Envahie par SaveDefense -- HELP

salut et Merci NARCO pour ton aide!!!!
voici le rapport...


Rapport GenProc 2.617 [4] - 28/08/2009 à 17:20:30
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.5.2) [Navigateur par défaut]

~~ CM DISK ERROR ~~
~~ INTERRUPTION REQUETES COMPTEURMAX ~~

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :


Fais scanner le(s) fichier(s) suivant(s) sur ce site https://www.virustotal.com/gui/ :


C:\WINDOWS\1113259ruz1a.exe
C:\WINDOWS\14143nzt-a-95rus5f4.cpl
C:\WINDOWS\15020w9rz5ab.bin
C:\WINDOWS\15515hacktooz798.dll
C:\WINDOWS\15732spam9otzb9.dll


et poste le(s) rapport(s) obtenu(s) dans ta prochaine réponse.




~~~~ INFORMATION COMPLEMENTAIRE ~~~~


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:23:23, on 28/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\unfogk30.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
C:\GenProc\outil\Michel_GenProc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare\BearShareIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [unfogk30.exe] C:\WINDOWS\system32\unfogk30.exe
O4 - HKCU\..\Run: [SaveDefense] C:\Program Files\SaveDefense Software\SaveDefense\SaveDefense.exe -min
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://88.191.51.249/fichiers/hardwaredetection/hardwaredetection_3_1_2_0.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Update Service (gupdate1c9b1271465f510) (gupdate1c9b1271465f510) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Merci!

Déjà, étonnament, je n'ai plus ces messages d'alertes qui envahissaient mon pc :DDD

Ensuite combofix a detecter la présence de rootkit et des fichiers endommagés&illisibles
(j'ai noté les liens au cas où ?)


sinon voiçi le rapport





ComboFix 09-08-27.A3 - Michel 28/08/2009 18:03.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.213 [GMT 2:00]
Running from: c:\documents and settings\Michel\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\103z3hac5tool2d09.bin
c:\windows\109505roj9zb.bin
c:\windows\1113259ruz1a.exe
c:\windows\11179sza9b5t79a.bin
c:\windows\11395tzoj682.bin
c:\windows\11709hr5zt3519.cpl
c:\windows\12560h59ktozl591.cpl
c:\windows\126949py5eez.ocx
c:\windows\13z7spy9ar53255.cpl
c:\windows\14143nzt-a-95rus5f4.cpl
c:\windows\142225ot-a-vi9usz0.dll
c:\windows\14282z5yc59.cpl
c:\windows\14785szy5d09.cpl
c:\windows\14995spy4b1z.bin
c:\windows\15020w9rz5ab.bin
c:\windows\15515hacktooz798.dll
c:\windows\15732spam9otzb9.dll
c:\windows\15761vir9s2b3z.dll
c:\windows\15938spambot52z.exe
c:\windows\16904s953dfz.bin
c:\windows\1711zhack5ool6d9.exe
c:\windows\17501v5zus699.cpl
c:\windows\17516not-z5vi9us304.dll
c:\windows\17937haz9t5ol2fe.bin
c:\windows\17c9dzw5l9ader2527.ocx
c:\windows\18759viru519z.bin
c:\windows\18772zp9mbot205.exe
c:\windows\1888w5rm469z.bin
c:\windows\1891t5ief240z.ocx
c:\windows\1898vir245z.dll
c:\windows\190z0not-a-virus65c9.ocx
c:\windows\19175troj7z95.dll
c:\windows\1917ztroj795.bin
c:\windows\1935backdo5r303z.exe
c:\windows\19515t5zj919.bin
c:\windows\19599troj55z5.cpl
c:\windows\195cdow9lzader2353.cpl
c:\windows\19823hacztool435.exe
c:\windows\19879troj5zf5.bin
c:\windows\1990spars5z964.dll
c:\windows\1994t5izf121.exe
c:\windows\19986zirus1c5.exe
c:\windows\1999zw5rm455.cpl
c:\windows\19bfs95rse29z3.exe
c:\windows\19wz5m390.bin
c:\windows\19z6worm17a5.ocx
c:\windows\19zdv5r1929.dll
c:\windows\1b1ast5al17z9.exe
c:\windows\1bbbaczd95r1674.bin
c:\windows\1d629pyzare2535.exe
c:\windows\1e53b9czdoor1650.cpl
c:\windows\1ebet5iefz559.cpl
c:\windows\1z17spywa59945.exe
c:\windows\1z941spa59ote9.bin
c:\windows\1ze8spyw5re9625.bin
c:\windows\20895zpambot4095.ocx
c:\windows\20946s5z149.exe
c:\windows\20z03not-a-vi95s2ff.exe
c:\windows\21515w9rmze5.bin
c:\windows\21598spamb5t6dcz.exe
c:\windows\219155zr941.exe
c:\windows\21z689py7a5.ocx
c:\windows\22505tro992z.bin
c:\windows\22509spambo519az.bin
c:\windows\22761z9rus76e5.bin
c:\windows\22adstz5l239.exe
c:\windows\23119spz5bot9e0.bin
c:\windows\23145noz-a-vi5u9402.bin
c:\windows\23163zpam9ote5.dll
c:\windows\238z5h9cktool36c.dll
c:\windows\24289ziru5505.cpl
c:\windows\2455hacktoo97z.bin
c:\windows\24z52worm529.ocx
c:\windows\25008h9cktozl2d2.bin
c:\windows\2507dzwnlo9der605.exe
c:\windows\25176zirus1d79.bin
c:\windows\25489tr5j9z9.cpl
c:\windows\25650troj669z.bin
c:\windows\257threzt90965.exe
c:\windows\25805viz9sc5.cpl
c:\windows\2584zhacktool5889.bin
c:\windows\258fthiz91132.cpl
c:\windows\25918tr5jz949.dll
c:\windows\25955worm53z.dll
c:\windows\25b3stea9408z.bin
c:\windows\25e85tezl1981.ocx
c:\windows\25z33troj6609.dll
c:\windows\25z8ste9l2656.ocx
c:\windows\26111s9y55fz.cpl
c:\windows\26255vzrus9d5.bin
c:\windows\26289zp5209.bin
c:\windows\26575ziru9720.ocx
c:\windows\26606viz95527.exe
c:\windows\26725s9yze.ocx
c:\windows\275479zr5s68c.bin
c:\windows\275559pam5zt6a0.bin
c:\windows\27563noz-a9virus675.dll
c:\windows\27834nz5-a-vir9s737.cpl
c:\windows\278aaddwarz2599.bin
c:\windows\28096not-a5virus586z.dll
c:\windows\281cthreat2z593.ocx
c:\windows\2826t9reat5z023.exe
c:\windows\28353haczt9ol65.dll
c:\windows\28505hzcktoo97e5.cpl
c:\windows\28734v5z9s78.dll
c:\windows\28989hackzool45f.ocx
c:\windows\28e9szyware85.dll
c:\windows\29509viru9155z.dll
c:\windows\29552spambo95z0.dll
c:\windows\297085izus539.cpl
c:\windows\297z0viru95a15.bin
c:\windows\29955ot-a-zirus174.ocx
c:\windows\2999s9eaz955.dll
c:\windows\29a7adzw9re854.ocx
c:\windows\29d4addw5re1z33.cpl
c:\windows\2a4fbackzoor8995.dll
c:\windows\2az9d5w9loader181.bin
c:\windows\2beba59zare2311.bin
c:\windows\2cz7stea9745.ocx
c:\windows\2d5dow9loaderz937.dll
c:\windows\2eddbackdz5r911.bin
c:\windows\2z536wo9m660.cpl
c:\windows\2z745not-9-virus4d4.bin
c:\windows\2z755not-a-virus3f29.bin
c:\windows\2z959spambot760.ocx
c:\windows\3007zhacktoo9745.cpl
c:\windows\30189s5y3zb.cpl
c:\windows\3039zh9cktool55b.bin
c:\windows\30512spamboza9.bin
c:\windows\30996zpam9o5768.dll
c:\windows\309bthief239z5.cpl
c:\windows\31466spy579z.exe
c:\windows\31517s5y595z.cpl
c:\windows\31955spambz910d.exe
c:\windows\31962not-azvi9us5a.ocx
c:\windows\321zsteal598.exe
c:\windows\32390vzrus4a05.bin
c:\windows\32589hazk5ool69e.ocx
c:\windows\32b5downloadez9830.ocx
c:\windows\3314notza-vir5s49e.cpl
c:\windows\336zvir5s945.ocx
c:\windows\33825ot-a9virus5az.bin
c:\windows\3485s9arse267z.exe
c:\windows\355689izuseb.cpl
c:\windows\355dthz9f2517.cpl
c:\windows\357c9pywa5e20z0.bin
c:\windows\358bspyware296z9.ocx
c:\windows\35d0zhrea919912.dll
c:\windows\384995rzs482.bin
c:\windows\38c3bacz5oor2597.exe
c:\windows\391zs59mbot401.cpl
c:\windows\3929dow9loade5635z.dll
c:\windows\392ezackdo5r5939.bin
c:\windows\39baspaz952085.cpl
c:\windows\39z98troj51f.ocx
c:\windows\3a52spar9e258z.exe
c:\windows\3a58zhrea918444.exe
c:\windows\3a859tealz6305.exe
c:\windows\3afzdo9nloader5768.ocx
c:\windows\3bz8v5r11019.exe
c:\windows\3cc5sp9rsez096.ocx
c:\windows\3d9caddware509z.exe
c:\windows\3e91thie52z42.dll
c:\windows\3e9cthze54409.cpl
c:\windows\3f45zt9al14885.cpl
c:\windows\3z9a5ddware2534.cpl
c:\windows\4060s5arze1956.cpl
c:\windows\4097spzwa9e5234.dll
c:\windows\410z5r9j76c.bin
c:\windows\41419ddw5rz2293.bin
c:\windows\422spywar9785z.bin
c:\windows\4260vi9us54az.dll
c:\windows\4319hacktooz59.dll
c:\windows\448dt5re9z21585.exe
c:\windows\452bst9al655z.exe
c:\windows\459zspyware1423.exe
c:\windows\45bzs5y9are2997.cpl
c:\windows\45z5s9eal1505.dll
c:\windows\462asz5rse439.bin
c:\windows\46a5ste9lz940.bin
c:\windows\4836downl9azer3513.exe
c:\windows\48f1spa9sez457.ocx
c:\windows\49009hief592z.exe
c:\windows\490szeal5295.exe
c:\windows\493dzownloa5er3001.dll
c:\windows\4996threat2576z.exe
c:\windows\49e5zp5rse9406.ocx
c:\windows\4a06vi529z8.cpl
c:\windows\4cc6spazse20559.exe
c:\windows\4e6sparsez8859.bin
c:\windows\4e9athreat23524z.ocx
c:\windows\4fdbba5z9oor1850.dll
c:\windows\4z6995cktool99.bin
c:\windows\4zb6v9r3056.exe
c:\windows\506bstea92649z.exe
c:\windows\50f9v5rz091.bin
c:\windows\512z5spambo9774.dll
c:\windows\514da5dw9re2z54.exe
c:\windows\515zs59al2799.ocx
c:\windows\5168s9arse182z.exe
c:\windows\5277zhre9t5349.bin
c:\windows\528za5dware719.exe
c:\windows\53269troj6az.dll
c:\windows\53359zr3089.exe
c:\windows\5371noz-9-virus786.cpl
c:\windows\5445zpy9c9.dll
c:\windows\5461worm19z.exe
c:\windows\54b5s9ywarz2621.ocx
c:\windows\54z9vi51453.cpl
c:\windows\550fspyzar977.cpl
c:\windows\557zspy29f5.dll
c:\windows\5597hazktool535.exe
c:\windows\559aspyw9rz1129.dll
c:\windows\55zbac9door849.ocx
c:\windows\56556spazbo9da.bin
c:\windows\5766spy9z5.exe
c:\windows\57z1v5r9539.bin
c:\windows\580zworm129.dll
c:\windows\58zhac5tool64e9.cpl
c:\windows\5912vz5us2a0.dll
c:\windows\5915not9a-zirus73d.dll
c:\windows\594t5rzat7904.exe
c:\windows\5955v9rusz82.dll
c:\windows\5956zspy52a.ocx
c:\windows\595e5hreat2z829.ocx
c:\windows\5969backdoo5z38.bin
c:\windows\596bspywarz1952.cpl
c:\windows\5976spambot658z.cpl
c:\windows\5986steal236z.cpl
c:\windows\5999troz902.exe
c:\windows\59fzst9al1500.ocx
c:\windows\5ad39hzeat59050.cpl
c:\windows\5afvz91245.dll
c:\windows\5baa5iz2958.dll
c:\windows\5bzethreat57669.cpl
c:\windows\5c29ztea91080.dll
c:\windows\5c2bd9wnloadez2107.exe
c:\windows\5c7b5dd9are203z.cpl
c:\windows\5c9aspzware2281.dll
c:\windows\5ce2sp9rsz2525.bin
c:\windows\5d23vir92z3.bin
c:\windows\5e59viz956.dll
c:\windows\5f50spyzar5399.ocx
c:\windows\5f70s95rse26z8.cpl
c:\windows\5f7bs5eal1915z.exe
c:\windows\5z29spambot975.ocx
c:\windows\5z43worm590.exe
c:\windows\5z65trojd19.exe
c:\windows\5z7adownloader27369.bin
c:\windows\60aviz22995.dll
c:\windows\613aba9kdoor249z5.bin
c:\windows\6195sparse29z5.exe
c:\windows\61f2adzwa5e2149.cpl
c:\windows\626bazkd5or1479.ocx
c:\windows\6293t5reatz9366.cpl
c:\windows\62z5bac59oor2215.ocx
c:\windows\63659tz5l572.dll
c:\windows\6422vz5us593.exe
c:\windows\6481backd9or25z.exe
c:\windows\6517hac9toolz3f5.dll
c:\windows\65c3down5oadzr9955.cpl
c:\windows\66z9s5eal8889.ocx
c:\windows\698znot59-virus440.bin
c:\windows\69aaspywzre598.exe
c:\windows\69e99parze2553.bin
c:\windows\6cb3bacz9oor5099.bin
c:\windows\6cd3szeal5097.exe
c:\windows\6e74a5dwar920z4.ocx
c:\windows\6faast5al2195z.cpl
c:\windows\6z25wor91a5.bin
c:\windows\713195r43z.dll
c:\windows\7163spam5ot3bz9.ocx
c:\windows\729fbackzo5r2096.ocx
c:\windows\7524bac59ozr1850.exe
c:\windows\752cstzal19999.cpl
c:\windows\754z9ir3162.ocx
c:\windows\7596sparze1609.ocx
c:\windows\75fzdo9nloade53205.dll
c:\windows\76b1z5c9door776.bin
c:\windows\7706t5iez1659.dll
c:\windows\784ab5cz9oor544.ocx
c:\windows\7865v9r1z45.exe
c:\windows\7868tz5eat3903.exe
c:\windows\7979t5rezt23459.bin
c:\windows\7994backdozr3574.dll
c:\windows\7b0d5pars95z9.bin
c:\windows\7b459hiez1185.dll
c:\windows\7c2evir969z5.dll
c:\windows\7ca7sp5ware128z9.ocx
c:\windows\7d15thiefz595.bin
c:\windows\7z12th95f718.dll
c:\windows\8050spam9ot6ze.ocx
c:\windows\824a5dwzre3259.dll
c:\windows\87z6spa59ot5b8.exe
c:\windows\8cfspy59ze886.cpl
c:\windows\8z62not-a-viru95c8.cpl
c:\windows\90478zroj21d5.dll
c:\windows\90d95nlzader2962.exe
c:\windows\9155threaz19015.dll
c:\windows\93298notza-vir5s559.bin
c:\windows\9377threat603z5.exe
c:\windows\9395ddwaze2310.cpl
c:\windows\946backzoor5458.ocx
c:\windows\94z5not-a-vir5sb7.cpl
c:\windows\958zthreat6753.cpl
c:\windows\9628zspambot505.dll
c:\windows\965wz5m7f8.dll
c:\windows\9751stealz103.ocx
c:\windows\975zworm5f2.ocx
c:\windows\98346wormz45.bin
c:\windows\98615spy57z.ocx
c:\windows\9895tzal621.exe
c:\windows\99525spzmbot3cd.exe
c:\windows\9988zvirus754.bin
c:\windows\99d75tzal2499.exe
c:\windows\99z4threat1605.ocx
c:\windows\9a3zteal26945.bin
c:\windows\9a81bz5kdoor1248.bin
c:\windows\9b645ddware1317z.ocx
c:\windows\9c3aspyzare12515.dll
c:\windows\9d87stezl35.dll
c:\windows\9z573troj5e3.bin
c:\windows\9z82hack9oolc5.dll
c:\windows\9zaebac5door1296.bin
c:\windows\a6b5ownloade931z3.cpl
c:\windows\a98adzware1151.bin
c:\windows\af0vzr5936.exe
c:\windows\b4cs5ars9102z.dll
c:\windows\b90virz75.ocx
c:\windows\bfdtzreat32590.ocx
c:\windows\bz9s5ea91833.bin
c:\windows\c53spar9ez759.bin
c:\windows\c5czpar95336.dll
c:\windows\c8ft5i9f29z5.bin
c:\windows\dd0bz5kdo9r1980.ocx
c:\windows\f5zsteal4589.ocx
c:\windows\fadazd5are973.exe
c:\windows\fz95teal1494.dll
c:\windows\system32\102sp9mbot551z.cpl
c:\windows\system32\102z5tro958a.exe
c:\windows\system32\10468spazb5t7a9.exe
c:\windows\system32\1053downloadez9801.cpl
c:\windows\system32\10558w9rmfz.ocx
c:\windows\system32\10923t9oj545z.bin
c:\windows\system32\10c5down9oazer156.ocx
c:\windows\system32\11515troz209.cpl
c:\windows\system32\115cadd95re1704z.bin
c:\windows\system32\11751zpy922.exe
c:\windows\system32\122669ormz51.cpl
c:\windows\system32\12307notza-5irus729.ocx
c:\windows\system32\12939no9-azv5rus375.exe
c:\windows\system32\13329pzmbo5718.ocx
c:\windows\system32\13373w95m1dcz.cpl
c:\windows\system32\1353dzwnloader2597.cpl
c:\windows\system32\148z2spam59t453.exe
c:\windows\system32\148z5w9rm252.ocx
c:\windows\system32\1495irus2cz.cpl
c:\windows\system32\15045sp92z0.exe
c:\windows\system32\15175not-a-vi9uz41d5.dll
c:\windows\system32\17055wo9mzef.dll
c:\windows\system32\1801not-a-virus9z5.dll
c:\windows\system32\19541vzru5740.bin
c:\windows\system32\1d89th5ezt25519.dll
c:\windows\system32\1dzdt9i5f713.exe
c:\windows\system32\1z0bvir2599.dll
c:\windows\system32\23129troz556.dll
c:\windows\system32\23728s5y49ez.dll
c:\windows\system32\3397spamzot45d.bin
c:\windows\system32\3az75teal9202.dll
c:\windows\system32\3d59t5re9t388z.bin
c:\windows\system32\3z96759cktool71e.exe
c:\windows\system32\3zaedownloa9er559.exe
c:\windows\system32\3ze69ir1395.exe
c:\windows\system32\45z4a9dware24775.dll
c:\windows\system32\474cvirz559.dll
c:\windows\system32\51bfa9dwarez402.bin
c:\windows\system32\538tzief9673.bin
c:\windows\system32\5595zhief991.dll
c:\windows\system32\5f55downz9ader1544.bin
c:\windows\system32\67eeadzwar57239.exe
c:\windows\system32\6bz3bac59oor2415.exe
c:\windows\system32\7f49t5reat2707z9.dll
c:\windows\system32\7z26vir26159.dll
c:\windows\system32\92ab5parsz2803.dll
c:\windows\system32\97597hacztool1f05.bin
c:\windows\system32\9759t5ief39z.bin
c:\windows\system32\99a6spars5z700.bin
c:\windows\system32\9z35worm550.exe
c:\windows\system32\drivers\ESQULlvymovmycpetobwruboejnklttnghylk.sys
c:\windows\system32\drivers\ESQULxorxvirkyuwotpcbqobwtxylnqffpunv.sys
c:\windows\system32\ESQULevbiaphwesmnwxedcvhxjilossfvjmky.dll
c:\windows\system32\ESQULfjibccxtkpcimqbvfqisomaosetjijpy.dll
c:\windows\system32\unfogk30.exe
c:\windows\system32\z9635hreat2520.bin
c:\windows\system32\zce8s9yware2552.bin
c:\windows\z0067vi9u53ee.bin
c:\windows\z0931no5-a-virus706.cpl
c:\windows\z123steal9925.bin
c:\windows\z3389ddware5767.cpl
c:\windows\z43aspywa5e9859.cpl
c:\windows\z511vir1529.dll
c:\windows\z595tr5j6b89.dll
c:\windows\z596sparse892.bin
c:\windows\z59daddware5860.cpl
c:\windows\z5vir1935.exe
c:\windows\z696s5yware1192.cpl
c:\windows\z6aespyw9re854.dll
c:\windows\z6cdow9lo5der2830.cpl
c:\windows\z72195roj6ac.ocx
c:\windows\z7249irus7455.dll
c:\windows\z7769vir5s521.cpl
c:\windows\z811backdoor959.exe
c:\windows\z8455ro9160.bin
c:\windows\z8564worm229.bin
c:\windows\z9215ddw9re128.dll
c:\windows\z93549or513b.bin
c:\windows\z9509tr5j38.exe
c:\windows\z950downloader3222.ocx
c:\windows\zdd7spy5are9195.bin
c:\windows\ze27spywa9e1541.ocx
c:\windows\ze92spa5se475.bin

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ESQULserv.sys
-------\Legacy_ESQULserv.sys


((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-28 )))))))))))))))))))))))))))))))
.

2009-12-26 21:14 . 2009-12-26 21:14 3472 ----a-w- c:\windows\system32\aazs59rse1583.exe
2009-12-09 23:00 . 2009-12-09 23:00 6308 ----a-w- c:\windows\system32\296thze51679.exe
2009-11-26 18:46 . 2009-11-26 18:46 8979 ----a-w- c:\windows\system32\17199vi5us4zd.dll
2009-11-21 07:25 . 2009-11-21 07:25 9237 ----a-w- c:\windows\system32\2955viz239.bin
2009-10-18 03:57 . 2009-10-18 03:57 6878 ----a-w- c:\windows\system32\4b58backdo9r17z.dll
2009-09-20 19:22 . 2009-09-20 19:22 2949 ----a-w- c:\windows\system32\57a79hizf86.dll
2009-08-28 16:00 . 2009-08-28 16:17 2725664 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-28 14:59 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-28 14:59 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-28 14:55 . 2009-08-28 15:20 -------- d-----w- C:\GenProc
2009-08-28 01:07 . 2009-04-03 08:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-08-28 01:07 . 2008-12-18 09:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-08-28 01:06 . 2009-08-28 14:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-28 01:05 . 2009-08-28 01:07 -------- d-----w- c:\program files\Fichiers communs\PC Tools
2009-08-28 01:05 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-08-28 01:05 . 2009-08-28 01:05 -------- d-----w- c:\program files\Spyware Doctor
2009-08-28 01:05 . 2009-08-28 01:05 -------- d-----w- c:\documents and settings\Michel\Application Data\PC Tools
2009-08-28 01:05 . 2009-08-28 01:05 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-08-27 22:51 . 2009-08-27 22:51 -------- d-----w- c:\documents and settings\Michel\Application Data\MailFrontier
2009-08-27 22:42 . 2009-08-27 22:45 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-08-27 22:42 . 2009-05-28 18:25 72584 ----a-w- c:\windows\zllsputility.exe
2009-08-27 22:41 . 2009-05-28 18:25 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-08-27 22:41 . 2009-05-28 18:25 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-08-27 22:41 . 2009-05-28 18:25 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-08-27 22:41 . 2009-08-28 16:03 -------- d-----w- c:\windows\system32\ZoneLabs
2009-08-27 22:41 . 2009-08-27 22:41 -------- d-----w- c:\program files\Zone Labs
2009-08-27 22:40 . 2009-08-28 16:14 -------- d-----w- c:\windows\Internet Logs
2009-08-27 20:08 . 2009-02-17 12:49 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updext.dll
2009-08-27 20:08 . 2009-08-27 20:06 404737 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-08-27 20:08 . 2009-04-17 15:07 87297 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll
2009-08-27 20:08 . 2009-03-03 09:21 9985 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2009-08-27 20:08 . 2009-02-24 11:16 117505 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updgui.dll
2009-08-27 20:08 . 2009-08-27 20:06 345345 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll
2009-08-27 20:08 . 2008-10-20 06:38 126721 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-08-27 19:50 . 2009-08-27 20:09 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-27 19:50 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-27 19:50 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-27 19:50 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-27 19:50 . 2009-08-27 19:50 -------- d-----w- c:\program files\Avira
2009-08-27 19:50 . 2009-08-27 19:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-27 13:33 . 2009-08-27 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\122D
2009-08-27 13:31 . 2009-08-27 13:32 -------- d-----w- c:\documents and settings\Michel\Local Settings\Application Data\BearShare
2009-08-27 13:31 . 2009-08-27 13:31 -------- d-----w- c:\program files\BearShare Applications
2009-08-26 15:01 . 2009-08-26 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-08-26 14:33 . 2009-08-26 14:33 -------- d-----w- c:\program files\Messenger Plus! Live
2009-08-26 14:33 . 2009-08-26 14:33 -------- d-----w- c:\program files\Windows Live
2009-08-25 13:25 . 2009-08-25 13:25 -------- d-----w- c:\documents and settings\Michel\Contacts
2009-08-25 13:21 . 2009-08-26 14:33 -------- d-----w- c:\program files\MSN Messenger
2009-08-24 08:24 . 2009-08-24 08:24 8712 ----a-w- c:\windows\system32\8904not-a-vi5use1z.exe
2009-08-23 20:44 . 2008-04-13 18:39 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2009-08-23 20:44 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-08-23 20:44 . 2008-04-13 18:46 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2009-08-23 20:44 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-08-23 20:44 . 2008-04-13 18:46 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2009-08-23 20:44 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-08-23 20:43 . 2008-04-13 18:46 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys
2009-08-23 20:43 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-08-23 20:43 . 2008-04-13 18:46 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-08-23 20:43 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-08-23 20:43 . 2008-04-13 18:46 85248 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-08-23 20:43 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-08-23 20:43 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-08-23 20:43 . 2008-04-13 18:46 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-08-23 20:43 . 2008-04-13 18:45 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-08-23 20:43 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-08-23 20:36 . 2009-08-23 20:36 -------- d-----w- c:\program files\Fichiers communs\logishrd
2009-08-23 20:36 . 2008-04-14 02:33 54784 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-08-23 20:36 . 2008-04-14 02:33 54784 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-08-23 20:32 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-23 20:32 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-23 14:33 . 2009-08-23 14:33 -------- d-sh--w- C:\found.000
2009-08-23 13:32 . 2009-08-23 13:32 -------- d-----w- c:\windows\Sun
2009-08-23 13:31 . 2009-08-23 13:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-23 13:31 . 2009-08-23 13:31 -------- d-----w- c:\program files\Java
2009-08-23 13:30 . 2009-08-23 13:30 152576 ----a-w- c:\documents and settings\Michel\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-23 12:58 . 2009-08-23 12:58 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-23 12:58 . 2009-08-23 12:58 -------- d-----w- c:\program files\MSBuild
2009-08-23 12:58 . 2009-08-23 12:58 -------- d-----w- c:\program files\Reference Assemblies
2009-08-23 12:56 . 2009-03-27 15:38 366344 ----a-w- c:\documents and settings\Michel\Application Data\HouseCall 6.6\tsc.exe
2009-08-23 12:55 . 2009-08-23 12:57 -------- d-----w- c:\documents and settings\Michel\Application Data\HouseCall 6.6
2009-08-23 12:55 . 2009-08-23 12:55 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-08-23 12:37 . 2009-08-13 13:40 43008 ----a-w- c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-08-23 12:37 . 2009-08-13 13:39 340480 ----a-w- c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-08-23 12:37 . 2009-08-13 13:39 346112 ----a-w- c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-08-23 12:26 . 2008-04-13 16:44 2560 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
2009-08-14 20:55 . 2009-08-14 20:55 0 ----a-w- c:\windows\nsreg.dat
2009-08-14 20:55 . 2009-08-14 20:55 -------- d-----w- c:\documents and settings\Michel\Local Settings\Application Data\Mozilla
2009-08-12 20:53 . 2009-08-05 09:00 205312 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-12 18:50 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 00:46 . 2009-08-12 00:46 9894 ----a-w- c:\windows\system32\zfa5ad9ware26575.dll
2009-08-08 20:40 . 2009-08-08 20:40 -------- d-----w- c:\documents and settings\Michel\Application Data\Malwarebytes
2009-08-08 20:40 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-08 20:40 . 2009-08-08 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-08 20:40 . 2009-08-08 20:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-08 20:40 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-08 17:35 . 2009-08-08 17:35 9596 ----a-w- c:\windows\system32\59cezt5al981.exe
2009-08-04 04:21 . 2009-08-04 04:21 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-04 04:19 . 2009-08-04 04:19 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-08-04 04:19 . 2009-08-04 04:19 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-08-03 23:00 . 2009-08-04 12:32 -------- d-----w- c:\documents and settings\Michel\Application Data\BitTorrent
2009-08-03 22:59 . 2009-08-03 22:59 -------- d-----w- c:\program files\BitTorrent
2009-08-03 22:44 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-08-03 22:44 . 2008-10-16 12:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-08-02 16:09 . 2008-04-14 02:33 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-08-02 16:08 . 2009-08-02 16:08 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-02 16:06 . 2009-08-24 15:43 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-08-02 16:06 . 2009-08-02 16:06 -------- d-----w- c:\windows\system32\LogFiles
2009-08-02 16:01 . 2009-08-02 16:05 25839688 ----a-w- C:\wmp11-windowsxp-x86-FR-FR.exe
2009-08-02 15:39 . 2009-08-25 13:08 -------- d-----w- c:\documents and settings\Michel\Tracing
2009-08-02 15:31 . 2009-08-02 15:31 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-02 15:17 . 2009-08-02 15:17 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-08-02 15:16 . 2009-08-02 15:16 1161576 ----a-w- C:\wlsetup-web.exe
2009-08-02 14:29 . 2009-08-25 13:18 -------- d-----w- c:\documents and settings\Michel\Application Data\Panasonic
2009-08-02 14:27 . 2008-09-25 19:07 45056 ----a-w- c:\windows\system32\PhDi2.sys
2009-08-01 21:39 . 2009-08-01 21:39 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-01 21:32 . 2009-08-01 21:32 -------- d-sh--w- c:\documents and settings\Michel\IECompatCache
2009-08-01 21:31 . 2009-08-01 21:31 -------- d-sh--w- c:\documents and settings\Michel\PrivacIE
2009-08-01 21:28 . 2009-08-01 21:28 -------- d-sh--w- c:\documents and settings\Michel\IETldCache
2009-08-01 21:24 . 2009-07-03 16:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-01 21:24 . 2009-07-03 16:57 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-01 21:24 . 2009-07-03 16:57 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-01 21:24 . 2009-07-03 16:57 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-08-01 21:24 . 2009-07-03 16:57 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-01 21:24 . 2009-07-19 16:45 11067392 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-08-01 21:24 . 2009-08-01 21:24 -------- d-----w- c:\windows\ie8updates

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-28 16:00 . 2009-08-28 16:00 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-28 01:07 . 2009-08-28 13:39 1989632 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2009-08-28 01:07 . 2009-08-28 13:39 172032 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2009-08-27 22:03 . 2009-03-30 10:47 -------- d-----w- c:\documents and settings\Michel\Application Data\SUPERAntiSpyware.com
2009-08-27 20:09 . 2009-03-30 11:02 -------- d-----w- c:\program files\Google
2009-08-25 13:59 . 2009-08-25 13:58 -------- d-----w- c:\program files\DivX
2009-08-25 13:59 . 2009-08-25 13:58 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
2009-08-25 13:18 . 2009-04-27 16:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-24 16:15 . 2009-06-20 09:17 65752 ----a-w- c:\documents and settings\Michel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-23 13:05 . 2004-08-05 10:00 81824 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-23 13:05 . 2004-08-05 10:00 503894 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-08 21:01 . 2009-03-30 10:53 -------- d-----w- c:\program files\Yahoo!
2009-08-05 09:00 . 2004-08-05 10:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 01:04 . 2009-03-31 11:58 -------- d-----w- c:\program files\Microsoft Works
2009-08-01 21:10 . 2009-04-06 17:17 -------- d-----w- c:\program files\Intel
2009-07-24 11:39 . 2009-07-24 11:39 15761 ----a-w- c:\windows\system32\6875troj51z9.dll
2009-07-19 20:01 . 2009-07-19 20:01 6435 ----a-w- c:\windows\system32\1z375hack9ool506.exe
2009-07-17 19:03 . 2004-08-05 10:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 02:14 . 2009-07-17 02:14 10237 ----a-w- c:\windows\system32\51059no9-a-viruz579.exe
2009-07-14 00:17 . 2009-08-25 13:59 9464 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-07-14 00:17 . 2009-08-25 13:59 9336 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-07-14 00:17 . 2009-08-25 13:59 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-07-14 00:17 . 2009-08-25 13:59 129784 ------w- c:\windows\system32\pxafs.dll
2009-07-14 00:17 . 2009-08-25 13:59 120056 ------w- c:\windows\system32\pxcpyi64.exe
2009-07-14 00:17 . 2009-08-25 13:59 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-07-14 00:15 . 2009-07-14 00:15 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-07-14 00:15 . 2009-07-14 00:15 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-07-14 00:15 . 2009-07-14 00:15 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-07-14 00:15 . 2009-07-14 00:15 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-07-14 00:15 . 2009-07-14 00:15 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-07-14 00:15 . 2009-07-14 00:15 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-07-14 00:15 . 2009-07-14 00:15 685056 ----a-w- c:\windows\system32\DivX.dll
2009-07-13 21:43 . 2004-08-05 10:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 10:10 . 2009-07-13 10:10 12697 ----a-w- c:\windows\system32\92925zrm4c5.bin
2009-07-07 20:58 . 2009-07-07 20:58 6290 ----a-w- c:\windows\system32\96179wzr56fe.dll
2009-07-07 11:03 . 2009-07-07 11:03 15868 ----a-w- c:\windows\system32\5946zirus5f9.bin
2009-07-07 08:34 . 2009-07-07 08:34 17466 ----a-w- c:\windows\system32\3275z95t-a-virus7f9.bin
2009-07-06 19:08 . 2009-07-06 19:08 2650 ----a-w- c:\windows\system32\439995rm75z.dll
2009-07-03 16:57 . 2006-03-04 03:35 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-28 08:25 . 2009-06-28 08:25 4648 ----a-w- c:\windows\system32\91502worm2z55.exe
2009-06-28 05:29 . 2009-06-28 05:29 11243 ----a-w- c:\windows\system32\658zspy69d.bin
2009-06-26 16:50 . 2009-06-26 16:50 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-26 06:22 . 2009-06-26 06:22 5917 ----a-w- c:\windows\system32\50274hzcktool985.exe
2009-06-25 08:26 . 2004-08-05 10:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-05 10:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-05 10:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-05 10:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-05 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-05 10:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 13:41 . 2009-06-24 13:41 2572 ----a-w- c:\windows\system32\791dspy5a9e2538z.dll
2009-06-24 11:18 . 2004-08-05 10:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-18 15:38 . 2009-06-18 15:38 9842 ----a-w- c:\windows\system32\3zf5spar9e1909.bin
2009-06-18 14:45 . 2009-06-18 14:45 16159 ----a-w- c:\windows\system32\31915zorm75f9.exe
2009-06-18 00:13 . 2009-06-18 00:13 8505 ----a-w- c:\windows\system32\z16thief2095.dll
2009-06-16 14:40 . 2004-08-05 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2004-08-05 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:44 . 2004-08-05 10:00 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-05 10:00 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-13 00:45 . 2009-06-13 00:45 13116 ----a-w- c:\windows\system32\2298not-z-v9rus1865.exe
2009-06-10 14:14 . 2004-08-05 10:00 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2009-03-30 10:08 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-05 10:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-10 06:13 . 2009-06-10 06:13 5039 ----a-w- c:\windows\system32\314549pambot57z.dll
2009-06-03 19:10 . 2004-08-05 10:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 06:43 . 2009-06-02 06:43 13430 ----a-w- c:\windows\system32\3e599pyware2z565.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2009-05-04 10:56 398776 ----a-w- c:\program files\BearShare Applications\BearShare\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-29 133104]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-08 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-03-06 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-03-06 970752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-23 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-05-28 1005960]
"combofix"="c:\windows\system32\CF30491.exe" [2009-08-28 401408]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-02-14 88107]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"combofix"="c:\windows\system32\CF30491.exe" [2009-08-28 401408]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [27/08/2009 21:50 108289]
S2 gupdate1c9b1271465f510;Google Update Service (gupdate1c9b1271465f510);c:\program files\Google\Update\GoogleUpdate.exe [30/03/2009 13:02 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 11:02]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 11:02]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-854245398-2100742435-1003Core.job
- c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-29 17:37]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-854245398-2100742435-1003UA.job
- c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-29 17:37]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-unfogk30.exe - c:\windows\system32\unfogk30.exe
HKCU-Run-SaveDefense - c:\program files\SaveDefense Software\SaveDefense\SaveDefense.exe
HKLM-Run-NWEReboot - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/webResults.html?src=ffb&q=
FF - plugin: c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-28 18:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e1,b7,e8,a3,41,28,e9,48,89,49,83,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e1,b7,e8,a3,41,28,e9,48,89,49,83,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Completion time: 2009-08-28 18:19
ComboFix-quarantined-files.txt 2009-08-28 16:19

Pre-Run: 28 121 272 320 octets libres
Post-Run: 28 363 272 192 octets libres

805 --- E O F --- 2009-08-27 00:59

re!

Entre temps j'avais refait un scan et mon antivirus a detecter 3-4 virus/trojan + un scan de malwarebyte qui m'a supprimé 4 spywares!!

Merci déjà pour cette manip" car ce virus bloquait mes logiciels.

Ensuite j'ai relancé combofix et voiçi le rapport:



ComboFix 09-08-27.A3 - Michel 28/08/2009 18:03.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.213 [GMT 2:00]
Running from: c:\documents and settings\Michel\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\103z3hac5tool2d09.bin
c:\windows\109505roj9zb.bin
c:\windows\1113259ruz1a.exe
c:\windows\11179sza9b5t79a.bin
c:\windows\11395tzoj682.bin
c:\windows\11709hr5zt3519.cpl
c:\windows\12560h59ktozl591.cpl
c:\windows\126949py5eez.ocx
c:\windows\13z7spy9ar53255.cpl
c:\windows\14143nzt-a-95rus5f4.cpl
c:\windows\142225ot-a-vi9usz0.dll
c:\windows\14282z5yc59.cpl
c:\windows\14785szy5d09.cpl
c:\windows\14995spy4b1z.bin
c:\windows\15020w9rz5ab.bin
c:\windows\15515hacktooz798.dll
c:\windows\15732spam9otzb9.dll
c:\windows\15761vir9s2b3z.dll
c:\windows\15938spambot52z.exe
c:\windows\16904s953dfz.bin
c:\windows\1711zhack5ool6d9.exe
c:\windows\17501v5zus699.cpl
c:\windows\17516not-z5vi9us304.dll
c:\windows\17937haz9t5ol2fe.bin
c:\windows\17c9dzw5l9ader2527.ocx
c:\windows\18759viru519z.bin
c:\windows\18772zp9mbot205.exe
c:\windows\1888w5rm469z.bin
c:\windows\1891t5ief240z.ocx
c:\windows\1898vir245z.dll
c:\windows\190z0not-a-virus65c9.ocx
c:\windows\19175troj7z95.dll
c:\windows\1917ztroj795.bin
c:\windows\1935backdo5r303z.exe
c:\windows\19515t5zj919.bin
c:\windows\19599troj55z5.cpl
c:\windows\195cdow9lzader2353.cpl
c:\windows\19823hacztool435.exe
c:\windows\19879troj5zf5.bin
c:\windows\1990spars5z964.dll
c:\windows\1994t5izf121.exe
c:\windows\19986zirus1c5.exe
c:\windows\1999zw5rm455.cpl
c:\windows\19bfs95rse29z3.exe
c:\windows\19wz5m390.bin
c:\windows\19z6worm17a5.ocx
c:\windows\19zdv5r1929.dll
c:\windows\1b1ast5al17z9.exe
c:\windows\1bbbaczd95r1674.bin
c:\windows\1d629pyzare2535.exe
c:\windows\1e53b9czdoor1650.cpl
c:\windows\1ebet5iefz559.cpl
c:\windows\1z17spywa59945.exe
c:\windows\1z941spa59ote9.bin
c:\windows\1ze8spyw5re9625.bin
c:\windows\20895zpambot4095.ocx
c:\windows\20946s5z149.exe
c:\windows\20z03not-a-vi95s2ff.exe
c:\windows\21515w9rmze5.bin
c:\windows\21598spamb5t6dcz.exe
c:\windows\219155zr941.exe
c:\windows\21z689py7a5.ocx
c:\windows\22505tro992z.bin
c:\windows\22509spambo519az.bin
c:\windows\22761z9rus76e5.bin
c:\windows\22adstz5l239.exe
c:\windows\23119spz5bot9e0.bin
c:\windows\23145noz-a-vi5u9402.bin
c:\windows\23163zpam9ote5.dll
c:\windows\238z5h9cktool36c.dll
c:\windows\24289ziru5505.cpl
c:\windows\2455hacktoo97z.bin
c:\windows\24z52worm529.ocx
c:\windows\25008h9cktozl2d2.bin
c:\windows\2507dzwnlo9der605.exe
c:\windows\25176zirus1d79.bin
c:\windows\25489tr5j9z9.cpl
c:\windows\25650troj669z.bin
c:\windows\257threzt90965.exe
c:\windows\25805viz9sc5.cpl
c:\windows\2584zhacktool5889.bin
c:\windows\258fthiz91132.cpl
c:\windows\25918tr5jz949.dll
c:\windows\25955worm53z.dll
c:\windows\25b3stea9408z.bin
c:\windows\25e85tezl1981.ocx
c:\windows\25z33troj6609.dll
c:\windows\25z8ste9l2656.ocx
c:\windows\26111s9y55fz.cpl
c:\windows\26255vzrus9d5.bin
c:\windows\26289zp5209.bin
c:\windows\26575ziru9720.ocx
c:\windows\26606viz95527.exe
c:\windows\26725s9yze.ocx
c:\windows\275479zr5s68c.bin
c:\windows\275559pam5zt6a0.bin
c:\windows\27563noz-a9virus675.dll
c:\windows\27834nz5-a-vir9s737.cpl
c:\windows\278aaddwarz2599.bin
c:\windows\28096not-a5virus586z.dll
c:\windows\281cthreat2z593.ocx
c:\windows\2826t9reat5z023.exe
c:\windows\28353haczt9ol65.dll
c:\windows\28505hzcktoo97e5.cpl
c:\windows\28734v5z9s78.dll
c:\windows\28989hackzool45f.ocx
c:\windows\28e9szyware85.dll
c:\windows\29509viru9155z.dll
c:\windows\29552spambo95z0.dll
c:\windows\297085izus539.cpl
c:\windows\297z0viru95a15.bin
c:\windows\29955ot-a-zirus174.ocx
c:\windows\2999s9eaz955.dll
c:\windows\29a7adzw9re854.ocx
c:\windows\29d4addw5re1z33.cpl
c:\windows\2a4fbackzoor8995.dll
c:\windows\2az9d5w9loader181.bin
c:\windows\2beba59zare2311.bin
c:\windows\2cz7stea9745.ocx
c:\windows\2d5dow9loaderz937.dll
c:\windows\2eddbackdz5r911.bin
c:\windows\2z536wo9m660.cpl
c:\windows\2z745not-9-virus4d4.bin
c:\windows\2z755not-a-virus3f29.bin
c:\windows\2z959spambot760.ocx
c:\windows\3007zhacktoo9745.cpl
c:\windows\30189s5y3zb.cpl
c:\windows\3039zh9cktool55b.bin
c:\windows\30512spamboza9.bin
c:\windows\30996zpam9o5768.dll
c:\windows\309bthief239z5.cpl
c:\windows\31466spy579z.exe
c:\windows\31517s5y595z.cpl
c:\windows\31955spambz910d.exe
c:\windows\31962not-azvi9us5a.ocx
c:\windows\321zsteal598.exe
c:\windows\32390vzrus4a05.bin
c:\windows\32589hazk5ool69e.ocx
c:\windows\32b5downloadez9830.ocx
c:\windows\3314notza-vir5s49e.cpl
c:\windows\336zvir5s945.ocx
c:\windows\33825ot-a9virus5az.bin
c:\windows\3485s9arse267z.exe
c:\windows\355689izuseb.cpl
c:\windows\355dthz9f2517.cpl
c:\windows\357c9pywa5e20z0.bin
c:\windows\358bspyware296z9.ocx
c:\windows\35d0zhrea919912.dll
c:\windows\384995rzs482.bin
c:\windows\38c3bacz5oor2597.exe
c:\windows\391zs59mbot401.cpl
c:\windows\3929dow9loade5635z.dll
c:\windows\392ezackdo5r5939.bin
c:\windows\39baspaz952085.cpl
c:\windows\39z98troj51f.ocx
c:\windows\3a52spar9e258z.exe
c:\windows\3a58zhrea918444.exe
c:\windows\3a859tealz6305.exe
c:\windows\3afzdo9nloader5768.ocx
c:\windows\3bz8v5r11019.exe
c:\windows\3cc5sp9rsez096.ocx
c:\windows\3d9caddware509z.exe
c:\windows\3e91thie52z42.dll
c:\windows\3e9cthze54409.cpl
c:\windows\3f45zt9al14885.cpl
c:\windows\3z9a5ddware2534.cpl
c:\windows\4060s5arze1956.cpl
c:\windows\4097spzwa9e5234.dll
c:\windows\410z5r9j76c.bin
c:\windows\41419ddw5rz2293.bin
c:\windows\422spywar9785z.bin
c:\windows\4260vi9us54az.dll
c:\windows\4319hacktooz59.dll
c:\windows\448dt5re9z21585.exe
c:\windows\452bst9al655z.exe
c:\windows\459zspyware1423.exe
c:\windows\45bzs5y9are2997.cpl
c:\windows\45z5s9eal1505.dll
c:\windows\462asz5rse439.bin
c:\windows\46a5ste9lz940.bin
c:\windows\4836downl9azer3513.exe
c:\windows\48f1spa9sez457.ocx
c:\windows\49009hief592z.exe
c:\windows\490szeal5295.exe
c:\windows\493dzownloa5er3001.dll
c:\windows\4996threat2576z.exe
c:\windows\49e5zp5rse9406.ocx
c:\windows\4a06vi529z8.cpl
c:\windows\4cc6spazse20559.exe
c:\windows\4e6sparsez8859.bin
c:\windows\4e9athreat23524z.ocx
c:\windows\4fdbba5z9oor1850.dll
c:\windows\4z6995cktool99.bin
c:\windows\4zb6v9r3056.exe
c:\windows\506bstea92649z.exe
c:\windows\50f9v5rz091.bin
c:\windows\512z5spambo9774.dll
c:\windows\514da5dw9re2z54.exe
c:\windows\515zs59al2799.ocx
c:\windows\5168s9arse182z.exe
c:\windows\5277zhre9t5349.bin
c:\windows\528za5dware719.exe
c:\windows\53269troj6az.dll
c:\windows\53359zr3089.exe
c:\windows\5371noz-9-virus786.cpl
c:\windows\5445zpy9c9.dll
c:\windows\5461worm19z.exe
c:\windows\54b5s9ywarz2621.ocx
c:\windows\54z9vi51453.cpl
c:\windows\550fspyzar977.cpl
c:\windows\557zspy29f5.dll
c:\windows\5597hazktool535.exe
c:\windows\559aspyw9rz1129.dll
c:\windows\55zbac9door849.ocx
c:\windows\56556spazbo9da.bin
c:\windows\5766spy9z5.exe
c:\windows\57z1v5r9539.bin
c:\windows\580zworm129.dll
c:\windows\58zhac5tool64e9.cpl
c:\windows\5912vz5us2a0.dll
c:\windows\5915not9a-zirus73d.dll
c:\windows\594t5rzat7904.exe
c:\windows\5955v9rusz82.dll
c:\windows\5956zspy52a.ocx
c:\windows\595e5hreat2z829.ocx
c:\windows\5969backdoo5z38.bin
c:\windows\596bspywarz1952.cpl
c:\windows\5976spambot658z.cpl
c:\windows\5986steal236z.cpl
c:\windows\5999troz902.exe
c:\windows\59fzst9al1500.ocx
c:\windows\5ad39hzeat59050.cpl
c:\windows\5afvz91245.dll
c:\windows\5baa5iz2958.dll
c:\windows\5bzethreat57669.cpl
c:\windows\5c29ztea91080.dll
c:\windows\5c2bd9wnloadez2107.exe
c:\windows\5c7b5dd9are203z.cpl
c:\windows\5c9aspzware2281.dll
c:\windows\5ce2sp9rsz2525.bin
c:\windows\5d23vir92z3.bin
c:\windows\5e59viz956.dll
c:\windows\5f50spyzar5399.ocx
c:\windows\5f70s95rse26z8.cpl
c:\windows\5f7bs5eal1915z.exe
c:\windows\5z29spambot975.ocx
c:\windows\5z43worm590.exe
c:\windows\5z65trojd19.exe
c:\windows\5z7adownloader27369.bin
c:\windows\60aviz22995.dll
c:\windows\613aba9kdoor249z5.bin
c:\windows\6195sparse29z5.exe
c:\windows\61f2adzwa5e2149.cpl
c:\windows\626bazkd5or1479.ocx
c:\windows\6293t5reatz9366.cpl
c:\windows\62z5bac59oor2215.ocx
c:\windows\63659tz5l572.dll
c:\windows\6422vz5us593.exe
c:\windows\6481backd9or25z.exe
c:\windows\6517hac9toolz3f5.dll
c:\windows\65c3down5oadzr9955.cpl
c:\windows\66z9s5eal8889.ocx
c:\windows\698znot59-virus440.bin
c:\windows\69aaspywzre598.exe
c:\windows\69e99parze2553.bin
c:\windows\6cb3bacz9oor5099.bin
c:\windows\6cd3szeal5097.exe
c:\windows\6e74a5dwar920z4.ocx
c:\windows\6faast5al2195z.cpl
c:\windows\6z25wor91a5.bin
c:\windows\713195r43z.dll
c:\windows\7163spam5ot3bz9.ocx
c:\windows\729fbackzo5r2096.ocx
c:\windows\7524bac59ozr1850.exe
c:\windows\752cstzal19999.cpl
c:\windows\754z9ir3162.ocx
c:\windows\7596sparze1609.ocx
c:\windows\75fzdo9nloade53205.dll
c:\windows\76b1z5c9door776.bin
c:\windows\7706t5iez1659.dll
c:\windows\784ab5cz9oor544.ocx
c:\windows\7865v9r1z45.exe
c:\windows\7868tz5eat3903.exe
c:\windows\7979t5rezt23459.bin
c:\windows\7994backdozr3574.dll
c:\windows\7b0d5pars95z9.bin
c:\windows\7b459hiez1185.dll
c:\windows\7c2evir969z5.dll
c:\windows\7ca7sp5ware128z9.ocx
c:\windows\7d15thiefz595.bin
c:\windows\7z12th95f718.dll
c:\windows\8050spam9ot6ze.ocx
c:\windows\824a5dwzre3259.dll
c:\windows\87z6spa59ot5b8.exe
c:\windows\8cfspy59ze886.cpl
c:\windows\8z62not-a-viru95c8.cpl
c:\windows\90478zroj21d5.dll
c:\windows\90d95nlzader2962.exe
c:\windows\9155threaz19015.dll
c:\windows\93298notza-vir5s559.bin
c:\windows\9377threat603z5.exe
c:\windows\9395ddwaze2310.cpl
c:\windows\946backzoor5458.ocx
c:\windows\94z5not-a-vir5sb7.cpl
c:\windows\958zthreat6753.cpl
c:\windows\9628zspambot505.dll
c:\windows\965wz5m7f8.dll
c:\windows\9751stealz103.ocx
c:\windows\975zworm5f2.ocx
c:\windows\98346wormz45.bin
c:\windows\98615spy57z.ocx
c:\windows\9895tzal621.exe
c:\windows\99525spzmbot3cd.exe
c:\windows\9988zvirus754.bin
c:\windows\99d75tzal2499.exe
c:\windows\99z4threat1605.ocx
c:\windows\9a3zteal26945.bin
c:\windows\9a81bz5kdoor1248.bin
c:\windows\9b645ddware1317z.ocx
c:\windows\9c3aspyzare12515.dll
c:\windows\9d87stezl35.dll
c:\windows\9z573troj5e3.bin
c:\windows\9z82hack9oolc5.dll
c:\windows\9zaebac5door1296.bin
c:\windows\a6b5ownloade931z3.cpl
c:\windows\a98adzware1151.bin
c:\windows\af0vzr5936.exe
c:\windows\b4cs5ars9102z.dll
c:\windows\b90virz75.ocx
c:\windows\bfdtzreat32590.ocx
c:\windows\bz9s5ea91833.bin
c:\windows\c53spar9ez759.bin
c:\windows\c5czpar95336.dll
c:\windows\c8ft5i9f29z5.bin
c:\windows\dd0bz5kdo9r1980.ocx
c:\windows\f5zsteal4589.ocx
c:\windows\fadazd5are973.exe
c:\windows\fz95teal1494.dll
c:\windows\system32\102sp9mbot551z.cpl
c:\windows\system32\102z5tro958a.exe
c:\windows\system32\10468spazb5t7a9.exe
c:\windows\system32\1053downloadez9801.cpl
c:\windows\system32\10558w9rmfz.ocx
c:\windows\system32\10923t9oj545z.bin
c:\windows\system32\10c5down9oazer156.ocx
c:\windows\system32\11515troz209.cpl
c:\windows\system32\115cadd95re1704z.bin
c:\windows\system32\11751zpy922.exe
c:\windows\system32\122669ormz51.cpl
c:\windows\system32\12307notza-5irus729.ocx
c:\windows\system32\12939no9-azv5rus375.exe
c:\windows\system32\13329pzmbo5718.ocx
c:\windows\system32\13373w95m1dcz.cpl
c:\windows\system32\1353dzwnloader2597.cpl
c:\windows\system32\148z2spam59t453.exe
c:\windows\system32\148z5w9rm252.ocx
c:\windows\system32\1495irus2cz.cpl
c:\windows\system32\15045sp92z0.exe
c:\windows\system32\15175not-a-vi9uz41d5.dll
c:\windows\system32\17055wo9mzef.dll
c:\windows\system32\1801not-a-virus9z5.dll
c:\windows\system32\19541vzru5740.bin
c:\windows\system32\1d89th5ezt25519.dll
c:\windows\system32\1dzdt9i5f713.exe
c:\windows\system32\1z0bvir2599.dll
c:\windows\system32\23129troz556.dll
c:\windows\system32\23728s5y49ez.dll
c:\windows\system32\3397spamzot45d.bin
c:\windows\system32\3az75teal9202.dll
c:\windows\system32\3d59t5re9t388z.bin
c:\windows\system32\3z96759cktool71e.exe
c:\windows\system32\3zaedownloa9er559.exe
c:\windows\system32\3ze69ir1395.exe
c:\windows\system32\45z4a9dware24775.dll
c:\windows\system32\474cvirz559.dll
c:\windows\system32\51bfa9dwarez402.bin
c:\windows\system32\538tzief9673.bin
c:\windows\system32\5595zhief991.dll
c:\windows\system32\5f55downz9ader1544.bin
c:\windows\system32\67eeadzwar57239.exe
c:\windows\system32\6bz3bac59oor2415.exe
c:\windows\system32\7f49t5reat2707z9.dll
c:\windows\system32\7z26vir26159.dll
c:\windows\system32\92ab5parsz2803.dll
c:\windows\system32\97597hacztool1f05.bin
c:\windows\system32\9759t5ief39z.bin
c:\windows\system32\99a6spars5z700.bin
c:\windows\system32\9z35worm550.exe
c:\windows\system32\drivers\ESQULlvymovmycpetobwruboejnklttnghylk.sys
c:\windows\system32\drivers\ESQULxorxvirkyuwotpcbqobwtxylnqffpunv.sys
c:\windows\system32\ESQULevbiaphwesmnwxedcvhxjilossfvjmky.dll
c:\windows\system32\ESQULfjibccxtkpcimqbvfqisomaosetjijpy.dll
c:\windows\system32\unfogk30.exe
c:\windows\system32\z9635hreat2520.bin
c:\windows\system32\zce8s9yware2552.bin
c:\windows\z0067vi9u53ee.bin
c:\windows\z0931no5-a-virus706.cpl
c:\windows\z123steal9925.bin
c:\windows\z3389ddware5767.cpl
c:\windows\z43aspywa5e9859.cpl
c:\windows\z511vir1529.dll
c:\windows\z595tr5j6b89.dll
c:\windows\z596sparse892.bin
c:\windows\z59daddware5860.cpl
c:\windows\z5vir1935.exe
c:\windows\z696s5yware1192.cpl
c:\windows\z6aespyw9re854.dll
c:\windows\z6cdow9lo5der2830.cpl
c:\windows\z72195roj6ac.ocx
c:\windows\z7249irus7455.dll
c:\windows\z7769vir5s521.cpl
c:\windows\z811backdoor959.exe
c:\windows\z8455ro9160.bin
c:\windows\z8564worm229.bin
c:\windows\z9215ddw9re128.dll
c:\windows\z93549or513b.bin
c:\windows\z9509tr5j38.exe
c:\windows\z950downloader3222.ocx
c:\windows\zdd7spy5are9195.bin
c:\windows\ze27spywa9e1541.ocx
c:\windows\ze92spa5se475.bin

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ESQULserv.sys
-------\Legacy_ESQULserv.sys


((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-28 )))))))))))))))))))))))))))))))
.

2009-12-26 21:14 . 2009-12-26 21:14 3472 ----a-w- c:\windows\system32\aazs59rse1583.exe
2009-12-09 23:00 . 2009-12-09 23:00 6308 ----a-w- c:\windows\system32\296thze51679.exe
2009-11-26 18:46 . 2009-11-26 18:46 8979 ----a-w- c:\windows\system32\17199vi5us4zd.dll
2009-11-21 07:25 . 2009-11-21 07:25 9237 ----a-w- c:\windows\system32\2955viz239.bin
2009-10-18 03:57 . 2009-10-18 03:57 6878 ----a-w- c:\windows\system32\4b58backdo9r17z.dll
2009-09-20 19:22 . 2009-09-20 19:22 2949 ----a-w- c:\windows\system32\57a79hizf86.dll
2009-08-28 16:00 . 2009-08-28 16:17 2725664 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-28 14:59 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-28 14:59 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-28 14:55 . 2009-08-28 15:20 -------- d-----w- C:\GenProc
2009-08-28 01:07 . 2009-04-03 08:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-08-28 01:07 . 2008-12-18 09:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-08-28 01:06 . 2009-08-28 14:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-28 01:05 . 2009-08-28 01:07 -------- d-----w- c:\program files\Fichiers communs\PC Tools
2009-08-28 01:05 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-08-28 01:05 . 2009-08-28 01:05 -------- d-----w- c:\program files\Spyware Doctor
2009-08-28 01:05 . 2009-08-28 01:05 -------- d-----w- c:\documents and settings\Michel\Application Data\PC Tools
2009-08-28 01:05 . 2009-08-28 01:05 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-08-27 22:51 . 2009-08-27 22:51 -------- d-----w- c:\documents and settings\Michel\Application Data\MailFrontier
2009-08-27 22:42 . 2009-08-27 22:45 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-08-27 22:42 . 2009-05-28 18:25 72584 ----a-w- c:\windows\zllsputility.exe
2009-08-27 22:41 . 2009-05-28 18:25 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-08-27 22:41 . 2009-05-28 18:25 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-08-27 22:41 . 2009-05-28 18:25 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-08-27 22:41 . 2009-08-28 16:03 -------- d-----w- c:\windows\system32\ZoneLabs
2009-08-27 22:41 . 2009-08-27 22:41 -------- d-----w- c:\program files\Zone Labs
2009-08-27 22:40 . 2009-08-28 16:14 -------- d-----w- c:\windows\Internet Logs
2009-08-27 20:08 . 2009-02-17 12:49 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updext.dll
2009-08-27 20:08 . 2009-08-27 20:06 404737 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-08-27 20:08 . 2009-04-17 15:07 87297 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll
2009-08-27 20:08 . 2009-03-03 09:21 9985 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2009-08-27 20:08 . 2009-02-24 11:16 117505 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updgui.dll
2009-08-27 20:08 . 2009-08-27 20:06 345345 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll
2009-08-27 20:08 . 2008-10-20 06:38 126721 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-08-27 19:50 . 2009-08-27 20:09 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-27 19:50 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-27 19:50 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-27 19:50 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-27 19:50 . 2009-08-27 19:50 -------- d-----w- c:\program files\Avira
2009-08-27 19:50 . 2009-08-27 19:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-27 13:33 . 2009-08-27 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\122D
2009-08-27 13:31 . 2009-08-27 13:32 -------- d-----w- c:\documents and settings\Michel\Local Settings\Application Data\BearShare
2009-08-27 13:31 . 2009-08-27 13:31 -------- d-----w- c:\program files\BearShare Applications
2009-08-26 15:01 . 2009-08-26 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-08-26 14:33 . 2009-08-26 14:33 -------- d-----w- c:\program files\Messenger Plus! Live
2009-08-26 14:33 . 2009-08-26 14:33 -------- d-----w- c:\program files\Windows Live
2009-08-25 13:25 . 2009-08-25 13:25 -------- d-----w- c:\documents and settings\Michel\Contacts
2009-08-25 13:21 . 2009-08-26 14:33 -------- d-----w- c:\program files\MSN Messenger
2009-08-24 08:24 . 2009-08-24 08:24 8712 ----a-w- c:\windows\system32\8904not-a-vi5use1z.exe
2009-08-23 20:44 . 2008-04-13 18:39 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2009-08-23 20:44 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-08-23 20:44 . 2008-04-13 18:46 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2009-08-23 20:44 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-08-23 20:44 . 2008-04-13 18:46 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2009-08-23 20:44 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-08-23 20:43 . 2008-04-13 18:46 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys
2009-08-23 20:43 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-08-23 20:43 . 2008-04-13 18:46 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-08-23 20:43 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-08-23 20:43 . 2008-04-13 18:46 85248 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-08-23 20:43 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-08-23 20:43 . 2008-04-13 18:46 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-08-23 20:43 . 2008-04-13 18:46 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-08-23 20:43 . 2008-04-13 18:45 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-08-23 20:43 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-08-23 20:36 . 2009-08-23 20:36 -------- d-----w- c:\program files\Fichiers communs\logishrd
2009-08-23 20:36 . 2008-04-14 02:33 54784 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-08-23 20:36 . 2008-04-14 02:33 54784 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-08-23 20:32 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-23 20:32 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-23 14:33 . 2009-08-23 14:33 -------- d-sh--w- C:\found.000
2009-08-23 13:32 . 2009-08-23 13:32 -------- d-----w- c:\windows\Sun
2009-08-23 13:31 . 2009-08-23 13:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-23 13:31 . 2009-08-23 13:31 -------- d-----w- c:\program files\Java
2009-08-23 13:30 . 2009-08-23 13:30 152576 ----a-w- c:\documents and settings\Michel\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-23 12:58 . 2009-08-23 12:58 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-23 12:58 . 2009-08-23 12:58 -------- d-----w- c:\program files\MSBuild
2009-08-23 12:58 . 2009-08-23 12:58 -------- d-----w- c:\program files\Reference Assemblies
2009-08-23 12:56 . 2009-03-27 15:38 366344 ----a-w- c:\documents and settings\Michel\Application Data\HouseCall 6.6\tsc.exe
2009-08-23 12:55 . 2009-08-23 12:57 -------- d-----w- c:\documents and settings\Michel\Application Data\HouseCall 6.6
2009-08-23 12:55 . 2009-08-23 12:55 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-08-23 12:37 . 2009-08-13 13:40 43008 ----a-w- c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-08-23 12:37 . 2009-08-13 13:39 340480 ----a-w- c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-08-23 12:37 . 2009-08-13 13:39 346112 ----a-w- c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-08-23 12:26 . 2008-04-13 16:44 2560 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
2009-08-14 20:55 . 2009-08-14 20:55 0 ----a-w- c:\windows\nsreg.dat
2009-08-14 20:55 . 2009-08-14 20:55 -------- d-----w- c:\documents and settings\Michel\Local Settings\Application Data\Mozilla
2009-08-12 20:53 . 2009-08-05 09:00 205312 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-12 18:50 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 00:46 . 2009-08-12 00:46 9894 ----a-w- c:\windows\system32\zfa5ad9ware26575.dll
2009-08-08 20:40 . 2009-08-08 20:40 -------- d-----w- c:\documents and settings\Michel\Application Data\Malwarebytes
2009-08-08 20:40 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-08 20:40 . 2009-08-08 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-08 20:40 . 2009-08-08 20:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-08 20:40 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-08 17:35 . 2009-08-08 17:35 9596 ----a-w- c:\windows\system32\59cezt5al981.exe
2009-08-04 04:21 . 2009-08-04 04:21 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-04 04:19 . 2009-08-04 04:19 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-08-04 04:19 . 2009-08-04 04:19 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-08-03 23:00 . 2009-08-04 12:32 -------- d-----w- c:\documents and settings\Michel\Application Data\BitTorrent
2009-08-03 22:59 . 2009-08-03 22:59 -------- d-----w- c:\program files\BitTorrent
2009-08-03 22:44 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-08-03 22:44 . 2008-10-16 12:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-08-02 16:09 . 2008-04-14 02:33 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-08-02 16:08 . 2009-08-02 16:08 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-02 16:06 . 2009-08-24 15:43 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-08-02 16:06 . 2009-08-02 16:06 -------- d-----w- c:\windows\system32\LogFiles
2009-08-02 16:01 . 2009-08-02 16:05 25839688 ----a-w- C:\wmp11-windowsxp-x86-FR-FR.exe
2009-08-02 15:39 . 2009-08-25 13:08 -------- d-----w- c:\documents and settings\Michel\Tracing
2009-08-02 15:31 . 2009-08-02 15:31 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-02 15:17 . 2009-08-02 15:17 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-08-02 15:16 . 2009-08-02 15:16 1161576 ----a-w- C:\wlsetup-web.exe
2009-08-02 14:29 . 2009-08-25 13:18 -------- d-----w- c:\documents and settings\Michel\Application Data\Panasonic
2009-08-02 14:27 . 2008-09-25 19:07 45056 ----a-w- c:\windows\system32\PhDi2.sys
2009-08-01 21:39 . 2009-08-01 21:39 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-01 21:32 . 2009-08-01 21:32 -------- d-sh--w- c:\documents and settings\Michel\IECompatCache
2009-08-01 21:31 . 2009-08-01 21:31 -------- d-sh--w- c:\documents and settings\Michel\PrivacIE
2009-08-01 21:28 . 2009-08-01 21:28 -------- d-sh--w- c:\documents and settings\Michel\IETldCache
2009-08-01 21:24 . 2009-07-03 16:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-01 21:24 . 2009-07-03 16:57 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-01 21:24 . 2009-07-03 16:57 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-01 21:24 . 2009-07-03 16:57 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-08-01 21:24 . 2009-07-03 16:57 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-01 21:24 . 2009-07-19 16:45 11067392 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-08-01 21:24 . 2009-08-01 21:24 -------- d-----w- c:\windows\ie8updates

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-28 16:00 . 2009-08-28 16:00 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-28 01:07 . 2009-08-28 13:39 1989632 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2009-08-28 01:07 . 2009-08-28 13:39 172032 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2009-08-27 22:03 . 2009-03-30 10:47 -------- d-----w- c:\documents and settings\Michel\Application Data\SUPERAntiSpyware.com
2009-08-27 20:09 . 2009-03-30 11:02 -------- d-----w- c:\program files\Google
2009-08-25 13:59 . 2009-08-25 13:58 -------- d-----w- c:\program files\DivX
2009-08-25 13:59 . 2009-08-25 13:58 -------- d-----w- c:\program files\Fichiers communs\DivX Shared
2009-08-25 13:18 . 2009-04-27 16:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-24 16:15 . 2009-06-20 09:17 65752 ----a-w- c:\documents and settings\Michel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-23 13:05 . 2004-08-05 10:00 81824 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-23 13:05 . 2004-08-05 10:00 503894 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-08 21:01 . 2009-03-30 10:53 -------- d-----w- c:\program files\Yahoo!
2009-08-05 09:00 . 2004-08-05 10:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 01:04 . 2009-03-31 11:58 -------- d-----w- c:\program files\Microsoft Works
2009-08-01 21:10 . 2009-04-06 17:17 -------- d-----w- c:\program files\Intel
2009-07-24 11:39 . 2009-07-24 11:39 15761 ----a-w- c:\windows\system32\6875troj51z9.dll
2009-07-19 20:01 . 2009-07-19 20:01 6435 ----a-w- c:\windows\system32\1z375hack9ool506.exe
2009-07-17 19:03 . 2004-08-05 10:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 02:14 . 2009-07-17 02:14 10237 ----a-w- c:\windows\system32\51059no9-a-viruz579.exe
2009-07-14 00:17 . 2009-08-25 13:59 9464 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-07-14 00:17 . 2009-08-25 13:59 9336 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-07-14 00:17 . 2009-08-25 13:59 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-07-14 00:17 . 2009-08-25 13:59 129784 ------w- c:\windows\system32\pxafs.dll
2009-07-14 00:17 . 2009-08-25 13:59 120056 ------w- c:\windows\system32\pxcpyi64.exe
2009-07-14 00:17 . 2009-08-25 13:59 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-07-14 00:15 . 2009-07-14 00:15 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-07-14 00:15 . 2009-07-14 00:15 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-07-14 00:15 . 2009-07-14 00:15 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-07-14 00:15 . 2009-07-14 00:15 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-07-14 00:15 . 2009-07-14 00:15 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-07-14 00:15 . 2009-07-14 00:15 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-07-14 00:15 . 2009-07-14 00:15 685056 ----a-w- c:\windows\system32\DivX.dll
2009-07-13 21:43 . 2004-08-05 10:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 10:10 . 2009-07-13 10:10 12697 ----a-w- c:\windows\system32\92925zrm4c5.bin
2009-07-07 20:58 . 2009-07-07 20:58 6290 ----a-w- c:\windows\system32\96179wzr56fe.dll
2009-07-07 11:03 . 2009-07-07 11:03 15868 ----a-w- c:\windows\system32\5946zirus5f9.bin
2009-07-07 08:34 . 2009-07-07 08:34 17466 ----a-w- c:\windows\system32\3275z95t-a-virus7f9.bin
2009-07-06 19:08 . 2009-07-06 19:08 2650 ----a-w- c:\windows\system32\439995rm75z.dll
2009-07-03 16:57 . 2006-03-04 03:35 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-28 08:25 . 2009-06-28 08:25 4648 ----a-w- c:\windows\system32\91502worm2z55.exe
2009-06-28 05:29 . 2009-06-28 05:29 11243 ----a-w- c:\windows\system32\658zspy69d.bin
2009-06-26 16:50 . 2009-06-26 16:50 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-26 06:22 . 2009-06-26 06:22 5917 ----a-w- c:\windows\system32\50274hzcktool985.exe
2009-06-25 08:26 . 2004-08-05 10:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-05 10:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-05 10:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-05 10:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-05 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2004-08-05 10:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 13:41 . 2009-06-24 13:41 2572 ----a-w- c:\windows\system32\791dspy5a9e2538z.dll
2009-06-24 11:18 . 2004-08-05 10:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-18 15:38 . 2009-06-18 15:38 9842 ----a-w- c:\windows\system32\3zf5spar9e1909.bin
2009-06-18 14:45 . 2009-06-18 14:45 16159 ----a-w- c:\windows\system32\31915zorm75f9.exe
2009-06-18 00:13 . 2009-06-18 00:13 8505 ----a-w- c:\windows\system32\z16thief2095.dll
2009-06-16 14:40 . 2004-08-05 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2004-08-05 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:44 . 2004-08-05 10:00 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-05 10:00 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-13 00:45 . 2009-06-13 00:45 13116 ----a-w- c:\windows\system32\2298not-z-v9rus1865.exe
2009-06-10 14:14 . 2004-08-05 10:00 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2009-03-30 10:08 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-05 10:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-10 06:13 . 2009-06-10 06:13 5039 ----a-w- c:\windows\system32\314549pambot57z.dll
2009-06-03 19:10 . 2004-08-05 10:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 06:43 . 2009-06-02 06:43 13430 ----a-w- c:\windows\system32\3e599pyware2z565.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2009-05-04 10:56 398776 ----a-w- c:\program files\BearShare Applications\BearShare\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-29 133104]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-08 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-03-06 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-03-06 970752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-23 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-05-28 1005960]
"combofix"="c:\windows\system32\CF30491.exe" [2009-08-28 401408]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-02-14 88107]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"combofix"="c:\windows\system32\CF30491.exe" [2009-08-28 401408]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [27/08/2009 21:50 108289]
S2 gupdate1c9b1271465f510;Google Update Service (gupdate1c9b1271465f510);c:\program files\Google\Update\GoogleUpdate.exe [30/03/2009 13:02 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 11:02]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 11:02]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-854245398-2100742435-1003Core.job
- c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-29 17:37]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-854245398-2100742435-1003UA.job
- c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-29 17:37]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-unfogk30.exe - c:\windows\system32\unfogk30.exe
HKCU-Run-SaveDefense - c:\program files\SaveDefense Software\SaveDefense\SaveDefense.exe
HKLM-Run-NWEReboot - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Michel\Application Data\Mozilla\Firefox\Profiles\ln0r7vmm.default\
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/webResults.html?src=ffb&q=
FF - plugin: c:\documents and settings\Michel\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-28 18:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e1,b7,e8,a3,41,28,e9,48,89,49,83,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e1,b7,e8,a3,41,28,e9,48,89,49,83,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Completion time: 2009-08-28 18:19
ComboFix-quarantined-files.txt 2009-08-28 16:19

Pre-Run: 28 121 272 320 octets libres
Post-Run: 28 363 272 192 octets libres

805 --- E O F --- 2009-08-27 00:59

Et en gros ca veut dire quoi?!
Désolé je m'y connais pas trop -_-