Rapport hijackthis

Je fais ce que tu dis et rien d'autre, j'ai pas envie de planter totalement l'ordi, j'en ai un tout petit peu besoin.
Je continue les manips que tu décris et je reviens tout à l'heure.
merci
Gaëlle

D'abord merci pour ta réponse aussi rapide.
Voici les 2 rapports de scan :

ToolBar

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Gaelle ( Administrator )
BOOT : Normal boot
Antivirus : Symantec AntiVirus Corporate Edition 10.1.6.6000 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:56 Go)
E:\ (CD or DVD)
Z:\ (Network Disk) - NTFS - Total:916 Go (Free:345 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 21/08/2009| 9:49 )
C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\Gaelle\Cookies\gaelle@dellfr.myway[2].txt
Supprime! - C:\DOCUME~1\Gaelle\Cookies\gaelle@myway[1].txt
Supprime! - C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.dell.com/fr-fr"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341"
"Default_Page_URL"="https://www.dell.com/fr-fr"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"
"SearchAssistant"="http://www.crawler.com/search/ie.aspx?tb_id=60341"
"CustomizeSearch"="http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341"
"Home_Page"="https://www.dell.com/fr-fr?c=fr&l=fr&s=gen&redirect=1"
"Help_Page"="http://support.euro.dell.com/segment.asp?country=FR&language=FR"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 21/08/2009| 9:50 - Option : [2]

-----------\\ Fin du rapport a 9:50:46,32

Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:49, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Hijackthis\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Dans CCleaner, il reste une erreur non réparable
Voilà ce qu'il me dit :
Le fichier de démarrage C:\WINDOWS\system32\regedit.exe ne peut être localisé. Ce genre de référence est souvent laissé après la désinstallation d'un programme.
Solution : effacer la valeur du registre.
Est-ce que je dois l'effacer, si oui comment ?
Merci
Gaëlle

La suite :

############################## | UsbFix V6.020 |

User : Gaelle (Administrateurs) # MONBLANC
Update on 20/08/09 by Chiquitine29
Start at: 11:10:26 | 21/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Symantec AntiVirus Corporate Edition 10.1.6.6000 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 74,41 Go (57,19 Go free) # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 61,26 Mo (30,09 Mo free) # FAT32
Z:\ -> Connexion réseau # 916,24 Go (345,19 Go free) [GevaudanGaelle] # NTFS

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

F:\autorun.inf # -> fichier appelé : "F:\em8tqm.cmd" ( Absent ! )
Présent ! F:\autorun.inf

################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{6fa2258e-2d7f-11de-aa2d-0014224d9de6}
Shell\AutoRun\command =em8tqm.cmd
Shell\open\Command =em8tqm.cmd

################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.020 ! |

Voilà déjà le rapport UsbFix et je continue les autres scans

############################## | UsbFix V6.020 |

User : Gaelle (Administrateurs) # MONBLANC
Update on 20/08/09 by Chiquitine29
Start at: 11:32:02 | 21/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Symantec AntiVirus Corporate Edition 10.1.6.6000 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 74,41 Go (57,16 Go free) # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 61,26 Mo (30,09 Mo free) # FAT32
Z:\ -> Connexion réseau # 916,24 Go (345,19 Go free) [GevaudanGaelle] # NTFS

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE

################## | Fichiers # Dossiers infectieux |

F:\autorun.inf # -> fichier appelé : "F:\em8tqm.cmd" ( Absent ! )
Supprimé ! F:\autorun.inf

################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |


################## | Listing des fichiers présent |

[19/08/2004 15:18|--a------|0] -> C:\AUTOEXEC.BAT
[03/02/2006 12:18|-rahs----|212] -> C:\boot.ini
[05/08/2004 14:00|-rahs----|4952] -> C:\Bootfont.bin
[19/08/2004 15:18|--a------|0] -> C:\CONFIG.SYS
[31/01/2006 12:55|-rah-----|3715] -> C:\dell.sdr
[30/03/2009 15:56|--ah-----|8017] -> C:\ffastun.ffa
[30/03/2009 15:56|--ah-----|4104192] -> C:\ffastun.ffl
[30/03/2009 15:56|--ah-----|2027520] -> C:\ffastun.ffo
[30/03/2009 15:56|--ah-----|51331072] -> C:\ffastun0.ffx
[?|?|?] -> C:\hiberfil.sys
[23/07/2009 13:57|--a------|9389307] -> C:\immudebug.log
[03/02/2006 18:07|--a------|4128] -> C:\INFCACHE.1
[19/08/2004 15:18|--ah-----|0] -> C:\IO.SYS
[19/08/2004 15:18|--ah-----|0] -> C:\MSDOS.SYS
[05/08/2004 14:00|-rahs----|47564] -> C:\NTDETECT.COM
[26/09/2008 12:19|-rahs----|252240] -> C:\ntldr
[?|?|?] -> C:\pagefile.sys
[21/08/2009 09:50|--a------|2353] -> C:\TB.txt
[21/08/2009 11:34|--a------|3197] -> C:\UsbFix.txt
[17/08/2009 11:00|--a------|31294926] -> F:\mode_op‚ratoire_AnionCation.rtf
[17/08/2009 14:25|--a------|58830] -> F:\test-Conc-MesaGr-AOB-20090817.asy
[18/08/2009 12:38|--a------|72048] -> F:\Test-MMsonde-bacteries-20090818.asy
[18/08/2009 12:57|--a------|429759] -> F:\test-Conc-MesaGr-AOB-20090817result.asy
[18/08/2009 12:58|--a------|560555] -> F:\test-Tm-Sybr-AOB-20090720result.asy
[18/08/2009 16:51|--a------|216308] -> F:\Test-MMsonde-bacteries-20090818result.asy
[21/08/2009 09:08|--a------|44624] -> F:\Bookmarks 2009-08-21.json

################## | Cracks / Keygens / Serials |


################## | Upload |

Veuillez envoyer le fichier : C:\DOCUME~1\Gaelle\Bureau\UsbFix_Upload_Me_MONBLANC.zip : https://www.androidworld.fr/
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.020 ! |

Le rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:15, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.fr/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Le dernier scan :
http://www.cijoint.fr/cjlink.php?file=cj200908/cijyqdDu4v.txt
merci
(Pour info, l'ordi est perso mais des fois je m'en sert pour le boulot d'où le lien vers le disque Z)

Les résultats des scans :

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2668
Windows 5.1.2600 Service Pack 3

21/08/2009 12:27:27
mbam-log-2009-08-21 (12-27-27).txt

Type de recherche: Examen rapide
Eléments examinés: 98514
Temps écoulé: 4 minute(s), 47 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\11801404 (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\11801404\11801404 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\11801404\pc11801404ins (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gaelle\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gaelle\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.

et le second :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:26, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Tes instructions sont vraiment très bien et facile à suivre donc voilà les 2 rapports :

ComboFix 09-08-20.07 - Gaelle 21/08/2009 13:56.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.216 [GMT 2:00]
Running from: c:\documents and settings\Gaelle\Bureau\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\Installer\25158e.msi
c:\windows\Installer\251593.msi
c:\windows\Installer\251598.msi

.
((((((((((((((((((((((((( Files Created from 2009-07-21 to 2009-08-21 )))))))))))))))))))))))))))))))
.

2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-21 10:10 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-21 09:09 . 2009-08-21 09:41 -------- d-----w- C:\UsbFix
2009-08-21 08:55 . 2009-08-21 08:57 -------- d-----w- c:\program files\ZHPDiag
2009-08-21 08:41 . 2009-08-21 08:46 -------- d-----w- c:\program files\CCleaner
2009-08-21 07:48 . 2009-08-21 07:50 -------- d-----w- C:\ToolBar SD
2009-08-21 07:12 . 2009-08-21 10:34 -------- d-----w- C:\Hijackthis
2009-08-20 09:23 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\uic40E.exe
2009-08-20 06:41 . 2009-08-20 06:41 -------- d-sh--w- c:\documents and settings\Gaelle\PrivacIE
2009-08-17 14:59 . 2009-08-17 14:59 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-13 07:09 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 07:49 . 2009-08-10 07:49 152576 ----a-w- c:\documents and settings\Gaelle\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-30 08:15 . 2009-07-03 16:57 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-30 08:15 . 2009-07-03 16:57 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2009-07-23 12:52 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\eah3B.exe
2009-07-23 12:51 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\jpe3A.exe
2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Simply Super Software
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-21 11:54 . 2009-04-03 07:14 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-21 11:46 . 2009-05-05 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 09:35 . 2004-08-19 13:03 64484 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-21 09:35 . 2004-08-19 13:03 446566 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-20 13:39 . 2006-02-03 10:59 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-20 09:25 . 2009-05-12 09:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-17 14:59 . 2004-08-19 13:03 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-08-10 11:56 . 2006-02-03 10:21 -------- d-----w- c:\program files\PowerArchiver
2009-08-10 10:23 . 2009-05-05 09:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 07:55 . 2006-01-31 11:10 -------- d-----w- c:\program files\Java
2009-08-05 09:00 . 2004-08-19 13:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2009-02-18 13:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2004-08-19 13:03 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 06:27 . 2009-05-05 11:39 -------- d-----w- c:\program files\Spyware Terminator
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Firebird
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Eppendorf
2009-07-12 10:21 . 2004-08-19 13:04 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 13:03 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-16 14:40 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-08-19 13:03 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-08-19 13:03 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-19 13:03 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 13:03 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2004-08-19 13:14 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-19 13:03 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2004-08-19 13:03 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-03-26 13:26 . 2008-03-26 13:24 3116521 ----a-w- c:\program files\dialang.exe
2007-05-25 07:31 . 2007-05-25 07:31 4787 ----a-w- c:\program files\legitcheck.hta
.

------- Sigcheck -------

[-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\$NtServicePackUninstall$\ntfs.sys
[7] 2004-08-05 12:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtUninstallKB930916$\ntfs.sys
[7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\dllcache\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\drivers\ntfs.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-05-04 126000]
"_BackupService"="c:\program files\Astase\UltraBackup\4.9\bin\tbs.exe" [2008-02-08 1671168]
"thnotify"="c:\program files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" [2008-02-08 1491456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 34880]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53:UDP"= 53:UDP:Promo

R2 thpassivesvc;Astase ThalliumBackup Client Background Service;c:\program files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe [06/04/2009 08:54 646144]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [21/08/2009 10:02 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [04/05/2007 16:06 119856]
S4 ThalliumServer;Astase ThalliumBackup Storage Service;c:\program files\Astase\UltraBackup\4.9\bin\tbsd.exe [06/04/2009 08:54 1952256]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]

2009-08-21 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-05-05 13:31]
.
.
------- Supplementary Scan -------
.
mWindow Title =
TCP: {63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD} = 147.99.0.16,147.99.0.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Gaelle\Application Data\Mozilla\Firefox\Profiles\p8yfybmu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?source=gama&hl=fr
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
FF - prefs.js: network.proxy.type - 2

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-21 14:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseGuardian]
"ImagePath"="c:\program files\Firebird\bin\ibguard -s"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseServer]
"ImagePath"="c:\program files\Firebird\bin\ibserver -s"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\windows\system32\igfxdev.dll
.
Completion time: 2009-08-21 14:03
ComboFix-quarantined-files.txt 2009-08-21 12:03

Pre-Run: 61 310 795 776 octets libres
Post-Run: 61 270 904 832 octets libres

159 --- E O F --- 2009-08-18 03:45

et Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:15:34, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijackthis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Sur le tutoriel , une fenêtre doit s'ouvrir pour installer la console et quand j'ai lancé combofix, de suite après la fenêtre limitation de garantie il a lancé le scan. Je fais comment pour installer la console s'il ne me le demande pas ?

En fait à la fin du tutoriel il parle de téléchargerle programme sur le site de microsoft, est-ce que je suis ce système et on voit si ça marche ?

Combo :
ComboFix 09-08-20.07 - Gaelle 21/08/2009 15:35.3.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.154 [GMT 2:00]
Running from: c:\documents and settings\Gaelle\Bureau\ske.exe
Command switches used :: c:\documents and settings\Gaelle\Bureau\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((( Files Created from 2009-07-21 to 2009-08-21 )))))))))))))))))))))))))))))))
.

2009-08-21 12:55 . 2009-08-21 13:00 -------- d-s---w- C:\ComboFix
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-21 10:10 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-21 09:09 . 2009-08-21 13:19 -------- d-----w- C:\UsbFix
2009-08-21 08:55 . 2009-08-21 13:17 -------- d-----w- c:\program files\ZHPDiag
2009-08-21 08:41 . 2009-08-21 08:46 -------- d-----w- c:\program files\CCleaner
2009-08-21 07:48 . 2009-08-21 07:50 -------- d-----w- C:\ToolBar SD
2009-08-21 07:12 . 2009-08-21 12:15 -------- d-----w- C:\Hijackthis
2009-08-20 09:23 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\uic40E.exe
2009-08-20 06:41 . 2009-08-20 06:41 -------- d-sh--w- c:\documents and settings\Gaelle\PrivacIE
2009-08-17 14:59 . 2009-08-17 14:59 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-13 07:09 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 07:49 . 2009-08-10 07:49 152576 ----a-w- c:\documents and settings\Gaelle\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-30 08:15 . 2009-07-03 16:57 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-30 08:15 . 2009-07-03 16:57 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2009-07-23 12:52 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\eah3B.exe
2009-07-23 12:51 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\jpe3A.exe
2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Simply Super Software
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-21 13:32 . 2009-04-03 07:14 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-21 11:46 . 2009-05-05 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 09:35 . 2004-08-19 13:03 64484 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-21 09:35 . 2004-08-19 13:03 446566 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-20 13:39 . 2006-02-03 10:59 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-20 09:25 . 2009-05-12 09:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-17 14:59 . 2004-08-19 13:03 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-08-10 11:56 . 2006-02-03 10:21 -------- d-----w- c:\program files\PowerArchiver
2009-08-10 10:23 . 2009-05-05 09:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 07:55 . 2006-01-31 11:10 -------- d-----w- c:\program files\Java
2009-08-05 09:00 . 2004-08-19 13:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2009-02-18 13:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2004-08-19 13:03 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 06:27 . 2009-05-05 11:39 -------- d-----w- c:\program files\Spyware Terminator
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Firebird
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Eppendorf
2009-07-12 10:21 . 2004-08-19 13:04 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 13:03 915456 ------w- c:\windows\system32\wininet.dll
2009-06-16 14:40 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-08-19 13:03 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-08-19 13:03 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-19 13:03 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 13:03 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2004-08-19 13:14 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-19 13:03 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2004-08-19 13:03 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-03-26 13:26 . 2008-03-26 13:24 3116521 ----a-w- c:\program files\dialang.exe
2007-05-25 07:31 . 2007-05-25 07:31 4787 ----a-w- c:\program files\legitcheck.hta
.

------- Sigcheck -------

[-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\$NtServicePackUninstall$\ntfs.sys
[7] 2004-08-05 12:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtUninstallKB930916$\ntfs.sys
[7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\dllcache\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\drivers\ntfs.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-05-04 126000]
"_BackupService"="c:\program files\Astase\UltraBackup\4.9\bin\tbs.exe" [2008-02-08 1671168]
"thnotify"="c:\program files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" [2008-02-08 1491456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 34880]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53:UDP"= 53:UDP:Promo

R2 thpassivesvc;Astase ThalliumBackup Client Background Service;c:\program files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe [06/04/2009 08:54 646144]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [21/08/2009 10:02 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [04/05/2007 16:06 119856]
S4 ThalliumServer;Astase ThalliumBackup Storage Service;c:\program files\Astase\UltraBackup\4.9\bin\tbsd.exe [06/04/2009 08:54 1952256]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SPBBCDRV
*NewlyCreated* - SPBBCSVC

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]

2009-08-21 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-05-05 13:31]
.
.
------- Supplementary Scan -------
.
mWindow Title =
TCP: {63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD} = 147.99.0.16,147.99.0.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Gaelle\Application Data\Mozilla\Firefox\Profiles\p8yfybmu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?source=gama&hl=fr
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
FF - prefs.js: network.proxy.type - 2

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-21 15:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseGuardian]
"ImagePath"="c:\program files\Firebird\bin\ibguard -s"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseServer]
"ImagePath"="c:\program files\Firebird\bin\ibserver -s"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\windows\system32\igfxdev.dll

- - - - - - - > 'explorer.exe'(2104)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-08-21 15:42
ComboFix-quarantined-files.txt 2009-08-21 13:42
ComboFix2.txt 2009-08-21 13:08
ComboFix3.txt 2009-08-21 12:03

Pre-Run: 63 681 400 832 octets libres
Post-Run: 63 662 313 472 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

168 --- E O F --- 2009-08-21 12:11

Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:47:07, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Gaelle\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Fichier C:\Program Files\Firebird\bin\ibserver.exe

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 -
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
F-Secure 8.0.14470.0 2009.08.21 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 1748992 bytes
MD5...: 92dafd2c2416b8041ea239fb2084d5fe
SHA1..: 4a729c2d6bfab4a02d4332f959788a7abe1f9280
SHA256: 0ddce8bcebc0d0b2f14d4e7d09c3aec3835ea6cb8a7b0c677d3806f5f278ea2f
ssdeep: 49152:TzSE319xQCKT+BzkEL5kPsYWW0VGrLCKRLP8hX6d1D8ZqornlbgFjj:TzS
swczkCkfCKRLP801D8Fl8
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1651a0
timedatestamp.....: 0x3c88d92a (Fri Mar 08 15:30:50 2002)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x16472c 0x165000 6.17 fef765211ae90c8220729b72d1cc938d
.rdata 0x166000 0x1d682 0x1e000 5.13 f40c616f81b36e04951b65b1b791bf0f
.data 0x184000 0x2d0e4 0x24000 5.32 d61b83260302a5bef404933dcd541fc2
.rsrc 0x1b2000 0x2c18 0x3000 3.39 dd59d07d0b5e6c3f0c496c76bc5ba1ca

( 9 imports )
> GDI32.dll: SetBkMode, CreateSolidBrush, GetStockObject
> USER32.dll: TranslateMessage, DestroyWindow, GetMessageA, UpdateWindow, DispatchMessageA, SendMessageA, CreateWindowExA, RegisterClassA, LoadCursorA, LoadIconA, MessageBoxA, LoadStringA, FindWindowA, PostQuitMessage, SetFocus, DefWindowProcA, DeleteMenu, GetSystemMenu, DestroyIcon, LoadImageA, ShowWindow, DestroyMenu, TrackPopupMenu, GetCursorPos, SetMenuDefaultItem, AppendMenuA, CreatePopupMenu, SetForegroundWindow, EndDialog, CharToOemA, CharLowerBuffA, GetDlgItemInt, GetWindowLongA, DialogBoxParamA, SetWindowPos, EnableWindow, SetDlgItemInt, GetDlgItem, wsprintfA, GetParent, SetDlgItemTextA, SendDlgItemMessageA, SetCursor, GetSysColor, WinHelpA, SetWindowLongA, PostMessageA
> MSVCRT.dll: _onexit, _controlfp, __dllonexit, __setusermatherr, _initterm, __getmainargs, _isatty, _getcwd, __p__fmode, _stricmp, _strnicmp, _dup2, _getpid, _mktemp, _unlink, _open, _lseek, _read, _close, _umask, _fileno, _acmdln, _XcptFilter, _exit, strrchr, getchar, __p__commode, __set_app_type, putc, fseek, ftell, _setmaxstdio, _splitpath, strncat, _access, _seh_longjmp_unwind, _except_handler3, toupper, strpbrk, fgetc, system, getc, _open_osfhandle, signal, _beginthreadex, abort, strncmp, sscanf, __mb_cur_max, _isctype, _pctype, atol, fgets, free, vsprintf, _fullpath, strtok, localtime, _adjust_fdiv, _ftol, _errno, _iob, fputs, fputc, fflush, getenv, fopen, ctime, fprintf, vfprintf, fclose, _sys_nerr, _sys_errlist, strchr, malloc, memmove, time, strncpy, atoi, longjmp, _setjmp3, printf, exit, _stat, _write, sprintf
> COMCTL32.dll: CreatePropertySheetPageA, PropertySheetA
> WS2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> ADVAPI32.dll: RegCloseKey, ImpersonateNamedPipeClient, RegQueryValueExA, StartServiceCtrlDispatcherA, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegOpenKeyExA, RegisterServiceCtrlHandlerA, QueryServiceConfigA, OpenServiceA, GetUserNameA, RevertToSelf, OpenSCManagerA, ReportEventA, DeregisterEventSource, CloseServiceHandle, SetServiceStatus, RegisterEventSourceA
> MPR.dll: WNetCloseEnum, WNetGetUniversalNameA, WNetEnumResourceA, WNetOpenEnumA
> SHELL32.dll: Shell_NotifyIconA
> KERNEL32.dll: MoveFileA, GetConsoleCP, GetTapeParameters, CreateMutexA, GetFileSize, GetACP, SetFilePointer, SetEndOfFile, FlushViewOfFile, ResetEvent, SetThreadPriority, OpenEventA, SuspendThread, ResumeThread, TlsAlloc, LeaveCriticalSection, EnterCriticalSection, TlsSetValue, DeleteCriticalSection, TlsFree, InitializeCriticalSection, Sleep, ReleaseMutex, OpenMutexA, SetErrorMode, SetEvent, CreateEventA, CreateThread, GetCurrentThread, DuplicateHandle, WaitForSingleObject, CloseHandle, GetModuleHandleA, GetProcAddress, GetLastError, GetModuleFileNameA, GetVersionExA, GetCurrentProcess, GetPriorityClass, SetPriorityClass, GetCurrentProcessId, lstrcpyA, lstrcatA, CreateProcessA, GetCommandLineA, FormatMessageA, SleepEx, ConnectNamedPipe, CreateNamedPipeA, WaitNamedPipeA, CreateFileA, DisconnectNamedPipe, FlushFileBuffers, ReadFile, WriteFile, TerminateThread, ExitThread, CreateSemaphoreA, OpenProcess, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, WaitForMultipleObjects, ReleaseSemaphore, TlsGetValue, GetUserDefaultLangID, VirtualAlloc, VirtualFree, GetTempPathA, GetComputerNameA, SetProcessWorkingSetSize, DeleteFileA, SetTapePosition, GetDriveTypeA, GetShortPathNameA, GetFileInformationByHandle, FreeLibrary, LoadLibraryA, GetCurrentDirectoryA, GetStartupInfoA, IsBadReadPtr, GetCurrentThreadId

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-

fichier : C:\Program Files\Firebird\bin\ibguard.exe

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 -
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 32768 bytes
MD5...: 9ddfdccce76633b074ffafc856a6148d
SHA1..: f76ce7ad1d9629c87d7008b5282bf517565eb2ff
SHA256: 6bb5a67d1ddba95e3ea8bf754f62c53059d1061cdef73f5426b6331a4a91feba
ssdeep: 384:yHAC6BQoC5ZhP/pMk21oXl1HlqA1nw7QJHLh2qS3GOa:YvYQFdxs1oBqynQQ
Jrh9Vd
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x357a
timedatestamp.....: 0x3c874c9a (Thu Mar 07 11:18:50 2002)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x271e 0x3000 5.09 64b85725f7231ba49415a7fe55d753f5
.rdata 0x4000 0xb74 0x1000 3.99 b2ae61ac2b18e6f9d3fa86d0b87fb8dd
.data 0x5000 0x504 0x1000 1.86 9e13c6addf596571e5e675e9f3e0e7c5
.rsrc 0x6000 0x19c8 0x2000 3.16 9980d091a4f788a9aeb52e8208546b0b

( 9 imports )
> gds32.dll: -, -
> ADVAPI32.dll: QueryServiceStatus, DeregisterEventSource, StartServiceCtrlDispatcherA, CloseServiceHandle, ControlService, StartServiceA, OpenServiceA, OpenSCManagerA, RegCloseKey, ReportEventA, RegisterEventSourceA, RegisterServiceCtrlHandlerA, RegQueryValueExA, RegOpenKeyExA, SetServiceStatus
> USER32.dll: LoadImageA, SetClassLongA, SetDlgItemInt, SetDlgItemTextA, GetDlgItem, WinHelpA, SetWindowLongA, GetWindowLongA, ShowWindow, SetForegroundWindow, CreatePopupMenu, AppendMenuA, SetMenuDefaultItem, FindWindowA, SetFocus, PostQuitMessage, TranslateMessage, GetCursorPos, TrackPopupMenu, DestroyMenu, PostMessageA, DispatchMessageA, DestroyIcon, GetSystemMenu, DeleteMenu, DefWindowProcA, UpdateWindow, GetMessageA, LoadCursorA, LoadStringA, MessageBoxA, LoadIconA, RegisterClassA, CreateWindowExA, DestroyWindow, SendMessageA
> GDI32.dll: GetStockObject
> SHELL32.dll: Shell_NotifyIconA
> COMCTL32.dll: PropertySheetA
> MSVCRT.dll: _XcptFilter, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, _controlfp, time, _exit, malloc, _beginthread, free, exit, sprintf, atoi, strrchr, strncpy, localtime
> VERSION.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
> KERNEL32.dll: CreateEventA, SetEvent, Sleep, GetDateFormatA, FormatMessageA, LocalFree, GetModuleFileNameA, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, GetModuleHandleA, SetErrorMode, CreateMutexA, CreateProcessA, CloseHandle, GetStartupInfoA, WaitForSingleObject, ReleaseMutex, GetExitCodeProcess, lstrcpyA, GetVersionExA, GetLastError, GetTimeFormatA, OpenProcess

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
Fichier : c:\windows\system32\dllcache\msoe.dll

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 -
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
F-Secure 8.0.14470.0 2009.08.21 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 1315328 bytes
MD5...: 97b6c66fe04c607d5f530f174b090138
SHA1..: cdd1363c2599cf5241a8da1c80daa6691b8eafa2
SHA256: b7ad8e59b964a04b745a151102a66f9a4fdfe62b067de85e48e14ad9bcf2b32e
ssdeep: 24576:F7FcCZs5NxkRCQOQ2ky9G70ywq+TncVX5d4a77K04L3AkN:fcr5NxkwQ2k
hwOX5d4av/4jAq
PEiD..: -
TrID..: File type identification
DirectShow filter (77.7%)
Win32 Executable MS Visual C++ (generic) (14.5%)
Win32 Executable Generic (3.2%)
Win32 Dynamic Link Library (generic) (2.9%)
Generic Win/DOS Executable (0.7%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x173cd
timedatestamp.....: 0x4a5741bf (Fri Jul 10 13:27:27 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1250a5 0x125200 6.52 d9f4843c46e4a0db128c439460608570
.data 0x127000 0xfc58 0xb000 0.96 c06d614727f526fbdfc81c828b649360
.rsrc 0x137000 0x24d0 0x2600 5.71 779e870b1d2636d9184800b94a1e08c3
.reloc 0x13a000 0xe49c 0xe600 6.41 9b1e18f6210517711b7617531a854e98

( 11 imports )
> ATL.DLL: -, -, -, -, -, -, -, -, -, -
> MSOERT2.dll: UlStripWhitespace, UlStripWhitespaceW, StreamSubStringMatch, _MSG, CreateLogFile, DeleteTempFileOnShutdownEx, CleanupFileNameInPlaceA, GenerateUniqueFileName, IDrawText, PszFromANSIStreamA, FIsHTMLFile, CreateStreamOnHFile, IsDigit, StrToUintA, FBuildTempPath, WriteStreamToFile, CrackNotificationPackage, CreateEnumFormatEtc, FIsEmptyW, HrStreamToByte, HrCreateTridentMenu, HrCheckTridentMenu, HrGetBodyElement, fGetBrowserUrlEncoding, UpdateRebarBandColors, CreateInfoWindow, LoadMappedToolbarBitmap, strtrimW, IUnknownList_CreateInstance, StrTokEx, CchFileTimeToDateTimeW, HrGetElementImpl, HrGetStreamSize, IsHttpUrlA, SetWindowLongPtrAthW, PszDupW, FMissingCert, FIsSpaceA, CleanupFileNameInPlaceW, PszDupLenA, MessageBoxInstW, PszToANSI, HrStreamSeekSet, FIsEmptyA, PszToUnicode, GetExePath, MessageBoxInst, CenterDialog, PszSkipWhiteA, HrSetDirtyFlagImpl, HrLPSZCPToBSTR, HrIStreamWToBSTR, CreateStreamOnHFileW, FIsHTMLFileW, HrCopyStream, HrRewindStream, CopyRegistry, WriteStreamToFileHandle, CreateTempFile, BrowseForFolder, CreateNotify, DoHotMailWizard, ReplaceChars, WriteStreamToFileW, CreateDataObject, CchFileTimeToDateTimeSz, PszEscapeMenuStringA, SetIntlFont, HrIsStreamUnicode, GetHtmlCharset, HrSafeGetStreamSize, HrGetCertKeyUsage, PVGetCertificateParam, SzGetCertificateEmailAddress, CryptAllocFunc, CryptFreeFunc, PszDupA, FIsValidFileNameCharW, OpenFileStream, FBuildTempPathW, PszAllocA, HrLPSZToBSTR, ReplaceCharsW
> MSOEACCT.dll: HrCreateAccountManager, ValidEmailAddress
> INETCOMM.dll: HrAthGetFileNameW, MimeOleCreateSecurity, MimeOleAlgStrengthFromSMimeCap, MimeEditDocumentFromStream, MimeOleGetCertsFromThumbprints, MimeEditViewSource, MimeOleAlgNameFromSMimeCap, MimeOleClearDirtyTree, MimeOleSetBodyPropW, MimeOleParseRfc822AddressW, RichMimeEdit_CreateInstance, MimeOleGetPropertySchema, MimeOleParseRfc822Address, MimeOleSMimeCapGetHashAlg, MimeOleSetCompatMode, MimeOleGetAllocator, MimeOleCreateBody, MimeOleCreateHashTable, CreateIMAPTransport2, MimeOleUnEscapeStringInPlace, MimeOleDecodeHeader, MimeOleGetPropA, MimeOleCreatePropertySet, CreateRangeList, MimeOleCreateMessageParts, CreatePOP3Transport, MimeOleGenerateMID, CreateSMTPTransport, MimeOleStripHeaders, HrAthGetFileName, MimeOleSMimeCapInit, MimeOleSMimeCapAddSMimeCap, MimeOleSMimeCapAddCert, MimeOleSMimeCapGetEncAlg, MimeOleGetCodePageCharset, MimeOleSetDefaultCharset, MimeOleFindCharset, MimeOleGetCharsetInfo, MimeOleGetCodePageInfo, MimeOleGetBodyPropA, MimeOleCreateMessage, MimeOleCreateVirtualStream, MimeOleGetBodyPropW, MimeOleSetBodyPropA, HrGetAttachIconByFile, HrGetAttachIcon, HrFreeAttachData, HrAttachDataFromBodyPart, HrAttachDataFromFile, HrDoAttachmentVerb, MimeOleGetFileInfoW, CreateNNTPTransport, MimeOleInetDateToFileTime, MimeOleSMimeCapsFull
> ADVAPI32.dll: RegCloseKey, CryptAcquireContextA, RegQueryValueA, RegDeleteValueA, RegOpenKeyA, RevertToSelf, AllocateAndInitializeSid, FreeSid, ImpersonateLoggedOnUser, OpenThreadToken, RegQueryValueExA, RegOpenKeyExA, RegEnumKeyExA, RegQueryInfoKeyA, RegCreateKeyExA, RegSetValueExA, RegDeleteKeyA, RegEnumKeyA, CloseServiceHandle, RegEnumValueA, EnumServicesStatusA, OpenSCManagerA, GetTokenInformation, OpenProcessToken, EqualSid
> GDI32.dll: CreateFontIndirectA, GetObjectA, GetDeviceCaps, CreateSolidBrush, SetBkColor, DeleteObject, GetTextMetricsA, SelectObject, RestoreDC, SetBkMode, SaveDC, DeleteDC, BitBlt, TextOutA, TextOutW, CreateCompatibleBitmap, CreateCompatibleDC, PatBlt, LineTo, MoveToEx, CreatePen, SetTextAlign, CreateRectRgnIndirect, DeleteMetaFile, CloseMetaFile, Polyline, CreateFontA, GetTextExtentPointA, SelectPalette, RealizePalette, GetPixel, StretchBlt, EnumFontFamiliesExA, Rectangle, Ellipse, SetWindowExtEx, SetWindowOrgEx, CreateMetaFileA, SetViewportOrgEx, SetMapMode, LPtoDP, Polygon, GetTextExtentPoint32A, ExtTextOutA, SetTextColor
> KERNEL32.dll: HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, InterlockedExchange, VirtualQuery, UnhandledExceptionFilter, GetOEMCP, GetCPInfo, SetFilePointer, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetStdHandle, VirtualProtect, FlushFileBuffers, GetProcessHeap, GetWindowsDirectoryA, HeapSize, CreateDirectoryA, GetShortPathNameW, GetShortPathNameA, GetSystemDefaultLangID, GetUserDefaultLangID, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, RtlUnwind, HeapReAlloc, GetEnvironmentStringsW, lstrcmpiA, lstrcpynA, FreeLibrary, GetProcAddress, LoadLibraryA, GetVersionExA, ExpandEnvironmentStringsA, GetSystemDirectoryA, lstrlenA, GetACP, SystemTimeToFileTime, GetSystemTime, lstrlenW, LoadLibraryExA, GetLastError, SizeofResource, LockResource, LoadResource, FindResourceA, LeaveCriticalSection, lstrcmpA, EnterCriticalSection, FindClose, FindFirstFileA, GetCurrentThreadId, GetLocaleInfoA, GetModuleFileNameA, DeleteCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalLock, GlobalSize, GlobalFree, GlobalAlloc, InterlockedIncrement, InterlockedDecrement, LocalFree, CompareFileTime, WideCharToMultiByte, LocalAlloc, GetSystemTimeAsFileTime, FormatMessageA, MultiByteToWideChar, MulDiv, GetLocaleInfoW, GetUserDefaultLCID, RtlMoveMemory, CloseHandle, CreateMutexA, SetErrorMode, Sleep, GetTickCount, ReleaseMutex, WaitForSingleObject, IsDBCSLeadByte, GlobalReAlloc, IsBadReadPtr, GetCurrentProcessId, TlsSetValue, TlsGetValue, TlsAlloc, TlsFree, OpenFile, DeleteFileA, GetTempFileNameA, GetTempPathA, FormatMessageW, GetProfileIntA, FlushInstructionCache, GetCurrentProcess, GetCurrentThread, GetModuleHandleA, IsBadWritePtr, FileTimeToSystemTime, FileTimeToLocalFileTime, IsBadStringPtrA, GetVersion, MoveFileA, GetDiskFreeSpaceA, FindNextFileA, GetDriveTypeA, ExitProcess, GetExitCodeProcess, CreateProcessA, SetThreadPriority, SetEvent, CreateThread, CreateEventA, IsDBCSLeadByteEx, SetLastError, GetFileAttributesA, GetEnvironmentVariableA, CreateFileA, GetSystemInfo, GetCommandLineA, HeapAlloc, HeapFree
> ole32.dll: OleSetClipboard, CLSIDFromString, DoDragDrop, CoTaskMemRealloc, PropVariantCopy, CoDisconnectObject, CoInitialize, CoUninitialize, CreateStreamOnHGlobal, StringFromGUID2, CreateDataAdviseHolder, OleRegGetMiscStatus, OleRegGetUserType, OleRegEnumVerbs, CoTaskMemFree, OleSaveToStream, CoGetMalloc, CoTaskMemAlloc, OleInitialize, OleUninitialize, CreateOleAdviseHolder, OleRun, WriteClassStm, CoLockObjectExternal, RegisterDragDrop, RevokeDragDrop, ReadClassStm, ReleaseStgMedium, CoCreateInstance, PropVariantClear
> USER32.dll: WinHelpA, CheckRadioButton, DrawTextExA, SetMenuDefaultItem, IsDialogMessageA, GetAsyncKeyState, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, DrawFocusRect, FindWindowExA, GetMessageA, PostThreadMessageA, GetMessagePos, GetCursorPos, CharLowerA, TranslateAcceleratorA, GetNextDlgTabItem, GetSubMenu, IsMenu, ModifyMenuA, UnionRect, PtInRect, GetClassInfoExA, RegisterClassExA, IntersectRect, EqualRect, SetWindowRgn, UnregisterClassA, IsIconic, UpdateWindow, RemoveMenu, GetWindowDC, RegisterClipboardFormatA, GetMenuStringA, CheckMenuRadioItem, SetParent, DrawEdge, ActivateKeyboardLayout, ClientToScreen, GetDlgCtrlID, GetKeyboardLayoutList, ReleaseCapture, SetCapture, AdjustWindowRectEx, CopyRect, LoadMenuA, GetCapture, GetWindowPlacement, SetWindowPlacement, WindowFromPoint, IsChild, GetKeyState, LoadAcceleratorsA, GetForegroundWindow, CheckMenuItem, DeleteMenu, PostQuitMessage, LoadImageA, DestroyIcon, EnumWindows, GetClassNameA, GetSysColorBrush, FillRect, InflateRect, GetDlgItemInt, SetDlgItemInt, GetDlgItemTextW, SendDlgItemMessageW, SetDlgItemTextW, MessageBeep, CreateDialogParamA, KillTimer, PeekMessageA, TranslateMessage, DispatchMessageA, SetTimer, SystemParametersInfoA, MoveWindow, RegisterWindowMessageA, SetForegroundWindow, GetDlgItemTextA, InsertMenuItemA, SendDlgItemMessageA, GetSystemMetrics, GetMenu, GetMenuItemInfoA, InsertMenuA, IsWindowUnicode, SetDlgItemTextA, CheckDlgButton, CreatePopupMenu, AppendMenuA, GetMenuItemCount, SetMenuItemInfoA, DestroyMenu, OffsetRect, SetPropA, IsDlgButtonChecked, LoadIconA, GetDC, DrawTextA, ReleaseDC, SetWindowTextA, DialogBoxParamA, SetActiveWindow, EnableWindow, EnumThreadWindows, IsWindowEnabled, GetActiveWindow, GetLastActivePopup, IsWindowVisible, GetWindowThreadProcessId, GetWindow, MapWindowPoints, TrackPopupMenuEx, PostMessageA, SetFocus, GetClassInfoA, RegisterClassA, CreateWindowExA, BeginPaint, EndPaint, DefWindowProcA, DestroyWindow, EnableMenuItem, GetWindowRect, ScreenToClient, SetRect, GetDlgItem, GetWindowTextLengthA, GetWindowTextA, GetPropA, GetSysColor, CallWindowProcA, GetClientRect, SetWindowPos, InvalidateRect, ShowWindow, SetWindowLongA, RemovePropA, LoadCursorA, SetCursor, IsWindow, GetWindowLongA, GetParent, SendMessageA, CharNextA, GetFocus, MessageBoxA, EndDialog, CharPrevA, GetDesktopWindow, LoadStringA, DrawStateA, GetUpdateRect, IsZoomed, WaitForInputIdle, IsCharAlphaA, IsCharAlphaNumericA, GetMenuItemID, SendMessageW, GetMenuState, TrackPopupMenu, RedrawWindow, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, AdjustWindowRect, SetMenu, CharUpperA, EnumChildWindows, LoadStringW, LoadBitmapA, GetDoubleClickTime, ValidateRect, DrawIconEx, DrawFrameControl
> SHLWAPI.dll: SHRegGetValueW, -, StrChrA, PathRemoveBackslashW, StrStrIW, PathStripPathW, PathAddExtensionW, PathIsRootA, PathIsContentTypeW, SHCreateShellPalette, SHGetValueW, SHSetValueW, PathCombineW, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, SHQueryInfoKeyA, SHEnumKeyExA, StrToIntExA, StrStrW, StrNCatW, wvnsprintfA, PathCombineA, PathFindExtensionA, PathFindFileNameA, StrFormatByteSizeA, PathCanonicalizeA, PathRemoveBackslashA, PathIsDirectoryA, SHCopyKeyA, PathGetArgsA, PathRemoveArgsA, PathUnquoteSpacesA, StrDupW, PathFindExtensionW, StrRChrIW, StrCatBuffW, StrCmpNIW, SHAutoComplete, UrlApplySchemeW, StrStrIA, SHRegGetBoolUSValueA, PathRemoveExtensionW, PathCompactPathExW, PathAppendA, PathIsDirectoryW, PathFileExistsW, PathFindFileNameW, PathIsFileSpecW, StrDupA, PathIsURLW, PathRemoveFileSpecA, PathRemoveFileSpecW, UrlUnescapeA, SHDeleteValueA, SHSetValueA, StrCmpW, StrCSpnW, StrCSpnA, StrCmpIW, SHQueryValueExA, PathFileExistsA, StrToIntA, wnsprintfW, StrCmpNIA, UrlEscapeA, StrCpyNW, PathAddBackslashA, SHGetValueA, StrStrA, SHDeleteKeyA, StrCatBuffA, wnsprintfA
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -

( 32 exports )
BMAPIAddress, BMAPIDetails, BMAPIFindNext, BMAPIGetAddress, BMAPIGetReadMail, BMAPIReadMail, BMAPIResolveName, BMAPISaveMail, BMAPISendMail, CoStartOutlookExpress, DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, FIsDefaultMailConfiged, FIsDefaultNewsConfiged, ImportMailStoreToGUID, ImportNewsListToGUID, MAPIAddress, MAPIDeleteMail, MAPIDetails, MAPIFindNext, MAPIFreeBuffer, MAPILogoff, MAPILogon, MAPIReadMail, MAPIResolveName, MAPISaveMail, MAPISendDocuments, MAPISendMail, SetDefaultMailHandler, SetDefaultNewsHandler
PDFiD.: -
RDS...: NSRL Reference Data Set
-

Je vais devoir m'arrêter car j'ai des enfants à aller chercher et je ne pourrais pas m'occuper de l'ordi ce week-end.
Est-ce qu'il y a moyen de continuer lundi , je relancerais virus total à ce moment là.
Est-ce que je peux éteindre l'ordi et le relancer lundi matin ou je le laisse allumer ?
En tout cas merci beaucoup pour ton aide
Gaëlle

Fichier c:\windows\system32\drivers\beep.sys
Résultat: 1/40 (2.5%)

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 Win32.Banker
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
F-Secure 8.0.14470.0 2009.08.21 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 4224 bytes
MD5...: da1f27d85e0d1525f6621372e7b685e9
SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260
SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d
ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/
DKrmLGWBqhev7X+MEWKLu+Ww8
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x66c
timedatestamp.....: 0x3b7d82e5 (Fri Aug 17 20:47:33 2001)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d
.rdata 0x780 0xad 0x100 2.62 0ace5f365131534c66de4137833221ad
INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99
.rsrc 0xb80 0x3c8 0x400 3.22 9b654fc1759147ff04b147754f347be4
.reloc 0xf80 0x9a 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57

( 2 imports )
> ntoskrnl.exe: MmLockPagableDataSection, KeCancelTimer, MmUnlockPagableImageSection, IoStartNextPacket, KeSetTimer, _allmul, IoStartPacket, KeInitializeEvent, KeInitializeTimer, KeInitializeDpc, IoCreateDevice, RtlInitUnicodeString, IoAcquireCancelSpinLock, KeRemoveDeviceQueue, KeRemoveEntryDeviceQueue, IoReleaseCancelSpinLock, IoDeleteDevice, IofCompleteRequest
> HAL.dll: ExReleaseFastMutex, KfRaiseIrql, KfLowerIrql, HalMakeBeep, ExAcquireFastMutex

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set

( Topics Entertainment )

> Instant Home Design: beep.sys

( Symantec )

> Norton SystemWorks 2005: BEEP.SYS

( Compaq )

> Compaq Operating System CD: beep.sys

( NewTech Infosystems Inc. )

> CD-Maker Plus Edition: beep.sys

( The Learning Company Inc. )

> Reader Rabbits Toddler: beep.sys

( Dell )

> Reinstallation CD Microsoft Windows XP Professional: beep.sys

( Microsoft )

> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sys
> MSDN Disc 2466.2: beep.sys
> MSDN Disc 2466.1: beep.sys
> MSDN Disc 2466.4: beep.sys
> MSDN Disc 2465: beep.sys
> MSDN Disc 2464: beep.sys
> MSDN Disc 2466: beep.sys
> Windows XP: beep.sys
> Microsoft TechNet Trial Software 2002 Volume 1: beep.sys
> MSDN Disc2389: beep.sys
> MSDN disc 2455.2: beep.sys
> Windows 98 Versions: beep.sys
> MSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sys
> MSDN Disc 2438.7: beep.sys
> MSDN Disc 2438.2: beep.sys
> MSDN Disc 2438.1: beep.sys
> MSDN Disc 3264: beep.sys
> MSDN Disc 2455: beep.sys
> MSDN Disc 2438.8: beep.sys
> MSDN Disc 2428.1: beep.sys
> MSDN Disc 2428.2: beep.sys
> MSDN Disc 2428.5: beep.sys
> MSDN Disc 2428.4: beep.sys
> MSDN Disc 2428.8: beep.sys
> Platforms, SDK/DDK: beep.sys
> Internet Explorer Versions: beep.sys
> Virtual PC for Mac Windows XP Professional Edition: beep.sys
> Platforms: beep.sys
> MSDN DISC 2438.3: beep.sys
> Platforms SDKs/DDKs: beep.sys
> MSDN Disc 2053: beep.sys
> MSDN Disc 2444: beep.sys
> MSDN Disc 2443: beep.sys
> MSDN Disc 2442: beep.sys
> MSDN Disc 2441: beep.sys
> Internet Explorer: beep.sys
> MSDN Disc2428.3: beep.sys
> MSDN Disc 1550: beep.sys
> MSDN Disc 2455.6: beep.sys
> MSDN Disc 2455.1: beep.sys
> MSDN Disc 2476.1: beep.sys
> MSDN Disc 2476.2: beep.sys
> 2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sys
> Disc 2438.5: beep.sys
> 2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys
> MSDN Disc 2041: beep.sys
> MSDN Disc 2439.3: beep.sys
> MSDN Disc 2439.2: beep.sys
> MSDN Disc 2439.1: beep.sys
> MSDN Disc 2439.7: beep.sys
> MSDN Disc 2439.6: beep.sys
> MSDN Disc 2438: beep.sys
> MSDN Disc 2439: beep.sys
> MSDN Disc 2465.4: beep.sys
> MSDN Disc 2465.5: beep.sys
> MSDN Disc 2465.2: beep.sys
> Windows XP Professional: beep.sys
> MSDN Disc 2364: beep.sys
> Office XP Professional with FrontPage: beep.sys
> Microsoft Windows XP Professional: beep.sys
> Windows XP Professional 2002 Service Pack 1: beep.sys
> MSDN Disc 2443.1: beep.sys
> MSDN Disc 2443.2: beep.sys
> MSDN Disc 2443.4: beep.sys
> MSDN disc 2465.3: beep.sys
> MSDN Disc 2441.1: beep.sys
> MSDN Disc 2441.6: beep.sys
> MSDN Disc 2441.7: beep.sys
> MSDN Disc 2441.5: beep.sys
> MSDN Disc 2428: beep.sys
> MSDN Disc 2477.2: beep.sys
> Windows XP Home Edition: beep.sys
> Windows CE .NET Evaluation Software: beep.sys
> MSDN Disc 2307: beep.sys
> Implementing and Supporting Microsoft Windows XP Professional: beep.sys
> MSDN Disc 2464.1: beep.sys
> MSDN Disc 2464.5: beep.sys
> MSDN Disc 2439.8: beep.sys
> MSDN Disc 2440.5: beep.sys
> MSDN Disc 2440.4: beep.sys
> MSDN Disc 2440.3: beep.sys
> MSDN Disc2365: beep.sys
> MDSN Disc 2441.2: beep.sys
> Platforms, SDK/DDK, Developer Tools: beep.sys
> MSDN disc 2390: beep.sys
> MSDN Disc 2476.4: beep.sys
> Microsoft Security Resource Kit: beep.sys
> Windows 2000 Versions: beep.sys
> MSDN Disc 2444.3: beep.sys
> MSDN Disc 2444.1: beep.sys
> MSDN Disc 2444.6: beep.sys
> MSDN Disc 2444.4: beep.sys
> Virtual PC for Mac Windows XP Home Edition: beep.sys
> Windows XP eMbedded Evaluation Software: beep.sys
> MSDN Disc 2476: beep.sys
> MSDN Disc 2442.4: beep.sys
> MSDN Disc 2442.6: beep.sys
> MSDN Disc 2442.1: beep.sys
> Applications, Platforms, Servers: beep.sys
> MSDN Disc 2442.3: beep.sys
> MSDN Disc 2442.2: beep.sys
> Windows XP Tablet PC Edition: beep.sys
> Applications, Platforms: beep.sys

( Sony )

> Sony VAIO Recover CDs: BEEP.SYS

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS,beep.sys

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=da1f27d85e0d1525f6621372e7b685e9' target='_blank'>https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9</a>

Suppression OK

Il faut vraiment que je parte, est-ce que lundi on peux continuer ?
Encore merci
Gaëlle

Je vais laisser mon ordi allumer tout le week-end mais déconnecté.
et je ferais tes manips lundi. Mes enfants ne peuvent pas m'attendre, désolée.
Je te remercie pour ton aide et j'espère te retrouver lundi
Merci
Gaëlle

La suite le rapport GenProc

Rapport GenProc 2.615 [1] - 24/08/2009 à 10:38:39
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.0.13) [Navigateur par défaut]

~~ "C:\WINDOWS\sed.exe" a été renommé sed.exe_RenameGenProc ~~
~~ "C:\WINDOWS\grep.exe" a été renommé grep.exe_RenameGenProc ~~

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :


Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt




~~~~ INFORMATION COMPLEMENTAIRE ~~~~


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:41, on 24/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Genproc\outil\Gaelle_GenProc.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Voilà le rapport-OAD

24/08/2009 ---- 11:47:59,37

----------------------------------
§§§§§§ [MyWay Search Assistant] §§§§§§
----------------------------------
[X] Registre
[ ] Fichier (rapide)
[ ] Fichier (disque systeme)
[X] Fichier (complete)




********************
[Registre]
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8829557EB322C354F96043E0B32EE193]
"ProductName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties]
"DisplayName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}]
"DisplayName"="MyWay Search Assistant"

*******************
[Fichier]
*******************



*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté


----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

Le rapport OTM

All processes killed
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8829557EB322C354F96043E0B32EE193\\ProductName deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties\\DisplayName deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}\\DisplayName deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Gaelle
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\Gaelle\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 49286 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 51125372 bytes

User: INRA
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 220085 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 33645926 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 81,21 mb


OTM by OldTimer - Version 3.0.0.6 log created on 08242009_120930

Files moved on Reboot...

Registry entries deleted on Reboot...

Le rapport TCcleaner

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Combofix: trouvé !
C:\HijackThis: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\_OTM: trouvé !
C:\Toolbar SD: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Gaelle\Bureau\OTM.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Gaelle\Bureau\OAD.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Genproc\Genproc.exe: trouvé !
C:\Genproc\outil\hijackthis.log: trouvé !
C:\Genproc\outil\mbr.exe: trouvé !
C:\Genproc\Page\GenProc[*].html: trouvé !
C:\Hijackthis\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\Gaelle\Bureau\OTM.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Gaelle\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Gaelle\Bureau\OAD.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\Rsit.exe: supprimé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Genproc\Genproc.exe: supprimé !
C:\Genproc\outil\hijackthis.log: supprimé !
C:\Genproc\outil\mbr.exe: supprimé !
C:\Genproc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Hijackthis\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Combofix: supprimé !
C:\HijackThis: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\_OTM: supprimé !
C:\Toolbar SD: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\ZHPDiag: supprimé !

Voilà enfin le rapport de Panda :

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-08-24 15:45:00
PROTECTIONS: 1
MALWARE: 1
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Symantec AntiVirus Corporate Edition 10.1.6.6000 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00149064 Cookie/Maxserving TrackingCookie No 0 Yes No C:\Documents and Settings\INRA\Cookies\inra@maxserving[2].txt
;===================================================================================================================================================================================
SUSPECTS
Sent Location a
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description a
;===================================================================================================================================================================================
;===================================================================================================================================================================================