C_icon24.png
  794AA91C407043A88DAD4B086A865B2C_icon48.png
  794AA91C407043A88DAD4B086A865B2C_more.jpg
  7A35F6B8E3B747518F5737995988E6FB_icon24.png
  7A35F6B8E3B747518F5737995988E6FB_icon48.png
  7A35F6B8E3B747518F5737995988E6FB_more.jpg
  7BD52F8969074343A52FB2FEF12D9285_icon24.png
  7BD52F8969074343A52FB2FEF12D9285_icon48.png
  7BD52F8969074343A52FB2FEF12D9285_more.jpg
  7DB369C197CB421699AA8B7A9C0420FC_icon24.png
  7DB369C197CB421699AA8B7A9C0420FC_icon48.png
  7DB369C197CB421699AA8B7A9C0420FC_more.jpg
  7F5BE4677CC2476AAE329A220A9256D9_icon24.png
  7F5BE4677CC2476AAE329A220A9256D9_icon48.png
  7F8A4A2B676D4EDEB6B6DC6F46FEFE41_icon24.png
  7F8A4A2B676D4EDEB6B6DC6F46FEFE41_icon48.png
  7F8A4A2B676D4EDEB6B6DC6F46FEFE41_more.jpg
  7F8A4A2B676D4EDEB6B6DC6F46FEFE41_named_strings.mlsxml
  7FF925F91B164F79B5B60CF131390434_icon24.png
  7FF925F91B164F79B5B60CF131390434_icon48.png
  7FF925F91B164F79B5B60CF131390434_more.jpg
  7FF925F91B164F79B5B60CF131390434_named_strings.mlsxml
  80D03E349BF44E6D9BCD6BF3006A2379_icon24.png
  80D03E349BF44E6D9BCD6BF3006A2379_icon48.png
  823837D034CA4FC58C73C7108F00081E_icon24.png
  823837D034CA4FC58C73C7108F00081E_icon48.png
  823837D034CA4FC58C73C7108F00081E_more.jpg
  823837D034CA4FC58C73C7108F00081E_named_strings.mlsxml
  827568A28AD44457A81ABC08309D7D62_icon24.png
  827568A28AD44457A81ABC08309D7D62_icon48.png
  827568A28AD44457A81ABC08309D7D62_more.jpg
  82ECD3C4A40D40549198D0A162BFEFBE_icon24.png
  82ECD3C4A40D40549198D0A162BFEFBE_icon48.png
  82ECD3C4A40D40549198D0A162BFEFBE_more.jpg
  856B815D49644E71B7440FBDC105ED28_icon48.png
  86B67BC476C5410CA9C1F0FE1D97BEB2_icon24.png
  86B67BC476C5410CA9C1F0FE1D97BEB2_icon48.png
  86B67BC476C5410CA9C1F0FE1D97BEB2_more.jpg
  86B67BC476C5410CA9C1F0FE1D97BEB2_named_strings.mlsxml
  880C4AF585E7424893A3D22C64C3E597_icon24.png
  880C4AF585E7424893A3D22C64C3E597_icon48.png
  880C4AF585E7424893A3D22C64C3E597_more.jpg
  885D1E7B61B84B46BC70973A9C4327BA_icon24.png
  885D1E7B61B84B46BC70973A9C4327BA_icon48.png
  885D1E7B61B84B46BC70973A9C4327BA_more.jpg
  88C635100B414F1DA4886C1AA7B925FF_icon24.png
  88C635100B414F1DA4886C1AA7B925FF_icon48.png
  88C635100B414F1DA4886C1AA7B925FF_more.jpg
  8BC41031C6CA43DD9DB7DDFA6F73C729_icon24.png
  8BC41031C6CA43DD9DB7DDFA6F73C729_icon48.png
  8BC41031C6CA43DD9DB7DDFA6F73C729_named_strings.mlsxml
  8DC8467972494A2FA46A9106F7003291_icon24.png
  8DC8467972494A2FA46A9106F7003291_icon48.png
  8DC8467972494A2FA46A9106F7003291_more.jpg
  903CB56BA52F42478957BE8314837A86_icon24.png
  903CB56BA52F42478957BE8314837A86_icon48.png
  903CB56BA52F42478957BE8314837A86_more.jpg
  903CB56BA52F42478957BE8314837A86_named_strings.mlsxml
  906D8ACBEDCF4F9ABA608DE65965F0A9_icon24.png
  906D8ACBEDCF4F9ABA608DE65965F0A9_icon48.png
  906D8ACBEDCF4F9ABA608DE65965F0A9_more.jpg
  90F9407DF16A48EAA743527F2C290774_icon24.png
  90F9407DF16A48EAA743527F2C290774_icon48.png
  90F9407DF16A48EAA743527F2C290774_more.jpg
  90F9407DF16A48EAA743527F2C290774_named_strings.mlsxml
  95F12167483D466CABC98CAFE4B4FD93_icon24.png
  95F12167483D466CABC98CAFE4B4FD93_icon48.png
  95F12167483D466CABC98CAFE4B4FD93_more.jpg
  95F12167483D466CABC98CAFE4B4FD93_named_strings.mlsxml
  962C58B9C93944A28A0B82EF9F85A392_icon24.png
  962C58B9C93944A28A0B82EF9F85A392_icon48.png
  962C58B9C93944A28A0B82EF9F85A392_more.jpg
  96A68502084D46D0AD40C0C52D878A1E_icon24.png
  96A68502084D46D0AD40C0C52D878A1E_icon48.png
  97E065B58DB34359BED4D223D737C7E9_icon24.png
  97E065B58DB34359BED4D223D737C7E9_icon48.png
  97E065B58DB34359BED4D223D737C7E9_more.jpg
  99999DACB5D54C46ABDF74397417741F_icon24.png
  99999DACB5D54C46ABDF74397417741F_icon48.png
  99999DACB5D54C46ABDF74397417741F_more.jpg
  9B3841924CC847D7A428DE45431EFC77_icon24.png
  9B3841924CC847D7A428DE45431EFC77_icon48.png
  9B3841924CC847D7A428DE45431EFC77_more.jpg
  9B3841924CC847D7A428DE45431EFC77_named_strings.mlsxml
  9DD0E9094EA9457586DBCCEF6C641617_icon24.png
  9DD0E9094EA9457586DBCCEF6C641617_icon48.png
  9DD0E9094EA9457586DBCCEF6C641617_more.jpg
  9DD0E9094EA9457586DBCCEF6C641617_named_strings.mlsxml
  9E0D937F462E4362A83B254A9F8AB3F8_icon24.png
  9E0D937F462E4362A83B254A9F8AB3F8_icon48.png
  9E0D937F462E4362A83B254A9F8AB3F8_more.jpg
  A2F36B1829EB4E69AC53989EB936C018_icon24.png
  A2F36B1829EB4E69AC53989EB936C018_icon48.png
  A2F36B1829EB4E69AC53989EB936C018_more.jpg
  A38257F4BDAC4615BBE5E0ACDF608896_icon24.png
  A38257F4BDAC4615BBE5E0ACDF608896_icon48.png
  A5D98C699A4049D0A43C1136F38B1B07_icon24.png
  A5D98C699A4049D0A43C1136F38B1B07_icon48.png
  A5D98C699A4049D0A43C1136F38B1B07_more.jpg
  A64E72D796E944EBA048AA1312AC2827_icon24.png
  A64E72D796E944EBA048AA1312AC2827_icon48.png
  A64E72D796E944EBA048AA1312AC2827_more.jpg
  A917D7C9B8D0422E8AF070EED126876E_icon24.png
  A917D7C9B8D0422E8AF070EED126876E_icon48.png
  A917D7C9B8D0422E8AF070EED126876E_more.jpg
  ADEECE83278F48DCBD8FF75E21342C35_icon24.png
  ADEECE83278F48DCBD8FF75E21342C35_icon48.png
  ADEECE83278F48DCBD8FF75E21342C35_more.jpg
  B5403225562D4A258B9F2E4C83852D9F_icon24.png
  B5403225562D4A258B9F2E4C83852D9F_icon48.png
  B5403225562D4A258B9F2E4C83852D9F_more.jpg
  B6699E9B0FC545D88F648101AF84DA49_icon24.png
  B6699E9B0FC545D88F648101AF84DA49_icon48.png
  B6699E9B0FC545D88F648101AF84DA49_named_strings.mlsxml
  B6A7F3A52FFD4934A26DAFDF41C6AC1B_icon24.png
  B6A7F3A52FFD4934A26DAFDF41C6AC1B_icon48.png
  B6A7F3A52FFD4934A26DAFDF41C6AC1B_named_strings.mlsxml
  B7AA6314C6724DE38206EA862EF5A90E_icon24.png
  B7AA6314C6724DE38206EA862EF5A90E_icon48.png
  B7AA6314C6724DE38206EA862EF5A90E_more.jpg
  B9206F7A33BA4CE1BED2DE155CB6D812_icon24.png
  B9206F7A33BA4CE1BED2DE155CB6D812_icon48.png
  B9206F7A33BA4CE1BED2DE155CB6D812_more.jpg
  BD8D6FC5009346649E12CAC16EF2C33B_icon24.png
  BD8D6FC5009346649E12CAC16EF2C33B_icon48.png
  BD8D6FC5009346649E12CAC16EF2C33B_more.jpg
  BD8D6FC5009346649E12CAC16EF2C33B_named_strings.mlsxml
  BFE95A1F90BF4D7CBFCBEF696C13FF58_icon48.png
  C248BA0AB16341EE98466B74579F6923_icon24.png
  C248BA0AB16341EE98466B74579F6923_icon48.png
  C248BA0AB16341EE98466B74579F6923_more.jpg
  C2CBCB8DECC2408BB03E7522D5C3BC28_icon24.png
  C2CBCB8DECC2408BB03E7522D5C3BC28_icon48.png
  C2CBCB8DECC2408BB03E7522D5C3BC28_more.jpg
  C2CBCB8DECC2408BB03E7522D5C3BC28_named_strings.mlsxml
  C2CD97BCD8524DE79DC188FA2460C61A_icon24.png
  C528FFB1B9EC473792CF67849E25EDB6_icon24.png
  C528FFB1B9EC473792CF67849E25EDB6_icon48.png
  C528FFB1B9EC473792CF67849E25EDB6_more.jpg
  C665089E09A74A44B11CBE01878E1049_icon24.png
  C665089E09A74A44B11CBE01878E1049_icon48.png
  C665089E09A74A44B11CBE01878E1049_more.jpg
  C764B54920584E4DB6ED22C76181C663_icon24.png
  C764B54920584E4DB6ED22C76181C663_icon48.png
  C764B54920584E4DB6ED22C76181C663_more.jpg
  C862D5FF867E44C7AF42F7D27E77515D_icon24.png
  C862D5FF867E44C7AF42F7D27E77515D_icon48.png
  CBBF3DD80BDE4A29A723BE906CAFF33B_icon24.png
  CBBF3DD80BDE4A29A723BE906CAFF33B_icon48.png
  CBBF3DD80BDE4A29A723BE906CAFF33B_more.jpg
  CED7EA9B9D5D4C368001CEC627017007_icon24.png
  CED7EA9B9D5D4C368001CEC627017007_icon48.png
  CED7EA9B9D5D4C368001CEC627017007_more.jpg
  D32D9ABFBE354AC8A84F07C309C1E3AF_icon24.png
  D32D9ABFBE354AC8A84F07C309C1E3AF_icon48.png
  D32D9ABFBE354AC8A84F07C309C1E3AF_more.jpg
  D3987B641C134048B815DB578D607F42_icon24.png
  D3987B641C134048B815DB578D607F42_icon48.png
  D3987B641C134048B815DB578D607F42_more.jpg
  D804062847E141ACAE576A54264242C7_icon24.png
  D804062847E141ACAE576A54264242C7_icon48.png
  D804062847E141ACAE576A54264242C7_more.jpg
  D804062847E141ACAE576A54264242C7_named_strings.mlsxml
  D99E0FE328074EBB91C9CF9781C3150D_icon24.png
  D99E0FE328074EBB91C9CF9781C3150D_icon48.png
  D9DE1C0C0B674A588218C5698E2193D3_icon24.png
  D9DE1C0C0B674A588218C5698E2193D3_icon48.png
  D9DE1C0C0B674A588218C5698E2193D3_more.jpg
  D9DE1C0C0B674A588218C5698E2193D3_named_strings.mlsxml
  DDEB1C5957CB432E8BA823B6D3B25E0D_icon24.png
  DDEB1C5957CB432E8BA823B6D3B25E0D_icon48.png
  DDEB1C5957CB432E8BA823B6D3B25E0D_more.jpg
  E0EC36FFC2E841ECBB16385CBF6D932D_icon24.png
  E0EC36FFC2E841ECBB16385CBF6D932D_icon48.png
  E0EC36FFC2E841ECBB16385CBF6D932D_more.jpg
  E12C95FCBD1240FEAE314D89676CA6F8_icon24.png
  E12C95FCBD1240FEAE314D89676CA6F8_icon48.png
  E12C95FCBD1240FEAE314D89676CA6F8_more.jpg
  E12C95FCBD1240FEAE314D89676CA6F8_named_strings.mlsxml
  E1667E89D6F2409287165EA4D8F06DC4_icon24.png
  E1667E89D6F2409287165EA4D8F06DC4_icon48.png
  E1667E89D6F2409287165EA4D8F06DC4_more.jpg
  E1C4A63D24CE4ADC87D41DBEC1B27380_icon24.png
  E1C4A63D24CE4ADC87D41DBEC1B27380_icon48.png
  E1C4A63D24CE4ADC87D41DBEC1B27380_more.jpg
  E5A2E5DE22C1417B977F291A80306500_icon24.png
  E5A2E5DE22C1417B977F291A80306500_icon48.png
  E5A2E5DE22C1417B977F291A80306500_named_strings.mlsxml
  E6EC567C64B94F07A1A0826808B80B28_icon24.png
  E6EC567C64B94F07A1A0826808B80B28_icon48.png
  EB88264BC73E4BA0995109CEAF506A5F_icon24.png
  EB88264BC73E4BA0995109CEAF506A5F_icon48.png
  EB977B98998D4925929512564A60FED8_icon24.png
  EB977B98998D4925929512564A60FED8_icon48.png
  F09C3B9060684346A02C2F528049D062_icon24.png
  F09C3B9060684346A02C2F528049D062_icon48.png
  F09C3B9060684346A02C2F528049D062_more.jpg
  F1C19BF14C0246F693A175DFB7664EAD_icon24.png
  F1C19BF14C0246F693A175DFB7664EAD_icon48.png
  F2B83EECD4CF4910A0260B914BA281BA_icon24.png
  F2B83EECD4CF4910A0260B914BA281BA_icon48.png
  F2B83EECD4CF4910A0260B914BA281BA_more.jpg
  F3053EF74652448F98A5C45703106076_icon24.png
  F3053EF74652448F98A5C45703106076_icon48.png
  F3053EF74652448F98A5C45703106076_more.jpg
  F3053EF74652448F98A5C45703106076_named_strings.mlsxml
  F35E193DC3E84933B83DE961D9AC33BF_icon24.png
  F35E193DC3E84933B83DE961D9AC33BF_icon48.png
  F35E193DC3E84933B83DE961D9AC33BF_more.jpg
  F35E193DC3E84933B83DE961D9AC33BF_named_strings.mlsxml
  F6978F4ED0EB4A2B957D08E37B29E951_icon24.png
  F6978F4ED0EB4A2B957D08E37B29E951_icon48.png
  F6978F4ED0EB4A2B957D08E37B29E951_more.jpg
  FBAB4AF4CB0540E7B40FCE765547F4A1_icon24.png
  FBAB4AF4CB0540E7B40FCE765547F4A1_icon48.png
  FBAB4AF4CB0540E7B40FCE765547F4A1_more.jpg
  FE8E23D36D8A4E3AA10BB1FBB58E9876_icon24.png
  FE8E23D36D8A4E3AA10BB1FBB58E9876_icon48.png
  FE8E23D36D8A4E3AA10BB1FBB58E9876_more.jpg
  FE8E23D36D8A4E3AA10BB1FBB58E9876_named_strings.mlsxml
  FF343C082C7E44418B47411DCB57438D_icon24.png
  FF343C082C7E44418B47411DCB57438D_icon48.png
  FF343C082C7E44418B47411DCB57438D_more.jpg
  ~Please do not delete files from this folder
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\Categories\
  Business.png
  Collaboration.png
  Community.png
  Expression.png
  Featured.png
  GameChannel.png
  GreetingCards.png
  Manage.png
  MostPopular.png
  Movies.png
  MyPlugins.png
  New.png
  Productivity.png
  RemoteAccess.png
  Utilities.png
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\
  collection.ini
  Game List.swf
  Handler.png
  HandlerInfo.dat
  icon24.png
  icon48.png
  Local.png
  named_strings.mlsxml
  PickGame.htm
  pxml.xml
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\Local Cache\
  01E408B224F44A85B5C58CEAFA619E53_icon24.png
  01E408B224F44A85B5C58CEAFA619E53_icon48.png
  01E408B224F44A85B5C58CEAFA619E53_named_strings.mlsxml
  01E408B224F44A85B5C58CEAFA619E53_thumb135x80.jpg
  0827725D5A0C415AB3B72E8ECA712134_icon24.png
  0827725D5A0C415AB3B72E8ECA712134_icon48.png
  0827725D5A0C415AB3B72E8ECA712134_thumb135x80.jpg
  0C99AA2DA06E4F6BA61B15297AA0DBEF_icon24.png
  0C99AA2DA06E4F6BA61B15297AA0DBEF_icon48.png
  0C99AA2DA06E4F6BA61B15297AA0DBEF_thumb135x80.jpg
  164368FE9051439A8E8FB3FE5730FC7C_icon24.png
  164368FE9051439A8E8FB3FE5730FC7C_icon48.png
  164368FE9051439A8E8FB3FE5730FC7C_named_strings.mlsxml
  164368FE9051439A8E8FB3FE5730FC7C_thumb135x80.jpg
  2E06D5039B734EE8A1244F34184BD499_icon24.png
  2E06D5039B734EE8A1244F34184BD499_icon48.png
  2E06D5039B734EE8A1244F34184BD499_named_strings.mlsxml
  2E06D5039B734EE8A1244F34184BD499_thumb135x80.jpg
  4136746E049B4E648BAE5299828AAC2B_icon48.png
  4136746E049B4E648BAE5299828AAC2B_thumb135x80.jpg
  4396EDB7C1A140ADA40B775FEB3C0D25_icon24.png
  4396EDB7C1A140ADA40B775FEB3C0D25_icon48.png
  4396EDB7C1A140ADA40B775FEB3C0D25_thumb135x80.jpg
  454EB22F4CF24AD0B14FBA4A4C21E879_icon24.png
  454EB22F4CF24AD0B14FBA4A4C21E879_icon48.png
  454EB22F4CF24AD0B14FBA4A4C21E879_thumb135x80.jpg
  4C89916128C54976B7A80B10F3C19137_icon24.png
  4C89916128C54976B7A80B10F3C19137_icon48.png
  4C89916128C54976B7A80B10F3C19137_thumb135x80.jpg
  5823ABD88F47457C9D2BF864D89C5FBC_icon24.png
  5823ABD88F47457C9D2BF864D89C5FBC_icon48.png
  5823ABD88F47457C9D2BF864D89C5FBC_thumb135x80.jpg
  6BD422D51C4342F2B6B8AB37C42AA17B_icon24.png
  6BD422D51C4342F2B6B8AB37C42AA17B_icon48.png
  6BD422D51C4342F2B6B8AB37C42AA17B_named_strings.mlsxml
  6BD422D51C4342F2B6B8AB37C42AA17B_thumb135x80.jpg
  7FF10FD1D9E1467181402A0155363CB2_icon24.png
  7FF10FD1D9E1467181402A0155363CB2_icon48.png
  7FF10FD1D9E1467181402A0155363CB2_more.jpg
  7FF10FD1D9E1467181402A0155363CB2_named_strings.mlsxml
  7FF10FD1D9E1467181402A0155363CB2_thumb135x80.jpg
  8CA38853EAF74A618812B5185704FA72_icon24.png
  8CA38853EAF74A618812B5185704FA72_icon48.png
  8CA38853EAF74A618812B5185704FA72_named_strings.mlsxml
  8CA38853EAF74A618812B5185704FA72_thumb135x80.jpg
  8F2BEA1A2B56457AA3182B880C863A52_icon24.png
  8F2BEA1A2B56457AA3182B880C863A52_icon48.png
  8F2BEA1A2B56457AA3182B880C863A52_thumb135x80.jpg
  91B6FD143522487DBC07A35DE803C671_icon24.png
  91B6FD143522487DBC07A35DE803C671_icon48.png
  91B6FD143522487DBC07A35DE803C671_more.jpg
  91B6FD143522487DBC07A35DE803C671_thumb135x80.jpg
  ABC0C93967AD43098E0382FD5EA9DFE1_icon24.png
  ABC0C93967AD43098E0382FD5EA9DFE1_icon48.png
  ABC0C93967AD43098E0382FD5EA9DFE1_named_strings.mlsxml
  ABC0C93967AD43098E0382FD5EA9DFE1_thumb135x80.jpg
  B5362B0B24E14E6B8A330041B208FF78_icon24.png
  B5362B0B24E14E6B8A330041B208FF78_icon48.png
  B5362B0B24E14E6B8A330041B208FF78_more.jpg
  B5362B0B24E14E6B8A330041B208FF78_thumb135x80.jpg
  C1CD45C3F42A43AB899F31B591A5211F_icon24.png
  C1CD45C3F42A43AB899F31B591A5211F_icon48.png
  C1CD45C3F42A43AB899F31B591A5211F_thumb135x80.jpg
  C5094D21049946CC8CCB397AAB28817A_icon24.png
  C5094D21049946CC8CCB397AAB28817A_icon48.png
  C5094D21049946CC8CCB397AAB28817A_named_strings.mlsxml
  C5094D21049946CC8CCB397AAB28817A_thumb135x80.jpg
  C7D94334204347AEBB0F776ED21C7F29_icon24.png
  C7D94334204347AEBB0F776ED21C7F29_icon48.png
  C7D94334204347AEBB0F776ED21C7F29_named_strings.mlsxml
  C7D94334204347AEBB0F776ED21C7F29_thumb135x80.jpg
  CA2E420582B3484EA454CB5E7A1C8892_icon24.png
  CA2E420582B3484EA454CB5E7A1C8892_icon48.png
  CA2E420582B3484EA454CB5E7A1C8892_more.jpg
  CA2E420582B3484EA454CB5E7A1C8892_thumb135x80.jpg
  CE6B3C1D64654E4B8331A1CB0ED028AD_icon24.png
  CE6B3C1D64654E4B8331A1CB0ED028AD_icon48.png
  CE6B3C1D64654E4B8331A1CB0ED028AD_more.jpg
  CE6B3C1D64654E4B8331A1CB0ED028AD_thumb135x80.jpg
  D10AF084E9C547B79DAA4B53C677B141_icon24.png
  D10AF084E9C547B79DAA4B53C677B141_icon48.png
  D10AF084E9C547B79DAA4B53C677B141_named_strings.mlsxml
  D10AF084E9C547B79DAA4B53C677B141_thumb135x80.jpg
  D8F6378E7EE742B9A38730ECE6FA7CCA_icon24.png
  D8F6378E7EE742B9A38730ECE6FA7CCA_icon48.png
  D8F6378E7EE742B9A38730ECE6FA7CCA_thumb135x80.jpg
  DE3FAACAE2834545AADAAE424244F5D8_icon24.png
  DE3FAACAE2834545AADAAE424244F5D8_icon48.png
  DE3FAACAE2834545AADAAE424244F5D8_named_strings.mlsxml
  DE3FAACAE2834545AADAAE424244F5D8_thumb135x80.jpg
  EB659AD2FCC647F38E82982293E1663C_icon24.png
  EB659AD2FCC647F38E82982293E1663C_icon48.png
  EB659AD2FCC647F38E82982293E1663C_named_strings.mlsxml
  EB659AD2FCC647F38E82982293E1663C_thumb135x80.jpg
  EF40E569ACCA4FA3A41083BA475C2102_icon24.png
  EF40E569ACCA4FA3A41083BA475C2102_icon48.png
  EF40E569ACCA4FA3A41083BA475C2102_more.jpg
  EF40E569ACCA4FA3A41083BA475C2102_named_strings.mlsxml
  EF40E569ACCA4FA3A41083BA475C2102_thumb135x80.jpg
  F48988F4365D412F9DDA68C7805772BF_icon24.png
  F48988F4365D412F9DDA68C7805772BF_icon48.png
  F48988F4365D412F9DDA68C7805772BF_thumb135x80.jpg
  F9C6228EE2884EB0B722ECBB9296FA74_icon24.png
  F9C6228EE2884EB0B722ECBB9296FA74_icon48.png
  F9C6228EE2884EB0B722ECBB9296FA74_thumb135x80.jpg
  ~Please do not delete files from this folder
C:\Documents and Settings\All Users\Application Data\Skype\Wallpapers\
  Skype Argyle-Madness.png
  Skype Blue-for-you.png
  Skype Blue-Haze.png
  Skype Brushed metal.png
  Skype Candy-Stripe.png
  Skype Crop-circles.png
  Skype Denim.png
  Skype Diagonal-grey.png
  Skype Ess.png
  Skype Fleur-de-Skype.png
  Skype Gid's-Threads.png
  Skype Giraffe.png
  Skype Grille.png
  Skype Kitchen.png
  Skype Moo-fuel.png
  Skype Moo.png
  Skype Pyjama Party.png
  Skype Rainbow Nation.png
  Skype Rivets.png
  Skype Sand.png
  Skype Shamrock.png
  Skype Wood.png
C:\Documents and Settings\All Users\Application Data\Skype\{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}\
  Skype.msi
C:\Documents and Settings\All Users\Application Data\Skype\{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}\
  Skype.msi
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\
  Statistics.ini
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\
  Checks.080224-0455.log
  Checks.080224-0621.txt
  Checks.080224-0632.log
  Checks.080224-0639.txt
  Checks.080224-1452.log
  Checks.080224-1606.txt
  Fixes.080224-1607.txt
  Update downloads.log
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\
  CiDIEPop.zip
    [0] Type d'archive: ZIP
      --> sbRecovery.reg
        [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
    [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
  CiDIEPop1.zip
    [0] Type d'archive: ZIP
      --> sbRecovery.reg
        [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
    [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
  Swizzor.zip
    [0] Type d'archive: ZIP
      --> sbRecovery.reg
        [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
    [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
  Swizzor1.zip
    [0] Type d'archive: ZIP
      --> sbRecovery.reg
        [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
    [AVERTISSEMENT] La totalité de l'archive est protégée par mot de passe
C:\Documents and Settings\All Users\Application Data\Support.com\profiles\CENZANO\{INSTALL}\
  config.cfg
C:\Documents and Settings\All Users\Application Data\Support.com\profiles\CENZANO\{INSTALL}\issues\
  881ccf0a-2b96-4994-8c7e-e6a79d618e81.cab
  siidx.xml
C:\Documents and Settings\All Users\Application Data\Support.com\profiles\CENZANO\{INSTALL}\prefs\
  default.xml
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\
  ApplicationTemplate.xml
  DeviceTemplate.xml
  NetworkOperatorTemplate.xml
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Applications\
  FileManager.xml
  OCS.xml
C:\Documents and Settings\All Users\Application Data\Teleca\DM\DEVREP\
  devrep.xml
  devrepSchema.xdr
C:\Documents and Settings\All Users\Application Data\TEMP
  TEMP:DFC5A2B2
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data\
  data.dat
C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar\fr-be\
  compfeed.xml
  newext.htm
C:\Documents and Settings\All Users\Application Data\WLInstaller\
  WLI_BS_2008-02-26_15-28-54.log
C:\Documents and Settings\All Users\Bureau\
  Adobe Reader 7.0.lnk
  ASUS WLAN Control Center.lnk
  Avira AntiVir Control Center.lnk
  DivX Converter.lnk
  DivX Player.lnk
  InterVideo WinDVD 4.lnk
  Jeux et musique gratuits.lnk
  Logitech QuickCam.lnk
  Malwarebytes' Anti-Malware.lnk
  MSN Explorer.lnk
  RealPlayer.lnk
  Skype.lnk
C:\Documents and Settings\All Users\Documents\
  desktop.ini
C:\Documents and Settings\All Users\Documents\Ma musique\
  AlbumArtSmall.jpg
  AlbumArt_{79D3A434-2D93-4194-AD18-F79744B5CF43}_Large.jpg
  AlbumArt_{79D3A434-2D93-4194-AD18-F79744B5CF43}_Small.jpg
  Desktop.ini
  Folder.jpg
  music.asx
  music.bmp
  music.wma
C:\Documents and Settings\All Users\Documents\Ma musique\Sync Playlists\1801F2\
  01_Music_auto_rated_at_5_stars.wpl
  02_Music_added_in_the_last_month.wpl
  03_Music_rated_at_4_or_5_stars.wpl
  04_Music_played_in_the_last_month.wpl
  05_Pictures_taken_in_the_last_month.wpl
  06_Pictures_rated_4_or_5_stars.wpl
  07_TV_recorded_in_the_last_week.wpl
  08_Video_rated_at_4_or_5_stars.wpl
  09_Music_played_the_most.wpl
  10_All_Music.wpl
  11_All_Pictures.wpl
  12_All_Video.wpl
C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\
  AlbumArtSmall.jpg
  AlbumArt_{EFFDEB51-C913-4EE1-8B2A-C80112057955}_Large.jpg
  AlbumArt_{EFFDEB51-C913-4EE1-8B2A-C80112057955}_Small.jpg
  desktop.ini
  Folder.jpg
  Symphonie n° 9 de Beethoven (scherzo).wma
  Thumbs.db
C:\Documents and Settings\All Users\Documents\Mes images\
  Desktop.ini
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\
  beste.gif
  desktop.ini
  Mae pour Do cherie.jpg
  Thumbs.db
C:\Documents and Settings\All Users\Documents\Mes vidéos\
  Desktop.ini
C:\Documents and Settings\All Users\DRM\
  drmstore.hds
  drmv2.lic
  drmv2.sst
  migration.log
  v3ks.bla
  v3ks.sec
C:\Documents and Settings\All Users\DRM\Cache\
  Indiv01.tmp
C:\Documents and Settings\All Users\Menu Démarrer\
  Catalogue Windows.lnk
  Configurer les programmes par défaut.lnk
  desktop.ini
  Obtenir OpenOffice.org.lnk
  Windows Update.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\
  Acrobat Reader 5.0.lnk
  Adobe Reader 7.0.lnk
  Connexion facile à Internet.lnk
  desktop.ini
  Lanceur de tâches Microsoft Works.lnk
  MSN Explorer.lnk
  Software Setup.lnk
  Windows Messenger.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\
  Calculatrice.lnk
  Connexion Bureau à distance.lnk
  desktop.ini
  Paint.lnk
  Scanner and Camera Wizard.lnk
  Windows Movie Maker.lnk
  WordPad.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Accessibilité\
  Assistant Accessibilité.lnk
  desktop.ini
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Communications\
  Assistant Configuration du réseau.lnk
  Assistant Nouvelle connexion.lnk
  Assistant Réseau sans fil.lnk
  Connexions réseau.lnk
  desktop.ini
  HyperTerminal.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Divertissement\
  Contrôle du volume.lnk
  desktop.ini
  Magnétophone.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Formation Microsoft Interactive\
  Aide de la Formation Microsoft Interactive.lnk
  Formation Microsoft Interactive.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Outils système\
  Assistant Transfert de fichiers et de paramètres.lnk
  Backup.lnk
  desktop.ini
  Défragmenteur de disque.lnk
  Informations système.lnk
  Nettoyage de disque.lnk
  Restauration du système.lnk
  Table des caractères.lnk
  Tâches planifiées.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ASUS Utility\WLAN Card\
  ASUS WLAN Control Center.lnk
  Mobile Manager.lnk
  One Touch Wizard.lnk
  Site Monitor.lnk
  TroubleShooting.lnk
  Uninstall ASUS WLAN Card Utilities.lnk
  Wireless Settings.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Avira\AntiVir Desktop\
  Aide AntiVir.lnk
  AntiVir sur Internet.lnk
  Démarrer AntiVir.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\
  Chercher les mises à jour DivX.lnk
  Pourquoi acheter DivX Pro .lnk
  Publiez des vidéos DivX® sur votre site web.lnk
  Supprimer l'ensemble DivX.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Codec\
  Enregistrez vos produits.lnk
  Licence.lnk
  ReadMe.lnk
  Supprimer le codec DivX.lnk
  Utilitaire de configuration du décodeur.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Codec\Liens\
  Dernières nouvelles du DivX Codec.lnk
  Découvrez le codec DivX Pro.lnk
  Pourquoi acheter DivX Pro .lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Converter\
  Converter.lnk
  Enregistrez vos produits.lnk
  Licence.lnk
  ReadMe.lnk
  Supprimer le DivX Converter.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Converter\Liens\
  Dernières nouvelle du DivX Converter.lnk
  Découvrez DivX Converter.lnk
  Pourquoi acheter DivX Pro .lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\
  DivX Player.lnk
  Licence.lnk
  ReadMe.lnk
  Supprimer le DivX Player.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\Liens\
  Dernières nouvelles du DivX Player.lnk
  Découvrez DivX Player.lnk
  Plus d’information sur les caractéristiques avancées de DivX.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Plus DirectShow Filters\
  H264 Decoder Config.lnk
  Supprimer le DivX Plus DirectShow Filters.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Web Player\
  Licence.lnk
  ReadMe.lnk
  Supprimer le DivX Web Player.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Web Player\Liens\
  Plus d’information sur DivX Web Player.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\Utile Liens\
  Assistance DivX.lnk
  DivX Labs.lnk
  Forums pour les utilisateurs DivX.lnk
  Matériel DivX.lnk
  Plus d’information sur DivX Author.lnk
  Plus d’information sur le logiciel DivX.lnk
  Plus d’information sur les caractéristiques avancées de DivX.lnk
  Pourquoi acheter DivX Pro .lnk
  Rendez-vous sur DivX.com.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
  desktop.ini
  Lancement rapide d'Adobe Reader.lnk
  Logitech Desktop Messenger.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Jasc Software\
  Animation Shop 3.lnk
  Uninstall Animation Shop 3.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Jeux\
  Atout Pique sur Internet.lnk
  Backgammon sur Internet.lnk
  Dame de pique sur Internet.lnk
  Dame de Pique.lnk
  desktop.ini
  Démineur.lnk
  Freecell.lnk
  Jeu de dames sur Internet.lnk
  Pinball.lnk
  Reversi sur Internet.lnk
  Solitaire.lnk
  Spider Solitaire.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\K-Lite Codec Pack\
  Media Player Classic.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\K-Lite Codec Pack\Configuration\
  AC3Filter.lnk
  Codec Tweak Tool.lnk
  CoreAVC.lnk
  DirectVobSub.lnk
  DivX Decoder.lnk
  ffdshow audio decoder.lnk
  ffdshow VFW interface.lnk
  ffdshow video decoder.lnk
  Haali Media Splitter.lnk
  Reset to recommended settings.lnk
  Xvid Encoder.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\K-Lite Codec Pack\Help\
  FAQ.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\K-Lite Codec Pack\Tools\
  Codec Tweak Tool.lnk
  GraphEdit.lnk
  GSpot Codec Information.lnk
  Haali Muxer.lnk
  VobSubStrip.lnk
  Xvid StatsReader.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\K-Lite Codec Pack\Uninstall\
  Uninstall K-Lite Codec Pack.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Logitech\
  Desktop Messenger.lnk
  Logitech QuickCam.lnk
  Mes photos Logitech.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malwarebytes' Anti-Malware\
  Désinstaller Malwarebytes' Anti-Malware.lnk
  Malwarebytes' Anti-Malware Help.lnk
  Malwarebytes' Anti-Malware.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\
  Microsoft Office Access 2003.lnk
  Microsoft Office Excel 2003.lnk
  Microsoft Office InfoPath 2003.lnk
  Microsoft Office Outlook 2003.lnk
  Microsoft Office PowerPoint 2003.lnk
  Microsoft Office Publisher 2003.lnk
  Microsoft Office Word 2003.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\Outils Microsoft Office\
  Bibliothèque Multimédia Microsoft.lnk
  Certificat numérique pour les projets VBA.lnk
  Microsoft Office 2003 Assistant Enregistrement des paramètres personnels.lnk
  Microsoft Office Access Snapshot Viewer.lnk
  Microsoft Office Document Imaging.lnk
  Microsoft Office Document Scanning.lnk
  Microsoft Office Picture Manager.lnk
  Paramètres linguistiques Microsoft Office 2003.lnk
  Récupération d'applications Microsoft Office.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office Live Add-in\
  Aide d'Office Live Add-in.lnk
  Office Live Workspace.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Works\
  Base de données Microsoft Works.lnk
  Calendrier Microsoft Works.lnk
  Carnet d‘adresses Windows.lnk
  Lanceur de tâches Microsoft Works.lnk
  L‘Album de Works.lnk
  Mise en route.lnk
  Tableur Microsoft Works.lnk
  Traitement de texte Microsoft Works.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Multimedia\DVD Player\
  InterVideo WinDVD 4.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Outil de mise à jour Google\
  Désinstaller l'outil de mise à jour Google.lnk
  Outil de mise à jour Google.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Outils d'administration\
  Analyseur de performances.lnk
  Assistants de Microsoft .NET Framework.lnk
  Configuration de Microsoft .NET Framework.lnk
  desktop.ini
  Gestion de l'ordinateur.lnk
  Observateur d'événements.lnk
  Services de composants.lnk
  Services.lnk
  Sources de données (ODBC).lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Real\
  RealPlayer.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Skype\
  Skype.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Utilities\
  Battery Optimizer.lnk
  Desktop Zoom.lnk
  Quick Lock.lnk
  TV Now - Options.lnk
  TV Now.lnk
  Wireless Configuration.lnk

Destrio5 · Answer

Pas besoin de me poster tout ça.

joyauduciel · Answer

Oui, j'ai des pub. 

Oups ! désolée ! j'ai enfin trouver le système pour vous faire parvenir le foutu rapport ! mais visiblement il ne vous sert à rien ;-)

Destrio5 · Answer

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

joyauduciel · Answer

Comment désactiver AVIRA sans le désinstaller ???

Destrio5 · Answer

Clique droit sur l'icône parapluie en bas à droite et choisis Activer AntiVir Guard et le parapluie va se fermer.

joyauduciel · Answer

Décidemment, rien ne fonctionne comme il faut : 

Message d'erreur au moment du téléchargement de ComboFix : "You cannot  rename ComboFix as ComboFix[1] - Please use another name, preferbaly made up of alphanumeric characters"

Destrio5 · Answer

https://forospyware.com

joyauduciel · Answer

Même problème rencontré avec ce lien --> impossible de télécharger ComboFix ;-(

Destrio5 · Answer

Essaie de le télécharger depuis un autre PC puis transfère-le avec une clé USB par exemple.

joyauduciel · Answer

J'ai réussi à télécharge ComboFix ! Yessssssssssss ! Voici le rapport :

ComboFix 09-08-20.07 - CENZANO 22/08/2009  1:36.1.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.32.1036.18.446.142 [GMT 2:00]
Running from: c:\documents and settings\CENZANO\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
 * Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\CENZANO\LOCALS~1\Temp\install_flash_player.exe
c:ecycler\S-1-5-21-776561741-789336058-1060284298-1003
c:\windows\0101120101464857.xe
c:\windows\0101120101464950.xe
c:\windows\0101120101465653.xe
c:\windows\Installer\268902.msp
c:\windows\Installer\268915.msp
c:\windows\Installer\2b8c8.msp
c:\windows\Installer\59bb62.msp
c:\windows\Installer\75cf9.msp
c:\windows\Installer\79cda4.msp
c:\windows\Installer\7b3012.msp
c:\windows\Installer\8363b5.msp
c:\windows\Installer\a6e202.msp
c:\windows\Installer\dca98c.msp
c:\windows\Installer\dca9a1.msp
c:\windows\prxid93ps.dat

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SfX


(((((((((((((((((((((((((   Files Created from 2009-07-22 to 2009-08-22  )))))))))))))))))))))))))))))))
.

2009-08-20 00:16 . 2009-08-20 00:16	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-08-19 23:59 . 2009-07-28 14:33	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-08-19 23:59 . 2009-03-30 08:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-08-19 23:59 . 2009-02-13 10:28	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2009-08-19 23:59 . 2009-02-13 10:17	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2009-08-19 23:59 . 2009-08-19 23:59	--------	d-----w-	c:\program files\Avira
2009-08-19 23:59 . 2009-08-19 23:59	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-08-19 21:47 . 2009-08-19 21:47	--------	d-----w-	c:\documents and settings\CENZANO\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 21:47 . 2009-08-19 21:47	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-19 21:47 . 2009-08-19 21:47	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-19 21:21 . 2009-08-19 21:21	--------	d-----w-	C:\_OTM
2009-08-19 20:57 . 2009-08-19 23:45	--------	d-----w-	c:\program files	rend micro
2009-08-19 20:57 . 2009-08-19 20:58	--------	d-----w-	C:sit
2009-08-19 20:53 . 2009-08-19 20:53	--------	d-----w-	c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR
2009-08-19 19:36 . 2009-08-19 19:36	--------	d-----w-	C:\UsbFix
2009-08-19 10:12 . 2009-08-19 10:12	38016	----a-w-	c:\windows\system32\drivers\DnsFilter.sys
2009-08-19 10:12 . 2009-08-19 10:12	--------	d-----w-	c:\program files\DDnsFilter
2009-08-12 07:16 . 2009-07-10 13:27	1315328	------w-	c:\windows\system32\dllcache\msoe.dll
2009-08-09 19:02 . 2009-08-09 19:02	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2009-08-09 19:00 . 2009-08-09 19:00	--------	d-----w-	c:\windows\system32\XPSViewer
2009-08-09 18:59 . 2009-08-09 18:59	--------	d-----w-	c:\program files\MSBuild
2009-08-09 18:58 . 2009-08-09 18:58	--------	d-----w-	c:\program files\Reference Assemblies
2009-08-09 18:56 . 2008-07-06 12:06	89088	------w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 18:56 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll
2009-08-09 18:56 . 2008-07-06 10:50	597504	------w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 18:56 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll
2009-08-09 18:56 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 18:56 . 2009-08-09 18:57	--------	d-----w-	C:\30bcd657059f25d6b2
2009-08-09 18:40 . 2009-08-09 18:40	--------	d-sh--w-	c:\documents and settings\NetworkService\IETldCache
2009-08-06 08:53 . 2009-08-06 08:53	--------	d-----w-	c:\documents and settings\CENZANO\Local Settings\Application Data\Deployment
2009-08-05 11:12 . 2009-08-05 11:12	152576	----a-w-	c:\documents and settings\CENZANO\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00	205312	------w-	c:\windows\system32\dllcache\mswebdvd.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-21 23:58 . 2008-02-24 03:42	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-08-21 23:09 . 2009-05-10 21:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-08-20 14:41 . 2007-08-03 17:25	--------	d-----w-	c:\documents and settings\All Users\Application Data\Gram 32 Drv Wipe
2009-08-19 23:31 . 2007-07-02 14:43	--------	d-----w-	c:\program files\Java
2009-08-10 07:02 . 2006-10-31 16:34	61592	----a-w-	c:\documents and settings\CENZANO\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 19:15 . 2002-09-16 14:59	91128	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-09 19:15 . 2002-09-16 14:59	524276	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-05 09:00 . 2002-08-30 02:00	205312	----a-w-	c:\windows\system32\mswebdvd.dll
2009-08-01 10:06 . 2008-12-19 14:02	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-07-25 03:23 . 2008-11-29 15:52	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2002-08-30 02:00	58880	----a-w-	c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 23:09	286208	------w-	c:\windows\system32\wmpdxm.dll
2009-07-08 20:10 . 2006-11-29 19:56	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-07-03 16:57 . 2006-06-23 12:28	915456	----a-w-	c:\windows\system32\wininet.dll
2009-06-25 08:26 . 2002-08-30 02:00	736768	----a-w-	c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2002-08-30 02:00	56832	----a-w-	c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2002-08-30 02:00	54272	----a-w-	c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2002-08-30 02:00	147456	----a-w-	c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2002-08-30 02:00	136192	----a-w-	c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2005-06-15 17:51	301568	----a-w-	c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2002-08-30 02:00	92928	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2002-08-30 02:00	81920	----a-w-	c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 02:00	119808	----a-w-	c:\windows\system32	2embed.dll
2009-06-15 10:44 . 2002-08-30 02:00	78848	----a-w-	c:\windows\system32	elnet.exe
2009-06-10 14:14 . 2002-08-30 02:00	85504	----a-w-	c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2002-08-30 02:00	2066432	----a-w-	c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2002-08-30 02:00	132096	----a-w-	c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2002-08-30 02:00	1297408	----a-w-	c:\windows\system32\quartz.dll
2008-05-04 19:54 . 2008-05-04 19:54	72	----a-w-	c:\program files\0008813279620-01_04.ram
2008-02-26 13:02 . 2008-02-26 13:02	318369	----a-w-	c:\program files\HiJackThis.zip
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-09 67128]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-10 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Desktop Zoom"="c:\program files\HPQ\Desktop Zoom\hpwinadj.exe" [2002-10-09 249856]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [2001-12-12 36864]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"TV Now"="c:\program files\HPQ\Notebook Utilities\TvNow.exe" [2002-11-07 253952]
"Display Settings"="c:\program files\HPQ\Notebook Utilities\hptasks.exe" [2002-08-15 45056]
"QT4HPOT"="c:\progra~1\HPQ\ONE-TO~1\OneTouch.EXE" [2002-10-14 98304]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-09-09 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-09-09 557056]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2002-10-23 176197]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2001-07-19 52736]
"Control Center"="c:\program files\ASUS\WLAN Card Utilities\Center.exe" [2004-11-04 1569280]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-02-01 1103240]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-03-30 198160]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-10 68592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-06-02 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2002-06-11 28672]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2002-06-11 286720]
"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-05-21 4608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Readereader_sl.exe [2008-4-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-3-9 67128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:ddnsfilter

R?2 ddnsfilter;ddnsfilter;c:\windows\sySTEM32\SvchoSt.ExE -k ddnsfilter [30/08/2002 4:00 14336]
R1 DnsFilter;DnsFilter;c:\windows\system32\drivers\DnsFilter.sys [19/08/2009 12:12 38016]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [20/08/2009 1:59 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [19/12/2008 16:00 55136]
R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [6/02/2009 19:08 533360]
R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [30/10/2006 22:41 16269]
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;c:\windows\system32\drivers\caliaud.sys [30/10/2006 16:24 291328]
R3 CALIHALA;CALIHALA;c:\windows\system32\drivers\calihal.sys [30/10/2006 16:24 244608]
R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;c:\windows\system32\drivers\DP83815.sys [18/03/2003 9:29 16512]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\driverst2870.sys [29/01/2008 0:20 476416]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [24/02/2008 5:41 747912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
ddnsfilter	REG_MULTI_SZ   	ddnsfilter
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-10 21:24]

2009-08-21 c:\windows\Tasks\User_Feed_Synchronization-{B2DB3515-4508-44FC-997E-4A80316FCAD8}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{A057A204-BACC-4D26-8287-79A187E26987} - (no file)
HKCU-Run-PcSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mWindow Title = Telenet Internet
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 02:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????9?1?5?5??????? ?X#B?????????????l|B? ?????? 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\WINDOWS\System32\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2156)
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\HPConfig.exe
c:\program files\HPQ\Notebook Utilities\HPWirelessMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\HPQ\One-Touch\ONETOUCH.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\WGATray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-22  2:12 - machine was rebooted
ComboFix-quarantined-files.txt  2009-08-22 00:12

Pre-Run: 6.645.624.832 octets libres
Post-Run: 11.829.534.720 octets libres

244	--- E O F ---	2009-08-17 12:27

Destrio5 · Answer

Ok, je vois, je viens de supprimer la même infection sur un autre forum.

Je reviens d'ici 2 minutes.

Destrio5 · Answer

/!\ Seul joyauduciel peut suivre cette procédure. /!\


1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

Driver::
ddnsfilter
DnsFilter

File::
c:\windows\system32\drivers\DnsFilter.sys 

Folder::
c:\documents and settings\All Users\Application Data\Gram 32 Drv Wipe 
c:\program files\DDnsFilter 
c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR 

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] 
"ddnsfilter"=-






--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.


2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

joyauduciel · Answer

Voici :

ComboFix 09-08-20.07 - CENZANO 22/08/2009  2:37.2.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.32.1036.18.446.190 [GMT 2:00]
Running from: c:\documents and settings\CENZANO\Bureau\ComboFix.exe
Command switches used :: c:\documents and settings\CENZANO\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\windows\system32\drivers\DnsFilter.sys"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Gram 32 Drv Wipe
c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR
c:\documents and settings\CENZANO\Application Data\VMNTOOLBAR\Brussels_BE_weather.txt
c:\program files\DDnsFilter
c:\program files\DDnsFilter\DDnsFilter.dll
c:\windows\system32\drivers\DnsFilter.sys

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DDNSFILTER
-------\Legacy_DNSFILTER
-------\Service_ddnsfilter
-------\Service_DnsFilter
-------\Service_SfX


(((((((((((((((((((((((((   Files Created from 2009-07-22 to 2009-08-22  )))))))))))))))))))))))))))))))
.

2009-08-20 00:16 . 2009-08-20 00:16	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-08-19 23:59 . 2009-07-28 14:33	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-08-19 23:59 . 2009-03-30 08:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-08-19 23:59 . 2009-02-13 10:28	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2009-08-19 23:59 . 2009-02-13 10:17	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2009-08-19 23:59 . 2009-08-19 23:59	--------	d-----w-	c:\program files\Avira
2009-08-19 23:59 . 2009-08-19 23:59	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-08-19 21:47 . 2009-08-19 21:47	--------	d-----w-	c:\documents and settings\CENZANO\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 21:47 . 2009-08-19 21:47	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-19 21:47 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-19 21:47 . 2009-08-19 21:47	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-19 21:21 . 2009-08-19 21:21	--------	d-----w-	C:\_OTM
2009-08-19 20:57 . 2009-08-19 23:45	--------	d-----w-	c:\program files	rend micro
2009-08-19 20:57 . 2009-08-19 20:58	--------	d-----w-	C:sit
2009-08-19 19:36 . 2009-08-19 19:36	--------	d-----w-	C:\UsbFix
2009-08-12 07:16 . 2009-07-10 13:27	1315328	------w-	c:\windows\system32\dllcache\msoe.dll
2009-08-09 19:02 . 2009-08-09 19:02	--------	d-sh--w-	c:\documents and settings\Default User\IETldCache
2009-08-09 19:00 . 2009-08-09 19:00	--------	d-----w-	c:\windows\system32\XPSViewer
2009-08-09 18:59 . 2009-08-09 18:59	--------	d-----w-	c:\program files\MSBuild
2009-08-09 18:58 . 2009-08-09 18:58	--------	d-----w-	c:\program files\Reference Assemblies
2009-08-09 18:56 . 2008-07-06 12:06	89088	------w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 18:56 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 18:56 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll
2009-08-09 18:56 . 2008-07-06 10:50	597504	------w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 18:56 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll
2009-08-09 18:56 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 18:56 . 2009-08-09 18:57	--------	d-----w-	C:\30bcd657059f25d6b2
2009-08-09 18:40 . 2009-08-09 18:40	--------	d-sh--w-	c:\documents and settings\NetworkService\IETldCache
2009-08-06 08:53 . 2009-08-06 08:53	--------	d-----w-	c:\documents and settings\CENZANO\Local Settings\Application Data\Deployment
2009-08-05 11:12 . 2009-08-05 11:12	152576	----a-w-	c:\documents and settings\CENZANO\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00	205312	------w-	c:\windows\system32\dllcache\mswebdvd.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-22 00:53 . 2008-02-24 03:42	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-08-21 23:09 . 2009-05-10 21:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-08-19 23:31 . 2007-07-02 14:43	--------	d-----w-	c:\program files\Java
2009-08-10 07:02 . 2006-10-31 16:34	61592	----a-w-	c:\documents and settings\CENZANO\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 19:15 . 2002-09-16 14:59	91128	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-09 19:15 . 2002-09-16 14:59	524276	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-05 09:00 . 2002-08-30 02:00	205312	----a-w-	c:\windows\system32\mswebdvd.dll
2009-08-01 10:06 . 2008-12-19 14:02	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-07-25 03:23 . 2008-11-29 15:52	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2002-08-30 02:00	58880	----a-w-	c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 23:09	286208	------w-	c:\windows\system32\wmpdxm.dll
2009-07-08 20:10 . 2006-11-29 19:56	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-07-03 16:57 . 2006-06-23 12:28	915456	------w-	c:\windows\system32\wininet.dll
2009-06-25 08:26 . 2002-08-30 02:00	736768	----a-w-	c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2002-08-30 02:00	56832	----a-w-	c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2002-08-30 02:00	54272	----a-w-	c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2002-08-30 02:00	147456	----a-w-	c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2002-08-30 02:00	136192	----a-w-	c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2005-06-15 17:51	301568	----a-w-	c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2002-08-30 02:00	92928	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:40 . 2002-08-30 02:00	81920	----a-w-	c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2002-08-30 02:00	119808	----a-w-	c:\windows\system32	2embed.dll
2009-06-15 10:44 . 2002-08-30 02:00	78848	----a-w-	c:\windows\system32	elnet.exe
2009-06-10 14:14 . 2002-08-30 02:00	85504	----a-w-	c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2002-08-30 02:00	2066432	----a-w-	c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2002-08-30 02:00	132096	----a-w-	c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2002-08-30 02:00	1297408	----a-w-	c:\windows\system32\quartz.dll
2008-05-04 19:54 . 2008-05-04 19:54	72	----a-w-	c:\program files\0008813279620-01_04.ram
2008-02-26 13:02 . 2008-02-26 13:02	318369	----a-w-	c:\program files\HiJackThis.zip
.

(((((((((((((((((((((((((((((   SnapShot@2009-08-22_00.01.38   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-22 00:50 . 2009-08-22 00:50	16384              c:\windows	emp\Perflib_Perfdata_6a8.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-09 67128]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-10 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Desktop Zoom"="c:\program files\HPQ\Desktop Zoom\hpwinadj.exe" [2002-10-09 249856]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [2001-12-12 36864]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"TV Now"="c:\program files\HPQ\Notebook Utilities\TvNow.exe" [2002-11-07 253952]
"Display Settings"="c:\program files\HPQ\Notebook Utilities\hptasks.exe" [2002-08-15 45056]
"QT4HPOT"="c:\progra~1\HPQ\ONE-TO~1\OneTouch.EXE" [2002-10-14 98304]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-09-09 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-09-09 557056]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2002-10-23 176197]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2001-07-19 52736]
"Control Center"="c:\program files\ASUS\WLAN Card Utilities\Center.exe" [2004-11-04 1569280]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-02-01 1103240]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-03-30 198160]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-10 68592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-06-02 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2002-06-11 28672]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2002-06-11 286720]
"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-05-21 4608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Readereader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [19/12/2008 16:00 55136]
R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [30/10/2006 22:41 16269]
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;c:\windows\system32\drivers\caliaud.sys [30/10/2006 16:24 291328]
R3 CALIHALA;CALIHALA;c:\windows\system32\drivers\calihal.sys [30/10/2006 16:24 244608]
R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;c:\windows\system32\drivers\DP83815.sys [18/03/2003 9:29 16512]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\driverst2870.sys [29/01/2008 0:20 476416]
.
Contents of the 'Scheduled Tasks' folder

2009-08-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-10 21:24]

2009-08-21 c:\windows\Tasks\User_Feed_Synchronization-{B2DB3515-4508-44FC-997E-4A80316FCAD8}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mWindow Title = Telenet Internet
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 02:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????9?1?5?5??p???? ?X#B?????????????l|B? ?????? 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\WINDOWS\System32\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3252)
c:\program files\Google\Quick Search Box\bin\1.2.1137.3514\qsb.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Windows Live\Family Safety\fsssvc.exe
c:\windows\system32\HPConfig.exe
c:\program files\HPQ\Notebook Utilities\HPWirelessMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\HPQ\One-Touch\ONETOUCH.EXE
c:\windows\system32\WGATray.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-22  3:06 - machine was rebooted
ComboFix-quarantined-files.txt  2009-08-22 01:06
ComboFix2.txt  2009-08-22 00:12

Pre-Run: 11.837.353.984 octets libres
Post-Run: 11.794.280.448 octets libres

227	--- E O F ---	2009-08-17 12:27

Destrio5 · Answer

--> Menu Démarrer > Exécuter > Tape combofix /u et valide.

--> Télécharge Lop S&D (par Eric_71 & Angeldark) sur ton Bureau.

--> Double-clique dessus pour lancer l'installation.

--> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci de Lop S&D et choisir Exécuter en tant qu'administrateur)

--> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).

--> Patiente jusqu'à la fin du scan.

--> Poste le rapport généré (C:\lopR.txt).

joyauduciel · Answer

Voici :


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : mobile AMD Athlon(tm) XP2400+ )
   BIOS : PhoenixBIOS 4.0 Release 6.0     
   USER : CENZANO ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:27 Go (Free:13 Go)
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( sam. 22/08/2009| 4:35 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [20/08/2009|01:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [20/08/2009|01:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [17/12/2007|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
   [09/10/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EmailNotifier
   [10/05/2009|23:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [22/08/2009|01:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [01/08/2008|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
   [19/08/2009|23:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [18/11/2006|18:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [19/02/2009|06:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [30/10/2006|17:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [01/08/2008|15:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nokia
   [11/02/2009|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
   [03/01/2009|12:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
   [24/02/2008|05:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
   [30/10/2006|16:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [09/05/2009|14:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [14/01/2007|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
   [15/08/2008|12:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [13/10/2007|15:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Support.com
   [14/01/2007|15:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
   [22/08/2009|02:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [08/11/2006|21:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [07/02/2007|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [26/02/2008|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [28/02/2008|21:11] C:\DOCUME~1\CENZANO\APPLIC~1\Adobe
   [07/05/2008|23:24] C:\DOCUME~1\CENZANO\APPLIC~1\AdobeUM
   [03/06/2009|18:27] C:\DOCUME~1\CENZANO\APPLIC~1\DivX
   [09/10/2008|16:24] C:\DOCUME~1\CENZANO\APPLIC~1\EmailNotifier
   [01/11/2006|19:16] C:\DOCUME~1\CENZANO\APPLIC~1\FotoWire
   [24/02/2008|21:16] C:\DOCUME~1\CENZANO\APPLIC~1\Google
   [20/02/2007|17:58] C:\DOCUME~1\CENZANO\APPLIC~1\Help
   [31/10/2006|01:19] C:\DOCUME~1\CENZANO\APPLIC~1\Identities
   [30/10/2006|16:52] C:\DOCUME~1\CENZANO\APPLIC~1\InterTrust
   [02/12/2007|16:24] C:\DOCUME~1\CENZANO\APPLIC~1\InterVideo
   [29/12/2008|03:38] C:\DOCUME~1\CENZANO\APPLIC~1\iPodder
   [14/02/2007|17:09] C:\DOCUME~1\CENZANO\APPLIC~1\Jasc
   [15/08/2008|12:56] C:\DOCUME~1\CENZANO\APPLIC~1\Lavasoft
   [02/08/2008|15:09] C:\DOCUME~1\CENZANO\APPLIC~1\LimeWire
   [01/11/2006|17:10] C:\DOCUME~1\CENZANO\APPLIC~1\Macromedia
   [19/08/2009|23:47] C:\DOCUME~1\CENZANO\APPLIC~1\Malwarebytes
   [29/01/2008|16:16] C:\DOCUME~1\CENZANO\APPLIC~1\Media Player Classic
   [28/05/2009|11:25] C:\DOCUME~1\CENZANO\APPLIC~1\Megaupload
   [19/12/2008|16:05] C:\DOCUME~1\CENZANO\APPLIC~1\Microsoft
   [28/01/2008|14:36] C:\DOCUME~1\CENZANO\APPLIC~1\Mozilla
   [02/08/2008|12:55] C:\DOCUME~1\CENZANO\APPLIC~1\MSN6
   [06/10/2008|22:03] C:\DOCUME~1\CENZANO\APPLIC~1\MySpace
   [03/01/2009|12:03] C:\DOCUME~1\CENZANO\APPLIC~1\Nokia
   [17/01/2008|14:22] C:\DOCUME~1\CENZANO\APPLIC~1\PC Suite
   [24/02/2008|05:41] C:\DOCUME~1\CENZANO\APPLIC~1\PC Tools
   [10/11/2008|00:48] C:\DOCUME~1\CENZANO\APPLIC~1\Real
   [15/03/2007|18:08] C:\DOCUME~1\CENZANO\APPLIC~1\Screenshot Sender
   [10/05/2009|14:22] C:\DOCUME~1\CENZANO\APPLIC~1\Skype
   [10/05/2009|14:17] C:\DOCUME~1\CENZANO\APPLIC~1\skypePM
   [14/01/2007|15:47] C:\DOCUME~1\CENZANO\APPLIC~1\Sony Ericsson
   [20/07/2008|19:08] C:\DOCUME~1\CENZANO\APPLIC~1\Sun
   [14/01/2007|15:48] C:\DOCUME~1\CENZANO\APPLIC~1\Teleca
   [16/02/2007|23:49] C:\DOCUME~1\CENZANO\APPLIC~1\Template
   [28/01/2008|14:36] C:\DOCUME~1\CENZANO\APPLIC~1\Thunderbird

   [31/10/2006|01:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [31/10/2006|01:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [20/08/2009|02:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [28/01/2008|14:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [31/10/2006|01:19] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [22/08/2009 02:50][--a------] C:\WINDOWS	asks\Google Software Updater.job
   [22/08/2009 01:13][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{B2DB3515-4508-44FC-997E-4A80316FCAD8}.job
   [22/08/2009 02:50][--ah-----] C:\WINDOWS	asks\SA.DAT
   [30/08/2002 04:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [04/03/2007|17:49] C:\Program Files\Adobe
   [03/02/2008|14:20] C:\Program Files\Alwil Software
   [31/10/2006|00:49] C:\Program Files\ASUS
   [20/08/2009|01:59] C:\Program Files\Avira
   [10/05/2009|13:42] C:\Program Files\CA VMN Anti-Spyware
   [13/10/2007|15:55] C:\Program Files\Common Files
   [30/10/2006|16:52] C:\Program Files\COMPAQ
   [31/10/2006|01:19] C:\Program Files\ComPlus Applications
   [31/10/2006|09:53] C:\Program Files\CONEXANT
   [03/01/2009|12:00] C:\Program Files\DIFX
   [03/06/2009|18:22] C:\Program Files\DivX
   [03/02/2008|14:10] C:\Program Files\ESET
   [22/08/2009|02:43] C:\Program Files\Fichiers communs
   [10/05/2009|23:27] C:\Program Files\Google
   [30/10/2006|16:59] C:\Program Files\Hewlett-Packard
   [26/02/2008|15:33] C:\Program Files\HiJackThis
   [15/08/2008|12:57] C:\Program Files\Hitman Pro
   [30/10/2006|16:45] C:\Program Files\hp photosmart
   [30/10/2006|16:54] C:\Program Files\HPQ
   [02/06/2009|15:41] C:\Program Files\InstallShield Installation Information
   [31/07/2009|17:04] C:\Program Files\Internet Explorer
   [30/10/2006|16:52] C:\Program Files\InterVideo
   [20/02/2007|17:03] C:\Program Files\Jasc Software Inc
   [20/08/2009|01:31] C:\Program Files\Java
   [27/12/2008|14:38] C:\Program Files\Juice
   [29/01/2008|16:13] C:\Program Files\K-Lite Codec Pack
   [01/11/2006|19:16] C:\Program Files\Logitech
   [27/02/2008|01:01] C:\Program Files\Lopxp
   [19/08/2009|23:47] C:\Program Files\Malwarebytes' Anti-Malware
   [07/09/2008|10:19] C:\Program Files\Messenger
   [08/07/2009|22:10] C:\Program Files\Messenger Plus! Live
   [18/11/2006|18:21] C:\Program Files\MessengerPlus! 3
   [19/12/2008|16:02] C:\Program Files\Microsoft
   [16/05/2007|18:30] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [31/10/2006|01:19] C:\Program Files\microsoft frontpage
   [31/10/2006|01:29] C:\Program Files\Microsoft Office
   [19/12/2008|16:01] C:\Program Files\Microsoft Office Outlook Connector
   [01/08/2009|12:06] C:\Program Files\Microsoft Silverlight
   [09/10/2008|15:12] C:\Program Files\Microsoft SQL Server Compact Edition
   [19/12/2008|15:58] C:\Program Files\Microsoft Sync Framework
   [30/10/2006|16:51] C:\Program Files\Microsoft Works
   [31/10/2006|01:29] C:\Program Files\Microsoft.NET
   [07/09/2008|04:29] C:\Program Files\Movie Maker
   [09/08/2009|20:59] C:\Program Files\MSBuild
   [09/05/2009|13:45] C:\Program Files\MSN
   [31/10/2006|01:19] C:\Program Files\MSN Gaming Zone
   [29/01/2008|19:07] C:\Program Files\MSXML 4.0
   [01/08/2008|15:15] C:\Program Files\MSXML 6.0
   [30/10/2006|17:13] C:\Program Files\MUSICMATCH
   [28/10/2008|15:35] C:\Program Files\MySpace
   [07/09/2008|04:22] C:\Program Files\NetMeeting
   [28/01/2008|14:36] C:\Program Files\Netscape
   [03/01/2009|12:45] C:\Program Files\Nokia
   [17/08/2009|11:29] C:\Program Files\Outlook Express
   [03/01/2009|12:00] C:\Program Files\PC Connectivity Solution
   [28/01/2008|14:36] C:\Program Files\Qualcomm
   [02/06/2009|10:53] C:\Program Files\QuickTime
   [10/11/2008|00:45] C:\Program Files\Real
   [09/08/2009|20:58] C:\Program Files\Reference Assemblies
   [31/10/2006|01:19] C:\Program Files\Services en ligne
   [09/05/2009|14:19] C:\Program Files\Skype
   [14/01/2007|15:43] C:\Program Files\Sony Ericsson
   [16/08/2008|00:29] C:\Program Files\Spybot - Search & Destroy
   [24/02/2008|06:09] C:\Program Files\Spyware Doctor
   [29/07/2008|00:07] C:\Program Files\Sun
   [30/10/2006|16:50] C:\Program Files\Synaptics
   [20/08/2009|01:45] C:\Program Files	rend micro
   [31/10/2006|01:19] C:\Program Files\Uninstall Information
   [25/01/2009|14:53] C:\Program Files\Unity
   [02/07/2007|16:28] C:\Program Files\VirtualDJ
   [09/08/2007|17:11] C:\Program Files\Visicom Media
   [06/07/2007|18:39] C:\Program Files\Vodafone
   [03/05/2009|13:09] C:\Program Files\Winamp Toolbar
   [19/02/2009|06:49] C:\Program Files\Windows Live
   [29/01/2008|19:04] C:\Program Files\Windows Live Favorites
   [19/12/2008|15:48] C:\Program Files\Windows Live SkyDrive
   [09/10/2008|15:11] C:\Program Files\Windows Live Toolbar
   [31/07/2008|01:08] C:\Program Files\Windows Media Connect 2
   [07/09/2008|04:22] C:\Program Files\Windows Media Player
   [07/09/2008|04:22] C:\Program Files\Windows NT
   [31/10/2006|00:09] C:\Program Files\WindowsUpdate
   [31/10/2006|01:19] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [07/05/2008|23:27] C:\Program Files\Fichiers communs\Adobe
   [03/02/2008|14:07] C:\Program Files\Fichiers communs\BitDefender
   [31/10/2006|01:29] C:\Program Files\Fichiers communs\DESIGNER
   [03/06/2009|18:20] C:\Program Files\Fichiers communs\DivX Shared
   [01/11/2006|19:16] C:\Program Files\Fichiers communs\FotoWire
   [14/01/2007|15:41] C:\Program Files\Fichiers communs\InstallShield
   [01/11/2006|19:14] C:\Program Files\Fichiers communs\Logitech
   [20/06/2009|13:48] C:\Program Files\Fichiers communs\Microsoft Shared
   [31/10/2006|01:19] C:\Program Files\Fichiers communs\MSSoap
   [31/10/2006|01:19] C:\Program Files\Fichiers communs\ODBC
   [30/03/2009|11:07] C:\Program Files\Fichiers communs\Real
   [10/05/2009|13:38] C:\Program Files\Fichiers communs\Scanner
   [31/10/2006|01:19] C:\Program Files\Fichiers communs\Services
   [09/05/2009|14:19] C:\Program Files\Fichiers communs\Skype
   [31/10/2006|01:19] C:\Program Files\Fichiers communs\SpeechEngines
   [19/12/2008|16:01] C:\Program Files\Fichiers communs\System
   [09/10/2008|15:00] C:\Program Files\Fichiers communs\Windows Live
   [26/02/2008|16:38] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [30/03/2009|11:08] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 56 Processes )

   iexplore.exe ~ [PID:3700]
   iexplore.exe ~ [PID:404]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\CENZANO\Cookies\cenzano@advertstream[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-08-22 04:38:22
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 106
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:330][D:7]-> C:\DOCUME~1\CENZANO\LOCALS~1\Temp
   [F:579][D:0]-> C:\DOCUME~1\CENZANO\Cookies
   [F:1674][D:4]-> C:\DOCUME~1\CENZANO\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - sam. 22/08/2009| 4:42 - Option : [1]

   --------------------\  Fin du rapport a  4:42:09

Destrio5 · Answer

Le PC fonctionne bien ?

joyauduciel · Answer

Il semble bien fonctionné, oui. Je n'ai plus ces pop-up. Il semble être un peu plus rapide que ces derniers jours (bien que je le trouve encore un peu lent surtout au démarrage)

Destrio5 · Answer

Je trouve que tu as trop de programmes qui se lancent au démarrage.

Tu peux en désactiver avec CCleaner.

joyauduciel · Answer

Trop de programmes au démarrage ??? Je n'ai (à ma connaissance) que Messenger et l'anti-virus...

Destrio5 · Answer

Je vois Winamp, Logitech, etc.

joyauduciel · Answer

Ok, ok, je vais nettoyer tout ça. 

Il me semble que "mes" problèmes soient résolus ?! Je vous remercie vivement pour votre aide et votre patience (surtout ;o))

Destrio5 · Answer

1/

---> Désinstalle HijackThis.

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


2/

---> Télécharge et installe CCleaner Slim.
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage. 


3/

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.


==Prévention==

Pour supprimer les popups d'AntiVir : Lien

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Vérifie que les mises à jour automatiques sont bien activées (Menu Démarrer, clique droit sur Poste de travail, Propriétés, onglet Mises à jour automatiques).

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien


Sois plus vigilant(e) sur Internet ;)

joyauduciel · Answer

ok pour le point 1 et 2 dont voici le rapport ci-après. Par contre, pour le point 3, moi pas comprendre ;-) :

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\_OTM: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\LopSD.exe: trouvé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\lopxp.lnk: trouvé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\UsbFix.lnk: trouvé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Documents and Settings\CENZANO\Recent\UsbFix.lnk: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\lopxp: trouvé !
C:\Program Files\HiJackThis\HijackThis.exe: trouvé !
C:\Program Files\HiJackThis\hijackthis.log: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\LopSD.exe: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\Program Files\HiJackThis\HijackThis.exe: supprimé !
C:\Program Files	rend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\lopxp.lnk: supprimé !
C:\Documents and Settings\CENZANO\Bureau\Raccourcis Bureau non utilisés\UsbFix.lnk: supprimé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Documents and Settings\CENZANO\Recent\UsbFix.lnk: supprimé !
C:\Lop SD\catchme.log: supprimé !
C:\Program Files\HiJackThis\hijackthis.log: supprimé !
C:\Program Files	rend micro\hijackthis.log: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\_OTM: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\CENZANO\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\HijackThis: supprimé !
C:\Program Files\lopxp: supprimé !

Destrio5 · Answer

Tu peux supprimer ToolsCleaner.

Tu bloques où ?

joyauduciel · Answer

Ok, ToolsCleaner supprimé

et pour la désactivation et activation c'est en ordre aussi. En fait, je "bloquais" car je ne comprenais pas l'intérêt mais j'ai pris le temps de lire les explications et les choses sont claires maintenant ;-)

Merci pour les différents liens (prévention) 

Promis, j'essaierai d'être vigilante à l'avenir ! ;-)

Destrio5 · Answer

Désactiver/Réactiver la restauration système sert à supprimer les points de restauration. Les infections aiment bien s'y mettre.

Bonne nuit ;)

joyauduciel · Answer

Encore merciiiiiiiiiiiiiiiiii et bonne nuit à vous aussi ! ;-)

TROJAN GEN. WIN 32

50 réponses

Discussions similaires

Newsletters