Send.exe (impossible de surpimer) Résolu

Question

Bonjour,
S'il vous plait les gens,j'ai un gros problème,après avoir exécuter un fichier .exe,il a disparu et après un autre est apparu sur mon bureau nome send.exe,et je ne sais pas comment faire pour le supprimer,et ça craint si c'est un virus espion,j'espère que vous allez me répondre et que ce problème soit résolu,je vous serez très reconnaissant.

Nowax · Answer

voiçi le scan que j'ai fais avec Hijackthis si ça vous aidera a résoudre mon problème !Merci.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:48:21, on 30/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\AEIWLSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Program Files\WindowsSecurity\SystemR1.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\WindowsSecurity\Systemx32.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\WindowsSecurity\SystemR2.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Program Files\WindowsSecurity\Send.exe
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\HiJackThis.exe
C:\Program Files\WindowsSecurity\Send.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Trust Gaming mouse] "C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe"
O4 - HKLM\..\Run: [OlStatusMon] "C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\RunOnce: [UniblueRegistryBooster] "C:\Program Files\Uniblue\RegistryBooster 2009\launcher.exe" delay 20000
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS2\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Aeiwsvc - Unknown owner - C:\WINDOWS\system32\AEIWLSVC.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: olMntrService - Olivetti - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

jfkpresident · Answer

Hello ;

Tu as deux infections distinctes sur ton pc .

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Nowax · Answer

merci beaucoup pour avoir répondu si rapidement,je vais faire ce que vous m'avez dis et je vous dirais le résultat !

Nowax · Answer

malheureusement j'ai pas pu exécuter le runthis.bat parce que ça me dit ça:

Windows ne trouve pas 'C:\SDFix\RunThis.bat
Vérifiez que vous avez entré le nom correctement et essayez à nouveau pour rechercher un fichier,cliquez sur le bouton démarrer,puis sur recherche. :\

Nowax · Answer

S'il vous plait,que pui-je faire pour pouvoir exécuter le .bat ?Merci.

jfkpresident · Answer

Si tu n'arrives pas a l'éxécuter ,on va faire autrement :

Ouvre ce lien et télécharge ZHPDiag :

    https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html
    

    Une fois le téléchargement achevé, dézippe le fichier obtenu et place ZHPDiag.exe sur ton Bureau.

    Double-clique sur l'icône pour lancer le programme.

    Clique sur Tous pour cocher toutes les cases des options.

    Clique sur la loupe pour lancer l'analyse.

    A la fin de l'analyse, clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

    Ouvre le fichier sauvegardé (ZHPDiag.txt)avec le Bloc-Notes et copie son contenu dans ta réponse.
    
    Postes le en deux fois s'il le faut (le log est assez long).

Nowax · Answer

D'accord,je vais essayer cela mnt et je copie le rapport.

Nowax · Answer

Rapport de ZHPDiag v1.24.09 par Nicolas Coolman
Run by Administrateur at 30/08/2009 22:40:37
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox (3.0.13)

Total RAM: 1023,2 Mb (22 % free)
System drive C: 149 Go (41 Go free)

---\ Processus lancés
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Program Files\WindowsSecurity\SystemR1.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\AEIWLSVC.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe

---\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

---\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx

---\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: C:\Program Files\AskBarDis\bar\bin\askBar.dll - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O3 - Toolbar: C:\Program Files\free-downloads.net	bfree.dll - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

---\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Trust Gaming mouse] C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
O4 - HKLM\..\Run: [OlStatusMon] C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ares] C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\policies\Explorer: [HonorAutoRunSetting] Data=1
O4 - Global Startup: DSLMON.lnk - C:\Program Files\Menara\dslmon.exe

---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223

---\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\system32\inetcomm.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\Windows\system32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\Windows\system32\SHELL32.dll

---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\System32\WgaLogon.dll

---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\system32\browseui.dll

---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Aeiwsvc (Aeiwsvc) - C:\WINDOWS\system32\AEIWLSVC.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! Antivirus) - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
O23 - Service:  (MBAMService) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: olMntrService (olMntrService) - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA (PnkBstrA) - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - C:\WINDOWS\System32\TUProgSt.exe

---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Maintenance en 1 clic.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{088C996B-D3A9-4963-B0D8-7D37F5935AC9}.job

---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Mise à jour de la version d’Internet Explorer - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32undll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
O40 - ASIC: Personnalisation du navigateur - >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - (not file)
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32egsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32	hemeui.dll
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: .NET Framework - {3F7924B9-D148-3141-87B1-68F36043A940} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: .NET Framework - {B508B3F1-A24A-32C0-B310-85786919EF28} - (not file)
O40 - ASIC: .NET Framework - {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - (not file)
O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)
O40 - ASIC: Planificateur de tâches - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx
O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)

---\ Pilotes lancés au démarrage (O41)
O41 - Driver: General Purpose USB Driver (adildr.sys) (ADILOADER) - C:\WINDOWS\System32\Drivers\adildr.sys
O41 - Driver: USB ADSL WAN Adapter (adiusbaw) - C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
O41 - Driver: Suppresseur d'écho acoustique (Noyau Microsoft) (aec) - C:\WINDOWS\system32\drivers\aec.sys
O41 - Driver: Protocole client ARP 1394 (Arp1394) - C:\WINDOWS\system32\DRIVERS\arp1394.sys
O41 - Driver: Pilote de média asynchrone RAS (AsyncMac) - C:\WINDOWS\system32\DRIVERS\asyncmac.sys
O41 - Driver: Protocole client ATM ARP (Atmarpc) - C:\WINDOWS\system32\DRIVERS\atmarpc.sys
O41 - Driver: Pilote audio Stub (audstub) - C:\WINDOWS\system32\DRIVERS\audstub.sys
O41 - Driver: Team H2O CLEDX service (CLEDX) - C:\WINDOWS\system32\DRIVERS\cledx.sys
O41 - Driver: (no object) (dmboot) - C:\WINDOWS\System32\drivers\dmboot.sys
O41 - Driver: Pilote de Gestionnaire de disque logique (dmio) - C:\WINDOWS\System32\drivers\dmio.sys
O41 - Driver: (no object) (dmload) - C:\WINDOWS\System32\drivers\dmload.sys
O41 - Driver: Synthétiseur DLS du noyau Microsoft (DMusic) - C:\WINDOWS\system32\drivers\DMusic.sys
O41 - Driver: Filtre de décodeur DRM (Noyau Microsoft) (drmkaud) - C:\WINDOWS\system32\drivers\drmkaud.sys
O41 - Driver: Intel(R) PRO Network Connection Driver (E100B) - C:\WINDOWS\system32\DRIVERS\e100b325.sys
O41 - Driver: FltMgr (FltMgr) - C:\WINDOWS\system32\DRIVERS\fltMgr.sys
O41 - Driver: GMFilter Filter (GMFilter Filter) - C:\WINDOWS\System32\Drivers\GMFilter.sys
O41 - Driver: Classificateur de paquets générique (Gpc) - C:\WINDOWS\system32\DRIVERS\msgpc.sys
O41 - Driver: Hamachi Network Interface (hamachi) - C:\WINDOWS\system32\DRIVERS\hamachi.sys
O41 - Driver: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
O41 - Driver: Pilote de classe HID Microsoft (hidusb) - C:\WINDOWS\system32\DRIVERS\hidusb.sys
O41 - Driver: Pilote pour clavier i8042 et souris sur port PS/2 (i8042prt) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys
O41 - Driver: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - C:\WINDOWS\system32\drivers\RtkHDAud.sys
O41 - Driver: Pilote de processeur Intel (intelppm) - C:\WINDOWS\system32\DRIVERS\intelppm.sys
O41 - Driver: Pilote du pare-feu Windows IPv6 (Ip6Fw) - C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
O41 - Driver: Pilote de filtre de trafic IP (IpFilterDriver) - C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
O41 - Driver: Pilote de tunnelage IP dans IP (IpInIp) - C:\WINDOWS\system32\DRIVERS\ipinip.sys
O41 - Driver: Pilote IPSEC (IPSec) - C:\WINDOWS\system32\DRIVERS\ipsec.sys
O41 - Driver: Service énumérateur IR (IRENUM) - C:\WINDOWS\system32\DRIVERS\irenum.sys
O41 - Driver: Pilote HID de clavier (kbdhid) - C:\WINDOWS\system32\DRIVERS\kbdhid.sys
O41 - Driver: Mélangeur audio Wave de noyau Microsoft (kmixer) - C:\WINDOWS\system32\drivers\kmixer.sys
O41 - Driver: (no object) (MBAMProtector) - C:\WINDOWS\system32\drivers\mbam.sys
O41 - Driver: Pilote HID de souris (mouhid) - C:\WINDOWS\system32\DRIVERS\mouhid.sys
O41 - Driver: Redirecteur client WebDav (MRxDAV) - C:\WINDOWS\system32\DRIVERS\mrxdav.sys
O41 - Driver: MRXSMB (MRxSmb) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
O41 - Driver: Proxy de service de répartition Microsoft (MSKSSRV) - C:\WINDOWS\system32\drivers\MSKSSRV.sys
O41 - Driver: Proxy d'horloge de répartition Microsoft (MSPCLOCK) - C:\WINDOWS\system32\drivers\MSPCLOCK.sys
O41 - Driver: Proxy de gestion de qualité de répartition Microsoft (MSPQM) - C:\WINDOWS\system32\drivers\MSPQM.sys
O41 - Driver: Pilote BIOS de gestion de systèmes Microsoft (mssmbios) - C:\WINDOWS\system32\DRIVERS\mssmbios.sys
O41 - Driver: Pilote TAPI NDIS d'accès distant (NdisTapi) - C:\WINDOWS\system32\DRIVERS
distapi.sys
O41 - Driver: NDIS mode utilisateur E/S Protocole (Ndisuio) - C:\WINDOWS\system32\DRIVERS
disuio.sys
O41 - Driver: Pilote réseau étendu NDIS d'accès distant (NdisWan) - C:\WINDOWS\system32\DRIVERS
diswan.sys
O41 - Driver: Interface NetBIOS (NetBIOS) - C:\WINDOWS\system32\DRIVERS
etbios.sys
O41 - Driver: NetBIOS sur TCP/IP (NetBT) - C:\WINDOWS\system32\DRIVERS
etbt.sys
O41 - Driver: Pilote réseau 1394 (NIC1394) - C:\WINDOWS\system32\DRIVERS
ic1394.sys
O41 - Driver: (no object) (nv) - C:\WINDOWS\system32\DRIVERS
v4_mini.sys
O41 - Driver: Pilote de filtre de trafic IPX (NwlnkFlt) - C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
O41 - Driver: Pilote de transfert de trafic IPX (NwlnkFwd) - C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
O41 - Driver: Contrôleurs hôte IEEE 1394 compatible OHCI (ohci1394) - C:\WINDOWS\system32\DRIVERS\ohci1394.sys
O41 - Driver: Miniport réseau étendu (PPTP) (PptpMiniport) - C:\WINDOWS\system32\DRIVERSaspptp.sys
O41 - Driver: Planificateur de paquets QoS (PSched) - C:\WINDOWS\system32\DRIVERS\psched.sys
O41 - Driver: Pilote de liaison parallèle directe (Ptilink) - C:\WINDOWS\system32\DRIVERS\ptilink.sys
O41 - Driver: Mobile Connector USB Device for Legacy Serial Communication (qcusbser) - C:\WINDOWS\system32\DRIVERS\cmusbser.sys
O41 - Driver: Pilote de connexion automatique d'accès distant (RasAcd) - C:\WINDOWS\system32\DRIVERSasacd.sys
O41 - Driver: Miniport réseau étendu (L2TP) (Rasl2tp) - C:\WINDOWS\system32\DRIVERSasl2tp.sys
O41 - Driver: Pilote PPPOE d'accès à distance (RasPppoe) - C:\WINDOWS\system32\DRIVERSaspppoe.sys
O41 - Driver: Parallèle direct (Raspti) - C:\WINDOWS\system32\DRIVERSaspti.sys
O41 - Driver: Rdbss (Rdbss) - C:\WINDOWS\system32\DRIVERSdbss.sys
O41 - Driver: Pilote de redirecteur de périphérique Terminal Server (rdpdr) - C:\WINDOWS\system32\DRIVERSdpdr.sys
O41 - Driver: Pilote de filtre de lecture digitale de CD audio (redbook) - C:\WINDOWS\system32\DRIVERSedbook.sys
O41 - Driver: Secdrv (Secdrv) - C:\WINDOWS\system32\DRIVERS\secdrv.sys
O41 - Driver: SAGEM 802.11g XG762 1211B Driver (SG762_XP) - C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys
O41 - Driver: Splitter audio du noyau Microsoft (splitter) - C:\WINDOWS\system32\drivers\splitter.sys
O41 - Driver: (no object) (sptd) - C:\WINDOWS\System32\Drivers\sptd.sys
O41 - Driver: Pilote de filtre de restauration système (sr) - C:\WINDOWS\system32\DRIVERS\sr.sys
O41 - Driver: Srv (Srv) - C:\WINDOWS\system32\DRIVERS\srv.sys
O41 - Driver: Pilote de bus logiciel (swenum) - C:\WINDOWS\system32\DRIVERS\swenum.sys
O41 - Driver: Synthétiseur de table de sons GC noyau Microsoft (swmidi) - C:\WINDOWS\system32\drivers\swmidi.sys
O41 - Driver: Périphérique audio système du noyau Microsoft (sysaudio) - C:\WINDOWS\system32\drivers\sysaudio.sys
O41 - Driver: Pilote du protocole TCP/IP (Tcpip) - C:\WINDOWS\system32\DRIVERS	cpip.sys
O41 - Driver: Pilote de mise à jour microcode (Update) - C:\WINDOWS\system32\DRIVERS\update.sys
O41 - Driver: Pilote parent générique USB Microsoft (usbccgp) - C:\WINDOWS\system32\DRIVERS\usbccgp.sys
O41 - Driver: Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0 (usbehci) - C:\WINDOWS\system32\DRIVERS\usbehci.sys
O41 - Driver: Concentrateur USB2 (usbhub) - C:\WINDOWS\system32\DRIVERS\usbhub.sys
O41 - Driver: Classe d'imprimantes USB Microsoft (usbprint) - C:\WINDOWS\system32\DRIVERS\usbprint.sys
O41 - Driver: Pilote de stockage de masse USB (usbstor) - C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
O41 - Driver: Pilote miniport de contrôleur hôte universel USB Microsoft (usbuhci) - C:\WINDOWS\system32\DRIVERS\usbuhci.sys
O41 - Driver: ADI Remote NDIS Network Device Driver (USB_RNDIS) - C:\WINDOWS\system32\DRIVERS\usb8023.sys
O41 - Driver: Pilote ARP IP d'accès distant (Wanarp) - C:\WINDOWS\system32\DRIVERS\wanarp.sys
O41 - Driver: Pilote WINMM de compatibilité audio WDM Microsoft (wdmaud) - C:\WINDOWS\system32\drivers\wdmaud.sys
O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Platform Driver (WudfPf) - C:\WINDOWS\system32\DRIVERS\WudfPf.sys
O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Reflector (WudfRd) - C:\WINDOWS\system32\DRIVERS\wudfrd.sys
O41 - Driver: ZDCndis5 Protocol Driver (ZDCndis5) - C:\WINDOWS\system32\ZDCndis5.SYS
O41 - Driver: ZDPNDIS5 NDIS Protocol Driver (ZDPNDIS5) - C:\WINDOWS\system32\ZDPNDIS5.SYS
O41 - Driver: ZDPSp50 NDIS Protocol Driver (ZDPSp50) - C:\WINDOWS\System32\Drivers\ZDPSp50.sys

---\ Logiciels installés (O42)
O42 - Logiciel: 18 Wheels of Steel: American Long Haul 
O42 - Logiciel: ASIO4ALL
O42 - Logiciel: AV Voice Changer Software DIAMOND 6.0
O42 - Logiciel: Adobe Audition 3.0
O42 - Logiciel: Adobe Flash Player 10 ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin
O42 - Logiciel: Adobe Reader 6.0 - Français
O42 - Logiciel: Archiveur WinRAR
O42 - Logiciel: Ares 2.1.1
O42 - Logiciel: Ask Toolbar
O42 - Logiciel: Ask.com Search Assistant 1.0.1
O42 - Logiciel: Assistant de connexion Windows Live
O42 - Logiciel: BearShare
O42 - Logiciel: Choice Guard
O42 - Logiciel: Cool Edit Pro 2.1
O42 - Logiciel: DAEMON Tools Toolbar
O42 - Logiciel: DVD Decrypter (Remove Only)
O42 - Logiciel: Enemy Territory - Quake Wars(TM)
O42 - Logiciel: FL Studio 8
O42 - Logiciel: GM-4200 Gamer Mouse Optical
O42 - Logiciel: GtkRadiant-1.3.8-ET
O42 - Logiciel: HSDPA USB MODEM version 4.112
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
O42 - Logiciel: Hotfix for Windows Media Format 11 SDK (KB929399)
O42 - Logiciel: Hotfix for Windows XP (KB926239)
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5)
O42 - Logiciel: Image Line ToxicIII v1.41 VSTi
O42 - Logiciel: Intel(R) Network Connections 13.5.32.0
O42 - Logiciel: Internet Download Manager
O42 - Logiciel: Java(TM) 6 Update 14
O42 - Logiciel: Kit de Connexion MENARA
O42 - Logiciel: Le Centre de Contrôle de Licences de Syncrosoft
O42 - Logiciel: Lecteur Windows Media 11
O42 - Logiciel: LinPlug CronoX VSTi v3.02
O42 - Logiciel: MSXML 6 Service Pack 2 (KB954459)
O42 - Logiciel: Malwarebytes' Anti-Malware
O42 - Logiciel: Messenger Plus! Live & Sponsor (CiD)
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2
O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack - fra
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft Compression Client Pack 1.0 for Windows XP
O42 - Logiciel: Microsoft Silverlight
O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable
O42 - Logiciel: Module linguistique Microsoft .NET Framework 3.5 - fra
O42 - Logiciel: Mozilla Firefox (3.0.13)
O42 - Logiciel: MyDSC2
O42 - Logiciel: NVIDIA Drivers
O42 - Logiciel: Nero 6 Ultra Edition
O42 - Logiciel: Nero 7 Essentials
O42 - Logiciel: PSP Video Converter 2.0
O42 - Logiciel: REALTEK GbE & FE Ethernet PCI NIC Driver
O42 - Logiciel: Realtek High Definition Audio Driver
O42 - Logiciel: Rob Papen Blue VSTi v1.01 
O42 - Logiciel: RocketDock 1.3.5
O42 - Logiciel: SAGEM F@st 33xx
O42 - Logiciel: Sagem Wi-Fi 11g USB adapter
O42 - Logiciel: Security Task Manager 1.7h
O42 - Logiciel: Shutdown-IT
O42 - Logiciel: Skype™ 4.0
O42 - Logiciel: Slayer2 Demo 2.5
O42 - Logiciel: Super Bloc-notes 2.1
O42 - Logiciel: SyncroSoft Emu (Remove only)
O42 - Logiciel: TeamSpeak 2 RC2
O42 - Logiciel: ToxicIII v1.2 Orion Edition Unlocked VSTi
O42 - Logiciel: TuneUp Utilities 2009
O42 - Logiciel: UBox 2.02
O42 - Logiciel: USB Dual Vibration Joystick
O42 - Logiciel: Uniblue RegistryBooster 2009
O42 - Logiciel: Windows Genuine Advantage Notifications (KB905474)
O42 - Logiciel: Windows Imaging Component
O42 - Logiciel: Windows Installer 3.1 (KB893803)
O42 - Logiciel: Windows Installer Clean Up
O42 - Logiciel: Windows Internet Explorer 8
O42 - Logiciel: Windows Live Messenger
O42 - Logiciel: Windows Media Format 11 runtime
O42 - Logiciel: Windows Media Player 11
O42 - Logiciel: Wolfenstein - Enemy Territory
O42 - Logiciel: World of Warcraft
O42 - Logiciel: Wow Cartographe 1.07
O42 - Logiciel: XML Paper Specification Shared Components Language Pack 1.0
O42 - Logiciel: XML Paper Specification Shared Components Pack 1.0
O42 - Logiciel: Xfire (remove only)
O42 - Logiciel: avast! Antivirus
O42 - Logiciel: free-downloads.net Toolbar
O42 - Logiciel: iZotope Ozone 3
O42 - Logiciel: reFX Vanguard VSTi v1.6.3
O42 - Logiciel: rgcAudio z3ta Plus v1.40

---\ Contenu des dossiers Fichiers Communs (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\18 Wheels of Steel American Long Haul
O43 - CFD:Common File Directory ----D- C:\Program Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\AGEIA Technologies
O43 - CFD:Common File Directory ----D- C:\Program Files\Alcohol Soft
O43 - CFD:Common File Directory ----D- C:\Program Files\AlienGUIse
O43 - CFD:Common File Directory ----D- C:\Program Files\Alwil Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Ares
O43 - CFD:Common File Directory ----D- C:\Program Files\ArKaos VJ 3.6 FC5
O43 - CFD:Common File Directory ----D- C:\Program Files\Arturia
O43 - CFD:Common File Directory ----D- C:\Program Files\ASIO4ALL v2
O43 - CFD:Common File Directory ----D- C:\Program Files\Ask Search Assistant
O43 - CFD:Common File Directory ----D- C:\Program Files\AskBarDis
O43 - CFD:Common File Directory ----D- C:\Program Files\AV VCS 4.0 DIAMOND
O43 - CFD:Common File Directory ----D- C:\Program Files\AV Vcs 6.0 DIAMOND
O43 - CFD:Common File Directory ----D- C:\Program Files\BearShare
O43 - CFD:Common File Directory ----D- C:\Program Files\BearShare Applications
O43 - CFD:Common File Directory ----D- C:\Program Files\BitTorrent
O43 - CFD:Common File Directory ----D- C:\Program Files\CHRYOPROD
O43 - CFD:Common File Directory ----D- C:\Program Files\Circle Developemet
O43 - CFD:Common File Directory ----D- C:\Program Files\Circle Dvelopement
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files
O43 - CFD:Common File Directory ----D- C:\Program Files\ComPlus Applications
O43 - CFD:Common File Directory ----D- C:\Program Files\Conduit
O43 - CFD:Common File Directory ----D- C:\Program Files\coolpro2
O43 - CFD:Common File Directory ----D- C:\Program Files\CyberLink
O43 - CFD:Common File Directory ----D- C:\Program Files\DAEMON Tools Lite
O43 - CFD:Common File Directory ----D- C:\Program Files\DAEMON Tools Toolbar
O43 - CFD:Common File Directory ----D- C:\Program Files\Digidesign
O43 - CFD:Common File Directory ----D- C:\Program Files\DNA
O43 - CFD:Common File Directory ----D- C:\Program Files\DreamStation DXi
O43 - CFD:Common File Directory ----D- C:\Program Files\DVD Decrypter
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\free-downloads.net
O43 - CFD:Common File Directory ----D- C:\Program Files\GtkRadiant-ET-1.3
O43 - CFD:Common File Directory ----D- C:\Program Files\Hewlett-Packard
O43 - CFD:Common File Directory ----D- C:\Program Files\HSDPA USB MODEM
O43 - CFD:Common File Directory ----D- C:\Program Files\id Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Image-Line
O43 - CFD:Common File Directory --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Intel
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Download Manager
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\iZotope
O43 - CFD:Common File Directory ----D- C:\Program Files\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Kaspersky Lab
O43 - CFD:Common File Directory ----D- C:\Program Files\ma-config.com
O43 - CFD:Common File Directory ----D- C:\Program Files\MagicISO
O43 - CFD:Common File Directory ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD:Common File Directory ----D- C:\Program Files\Menara
O43 - CFD:Common File Directory ----D- C:\Program Files\Messenger Plus! Live
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Visual Studio
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Works
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft.NET
O43 - CFD:Common File Directory ----D- C:\Program Files\Movie Maker
O43 - CFD:Common File Directory ----D- C:\Program Files\Mozilla Firefox
O43 - CFD:Common File Directory ----D- C:\Program Files\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files\MSECACHE
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Messenger
O43 - CFD:Common File Directory ----D- C:\Program Files\MSXML 6.0
O43 - CFD:Common File Directory ----D- C:\Program Files\MyDSC2
O43 - CFD:Common File Directory ----D- C:\Program Files\Native Instruments

Nowax · Answer

Rapport de ZHPDiag v1.24.09 par Nicolas Coolman
Run by Administrateur at 30/08/2009 22:40:37
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox (3.0.13)

Total RAM: 1023,2 Mb (22 % free)
System drive C: 149 Go (41 Go free)

---\ Processus lancés
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Program Files\WindowsSecurity\SystemR1.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\AEIWLSVC.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe

---\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

---\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx

---\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: C:\Program Files\AskBarDis\bar\bin\askBar.dll - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O3 - Toolbar: C:\Program Files\free-downloads.net	bfree.dll - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

---\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Trust Gaming mouse] C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
O4 - HKLM\..\Run: [OlStatusMon] C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ares] C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\policies\Explorer: [HonorAutoRunSetting] Data=1
O4 - Global Startup: DSLMON.lnk - C:\Program Files\Menara\dslmon.exe

---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223

---\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\system32\inetcomm.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\Windows\system32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\Windows\system32\SHELL32.dll

---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\System32\WgaLogon.dll

---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\system32\browseui.dll

---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Aeiwsvc (Aeiwsvc) - C:\WINDOWS\system32\AEIWLSVC.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! Antivirus) - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
O23 - Service:  (MBAMService) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: olMntrService (olMntrService) - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA (PnkBstrA) - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - C:\WINDOWS\System32\TUProgSt.exe

---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Maintenance en 1 clic.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{088C996B-D3A9-4963-B0D8-7D37F5935AC9}.job

---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Mise à jour de la version d’Internet Explorer - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32undll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
O40 - ASIC: Personnalisation du navigateur - >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - (not file)
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32egsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32	hemeui.dll
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: .NET Framework - {3F7924B9-D148-3141-87B1-68F36043A940} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: .NET Framework - {B508B3F1-A24A-32C0-B310-85786919EF28} - (not file)
O40 - ASIC: .NET Framework - {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - (not file)
O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)
O40 - ASIC: Planificateur de tâches - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx
O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)

---\ Pilotes lancés au démarrage (O41)
O41 - Driver: General Purpose USB Driver (adildr.sys) (ADILOADER) - C:\WINDOWS\System32\Drivers\adildr.sys
O41 - Driver: USB ADSL WAN Adapter (adiusbaw) - C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
O41 - Driver: Suppresseur d'écho acoustique (Noyau Microsoft) (aec) - C:\WINDOWS\system32\drivers\aec.sys
O41 - Driver: Protocole client ARP 1394 (Arp1394) - C:\WINDOWS\system32\DRIVERS\arp1394.sys
O41 - Driver: Pilote de média asynchrone RAS (AsyncMac) - C:\WINDOWS\system32\DRIVERS\asyncmac.sys
O41 - Driver: Protocole client ATM ARP (Atmarpc) - C:\WINDOWS\system32\DRIVERS\atmarpc.sys
O41 - Driver: Pilote audio Stub (audstub) - C:\WINDOWS\system32\DRIVERS\audstub.sys
O41 - Driver: Team H2O CLEDX service (CLEDX) - C:\WINDOWS\system32\DRIVERS\cledx.sys
O41 - Driver: (no object) (dmboot) - C:\WINDOWS\System32\drivers\dmboot.sys
O41 - Driver: Pilote de Gestionnaire de disque logique (dmio) - C:\WINDOWS\System32\drivers\dmio.sys
O41 - Driver: (no object) (dmload) - C:\WINDOWS\System32\drivers\dmload.sys
O41 - Driver: Synthétiseur DLS du noyau Microsoft (DMusic) - C:\WINDOWS\system32\drivers\DMusic.sys
O41 - Driver: Filtre de décodeur DRM (Noyau Microsoft) (drmkaud) - C:\WINDOWS\system32\drivers\drmkaud.sys
O41 - Driver: Intel(R) PRO Network Connection Driver (E100B) - C:\WINDOWS\system32\DRIVERS\e100b325.sys
O41 - Driver: FltMgr (FltMgr) - C:\WINDOWS\system32\DRIVERS\fltMgr.sys
O41 - Driver: GMFilter Filter (GMFilter Filter) - C:\WINDOWS\System32\Drivers\GMFilter.sys
O41 - Driver: Classificateur de paquets générique (Gpc) - C:\WINDOWS\system32\DRIVERS\msgpc.sys
O41 - Driver: Hamachi Network Interface (hamachi) - C:\WINDOWS\system32\DRIVERS\hamachi.sys
O41 - Driver: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
O41 - Driver: Pilote de classe HID Microsoft (hidusb) - C:\WINDOWS\system32\DRIVERS\hidusb.sys
O41 - Driver: Pilote pour clavier i8042 et souris sur port PS/2 (i8042prt) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys
O41 - Driver: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - C:\WINDOWS\system32\drivers\RtkHDAud.sys
O41 - Driver: Pilote de processeur Intel (intelppm) - C:\WINDOWS\system32\DRIVERS\intelppm.sys
O41 - Driver: Pilote du pare-feu Windows IPv6 (Ip6Fw) - C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
O41 - Driver: Pilote de filtre de trafic IP (IpFilterDriver) - C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
O41 - Driver: Pilote de tunnelage IP dans IP (IpInIp) - C:\WINDOWS\system32\DRIVERS\ipinip.sys
O41 - Driver: Pilote IPSEC (IPSec) - C:\WINDOWS\system32\DRIVERS\ipsec.sys
O41 - Driver: Service énumérateur IR (IRENUM) - C:\WINDOWS\system32\DRIVERS\irenum.sys
O41 - Driver: Pilote HID de clavier (kbdhid) - C:\WINDOWS\system32\DRIVERS\kbdhid.sys
O41 - Driver: Mélangeur audio Wave de noyau Microsoft (kmixer) - C:\WINDOWS\system32\drivers\kmixer.sys
O41 - Driver: (no object) (MBAMProtector) - C:\WINDOWS\system32\drivers\mbam.sys
O41 - Driver: Pilote HID de souris (mouhid) - C:\WINDOWS\system32\DRIVERS\mouhid.sys
O41 - Driver: Redirecteur client WebDav (MRxDAV) - C:\WINDOWS\system32\DRIVERS\mrxdav.sys
O41 - Driver: MRXSMB (MRxSmb) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
O41 - Driver: Proxy de service de répartition Microsoft (MSKSSRV) - C:\WINDOWS\system32\drivers\MSKSSRV.sys
O41 - Driver: Proxy d'horloge de répartition Microsoft (MSPCLOCK) - C:\WINDOWS\system32\drivers\MSPCLOCK.sys
O41 - Driver: Proxy de gestion de qualité de répartition Microsoft (MSPQM) - C:\WINDOWS\system32\drivers\MSPQM.sys
O41 - Driver: Pilote BIOS de gestion de systèmes Microsoft (mssmbios) - C:\WINDOWS\system32\DRIVERS\mssmbios.sys
O41 - Driver: Pilote TAPI NDIS d'accès distant (NdisTapi) - C:\WINDOWS\system32\DRIVERS
distapi.sys
O41 - Driver: NDIS mode utilisateur E/S Protocole (Ndisuio) - C:\WINDOWS\system32\DRIVERS
disuio.sys
O41 - Driver: Pilote réseau étendu NDIS d'accès distant (NdisWan) - C:\WINDOWS\system32\DRIVERS
diswan.sys
O41 - Driver: Interface NetBIOS (NetBIOS) - C:\WINDOWS\system32\DRIVERS
etbios.sys
O41 - Driver: NetBIOS sur TCP/IP (NetBT) - C:\WINDOWS\system32\DRIVERS
etbt.sys
O41 - Driver: Pilote réseau 1394 (NIC1394) - C:\WINDOWS\system32\DRIVERS
ic1394.sys
O41 - Driver: (no object) (nv) - C:\WINDOWS\system32\DRIVERS
v4_mini.sys
O41 - Driver: Pilote de filtre de trafic IPX (NwlnkFlt) - C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
O41 - Driver: Pilote de transfert de trafic IPX (NwlnkFwd) - C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
O41 - Driver: Contrôleurs hôte IEEE 1394 compatible OHCI (ohci1394) - C:\WINDOWS\system32\DRIVERS\ohci1394.sys
O41 - Driver: Miniport réseau étendu (PPTP) (PptpMiniport) - C:\WINDOWS\system32\DRIVERSaspptp.sys
O41 - Driver: Planificateur de paquets QoS (PSched) - C:\WINDOWS\system32\DRIVERS\psched.sys
O41 - Driver: Pilote de liaison parallèle directe (Ptilink) - C:\WINDOWS\system32\DRIVERS\ptilink.sys
O41 - Driver: Mobile Connector USB Device for Legacy Serial Communication (qcusbser) - C:\WINDOWS\system32\DRIVERS\cmusbser.sys
O41 - Driver: Pilote de connexion automatique d'accès distant (RasAcd) - C:\WINDOWS\system32\DRIVERSasacd.sys
O41 - Driver: Miniport réseau étendu (L2TP) (Rasl2tp) - C:\WINDOWS\system32\DRIVERSasl2tp.sys
O41 - Driver: Pilote PPPOE d'accès à distance (RasPppoe) - C:\WINDOWS\system32\DRIVERSaspppoe.sys
O41 - Driver: Parallèle direct (Raspti) - C:\WINDOWS\system32\DRIVERSaspti.sys
O41 - Driver: Rdbss (Rdbss) - C:\WINDOWS\system32\DRIVERSdbss.sys
O41 - Driver: Pilote de redirecteur de périphérique Terminal Server (rdpdr) - C:\WINDOWS\system32\DRIVERSdpdr.sys
O41 - Driver: Pilote de filtre de lecture digitale de CD audio (redbook) - C:\WINDOWS\system32\DRIVERSedbook.sys
O41 - Driver: Secdrv (Secdrv) - C:\WINDOWS\system32\DRIVERS\secdrv.sys
O41 - Driver: SAGEM 802.11g XG762 1211B Driver (SG762_XP) - C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys
O41 - Driver: Splitter audio du noyau Microsoft (splitter) - C:\WINDOWS\system32\drivers\splitter.sys
O41 - Driver: (no object) (sptd) - C:\WINDOWS\System32\Drivers\sptd.sys
O41 - Driver: Pilote de filtre de restauration système (sr) - C:\WINDOWS\system32\DRIVERS\sr.sys
O41 - Driver: Srv (Srv) - C:\WINDOWS\system32\DRIVERS\srv.sys
O41 - Driver: Pilote de bus logiciel (swenum) - C:\WINDOWS\system32\DRIVERS\swenum.sys
O41 - Driver: Synthétiseur de table de sons GC noyau Microsoft (swmidi) - C:\WINDOWS\system32\drivers\swmidi.sys
O41 - Driver: Périphérique audio système du noyau Microsoft (sysaudio) - C:\WINDOWS\system32\drivers\sysaudio.sys
O41 - Driver: Pilote du protocole TCP/IP (Tcpip) - C:\WINDOWS\system32\DRIVERS	cpip.sys
O41 - Driver: Pilote de mise à jour microcode (Update) - C:\WINDOWS\system32\DRIVERS\update.sys
O41 - Driver: Pilote parent générique USB Microsoft (usbccgp) - C:\WINDOWS\system32\DRIVERS\usbccgp.sys
O41 - Driver: Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0 (usbehci) - C:\WINDOWS\system32\DRIVERS\usbehci.sys
O41 - Driver: Concentrateur USB2 (usbhub) - C:\WINDOWS\system32\DRIVERS\usbhub.sys
O41 - Driver: Classe d'imprimantes USB Microsoft (usbprint) - C:\WINDOWS\system32\DRIVERS\usbprint.sys
O41 - Driver: Pilote de stockage de masse USB (usbstor) - C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
O41 - Driver: Pilote miniport de contrôleur hôte universel USB Microsoft (usbuhci) - C:\WINDOWS\system32\DRIVERS\usbuhci.sys
O41 - Driver: ADI Remote NDIS Network Device Driver (USB_RNDIS) - C:\WINDOWS\system32\DRIVERS\usb8023.sys
O41 - Driver: Pilote ARP IP d'accès distant (Wanarp) - C:\WINDOWS\system32\DRIVERS\wanarp.sys
O41 - Driver: Pilote WINMM de compatibilité audio WDM Microsoft (wdmaud) - C:\WINDOWS\system32\drivers\wdmaud.sys
O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Platform Driver (WudfPf) - C:\WINDOWS\system32\DRIVERS\WudfPf.sys
O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Reflector (WudfRd) - C:\WINDOWS\system32\DRIVERS\wudfrd.sys
O41 - Driver: ZDCndis5 Protocol Driver (ZDCndis5) - C:\WINDOWS\system32\ZDCndis5.SYS
O41 - Driver: ZDPNDIS5 NDIS Protocol Driver (ZDPNDIS5) - C:\WINDOWS\system32\ZDPNDIS5.SYS
O41 - Driver: ZDPSp50 NDIS Protocol Driver (ZDPSp50) - C:\WINDOWS\System32\Drivers\ZDPSp50.sys

Nowax · Answer

Rapport de ZHPDiag v1.24.09 par Nicolas Coolman
Run by Administrateur at 30/08/2009 22:40:37
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox (3.0.13)

Total RAM: 1023,2 Mb (22 % free)
System drive C: 149 Go (41 Go free)

---\ Processus lancés
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Program Files\WindowsSecurity\SystemR1.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\AEIWLSVC.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe

---\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

---\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx

---\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: C:\Program Files\AskBarDis\bar\bin\askBar.dll - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O3 - Toolbar: C:\Program Files\free-downloads.net	bfree.dll - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

---\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Trust Gaming mouse] C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
O4 - HKLM\..\Run: [OlStatusMon] C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ares] C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\policies\Explorer: [HonorAutoRunSetting] Data=1
O4 - Global Startup: DSLMON.lnk - C:\Program Files\Menara\dslmon.exe

---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223

---\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\system32\inetcomm.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\Windows\system32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\Windows\system32\SHELL32.dll

---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\System32\WgaLogon.dll

---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\system32\browseui.dll

---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Aeiwsvc (Aeiwsvc) - C:\WINDOWS\system32\AEIWLSVC.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! Antivirus) - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
O23 - Service:  (MBAMService) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: olMntrService (olMntrService) - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA (PnkBstrA) - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - C:\WINDOWS\System32\TUProgSt.exe

---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Maintenance en 1 clic.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{088C996B-D3A9-4963-B0D8-7D37F5935AC9}.job

---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Mise à jour de la version d’Internet Explorer - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32undll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
O40 - ASIC: Personnalisation du navigateur - >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - (not file)
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32egsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32	hemeui.dll
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: .NET Framework - {3F7924B9-D148-3141-87B1-68F36043A940} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: .NET Framework - {B508B3F1-A24A-32C0-B310-85786919EF28} - (not file)
O40 - ASIC: .NET Framework - {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - (not file)

Nowax · Answer

Rapport de ZHPDiag v1.24.09 par Nicolas Coolman
Run by Administrateur at 30/08/2009 22:40:37
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox (3.0.13)

Total RAM: 1023,2 Mb (22 % free)
System drive C: 149 Go (41 Go free)

---\ Processus lancés
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Program Files\WindowsSecurity\SystemR1.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\AEIWLSVC.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe

---\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

---\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx

---\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll

---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: C:\Program Files\AskBarDis\bar\bin\askBar.dll - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll
O3 - Toolbar: C:\Program Files\free-downloads.net	bfree.dll - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

---\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Trust Gaming mouse] C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
O4 - HKLM\..\Run: [OlStatusMon] C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ares] C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\policies\Explorer: [HonorAutoRunSetting] Data=1
O4 - Global Startup: DSLMON.lnk - C:\Program Files\Menara\dslmon.exe

---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223

---\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\system32\inetcomm.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\Windows\system32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\Windows\system32\SHELL32.dll

---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\System32\WgaLogon.dll

---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\system32\browseui.dll

---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Aeiwsvc (Aeiwsvc) - C:\WINDOWS\system32\AEIWLSVC.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! Antivirus) - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
O23 - Service:  (MBAMService) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: olMntrService (olMntrService) - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA (PnkBstrA) - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - C:\WINDOWS\System32\TUProgSt.exe

Nowax · Answer

---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Maintenance en 1 clic.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{088C996B-D3A9-4963-B0D8-7D37F5935AC9}.job

---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Mise à jour de la version d’Internet Explorer - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32undll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
O40 - ASIC: Personnalisation du navigateur - >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - (not file)
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32egsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32	hemeui.dll
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: .NET Framework - {3F7924B9-D148-3141-87B1-68F36043A940} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: .NET Framework - {B508B3F1-A24A-32C0-B310-85786919EF28} - (not file)
O40 - ASIC: .NET Framework - {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - (not file)
O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)
O40 - ASIC: Planificateur de tâches - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx
O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)

---\ Pilotes lancés au démarrage (O41)
O41 - Driver: General Purpose USB Driver (adildr.sys) (ADILOADER) - C:\WINDOWS\System32\Drivers\adildr.sys
O41 - Driver: USB ADSL WAN Adapter (adiusbaw) - C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
O41 - Driver: Suppresseur d'écho acoustique (Noyau Microsoft) (aec) - C:\WINDOWS\system32\drivers\aec.sys
O41 - Driver: Protocole client ARP 1394 (Arp1394) - C:\WINDOWS\system32\DRIVERS\arp1394.sys
O41 - Driver: Pilote de média asynchrone RAS (AsyncMac) - C:\WINDOWS\system32\DRIVERS\asyncmac.sys
O41 - Driver: Protocole client ATM ARP (Atmarpc) - C:\WINDOWS\system32\DRIVERS\atmarpc.sys
O41 - Driver: Pilote audio Stub (audstub) - C:\WINDOWS\system32\DRIVERS\audstub.sys
O41 - Driver: Team H2O CLEDX service (CLEDX) - C:\WINDOWS\system32\DRIVERS\cledx.sys
O41 - Driver: (no object) (dmboot) - C:\WINDOWS\System32\drivers\dmboot.sys
O41 - Driver: Pilote de Gestionnaire de disque logique (dmio) - C:\WINDOWS\System32\drivers\dmio.sys
O41 - Driver: (no object) (dmload) - C:\WINDOWS\System32\drivers\dmload.sys
O41 - Driver: Synthétiseur DLS du noyau Microsoft (DMusic) - C:\WINDOWS\system32\drivers\DMusic.sys
O41 - Driver: Filtre de décodeur DRM (Noyau Microsoft) (drmkaud) - C:\WINDOWS\system32\drivers\drmkaud.sys
O41 - Driver: Intel(R) PRO Network Connection Driver (E100B) - C:\WINDOWS\system32\DRIVERS\e100b325.sys
O41 - Driver: FltMgr (FltMgr) - C:\WINDOWS\system32\DRIVERS\fltMgr.sys
O41 - Driver: GMFilter Filter (GMFilter Filter) - C:\WINDOWS\System32\Drivers\GMFilter.sys
O41 - Driver: Classificateur de paquets générique (Gpc) - C:\WINDOWS\system32\DRIVERS\msgpc.sys
O41 - Driver: Hamachi Network Interface (hamachi) - C:\WINDOWS\system32\DRIVERS\hamachi.sys
O41 - Driver: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
O41 - Driver: Pilote de classe HID Microsoft (hidusb) - C:\WINDOWS\system32\DRIVERS\hidusb.sys
O41 - Driver: Pilote pour clavier i8042 et souris sur port PS/2 (i8042prt) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys
O41 - Driver: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - C:\WINDOWS\system32\drivers\RtkHDAud.sys
O41 - Driver: Pilote de processeur Intel (intelppm) - C:\WINDOWS\system32\DRIVERS\intelppm.sys
O41 - Driver: Pilote du pare-feu Windows IPv6 (Ip6Fw) - C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
O41 - Driver: Pilote de filtre de trafic IP (IpFilterDriver) - C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
O41 - Driver: Pilote de tunnelage IP dans IP (IpInIp) - C:\WINDOWS\system32\DRIVERS\ipinip.sys
O41 - Driver: Pilote IPSEC (IPSec) - C:\WINDOWS\system32\DRIVERS\ipsec.sys
O41 - Driver: Service énumérateur IR (IRENUM) - C:\WINDOWS\system32\DRIVERS\irenum.sys
O41 - Driver: Pilote HID de clavier (kbdhid) - C:\WINDOWS\system32\DRIVERS\kbdhid.sys
O41 - Driver: Mélangeur audio Wave de noyau Microsoft (kmixer) - C:\WINDOWS\system32\drivers\kmixer.sys
O41 - Driver: (no object) (MBAMProtector) - C:\WINDOWS\system32\drivers\mbam.sys
O41 - Driver: Pilote HID de souris (mouhid) - C:\WINDOWS\system32\DRIVERS\mouhid.sys
O41 - Driver: Redirecteur client WebDav (MRxDAV) - C:\WINDOWS\system32\DRIVERS\mrxdav.sys
O41 - Driver: MRXSMB (MRxSmb) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
O41 - Driver: Proxy de service de répartition Microsoft (MSKSSRV) - C:\WINDOWS\system32\drivers\MSKSSRV.sys
O41 - Driver: Proxy d'horloge de répartition Microsoft (MSPCLOCK) - C:\WINDOWS\system32\drivers\MSPCLOCK.sys
O41 - Driver: Proxy de gestion de qualité de répartition Microsoft (MSPQM) - C:\WINDOWS\system32\drivers\MSPQM.sys
O41 - Driver: Pilote BIOS de gestion de systèmes Microsoft (mssmbios) - C:\WINDOWS\system32\DRIVERS\mssmbios.sys
O41 - Driver: Pilote TAPI NDIS d'accès distant (NdisTapi) - C:\WINDOWS\system32\DRIVERS
distapi.sys
O41 - Driver: NDIS mode utilisateur E/S Protocole (Ndisuio) - C:\WINDOWS\system32\DRIVERS
disuio.sys
O41 - Driver: Pilote réseau étendu NDIS d'accès distant (NdisWan) - C:\WINDOWS\system32\DRIVERS
diswan.sys
O41 - Driver: Interface NetBIOS (NetBIOS) - C:\WINDOWS\system32\DRIVERS
etbios.sys
O41 - Driver: NetBIOS sur TCP/IP (NetBT) - C:\WINDOWS\system32\DRIVERS
etbt.sys
O41 - Driver: Pilote réseau 1394 (NIC1394) - C:\WINDOWS\system32\DRIVERS
ic1394.sys
O41 - Driver: (no object) (nv) - C:\WINDOWS\system32\DRIVERS
v4_mini.sys
O41 - Driver: Pilote de filtre de trafic IPX (NwlnkFlt) - C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
O41 - Driver: Pilote de transfert de trafic IPX (NwlnkFwd) - C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
O41 - Driver: Contrôleurs hôte IEEE 1394 compatible OHCI (ohci1394) - C:\WINDOWS\system32\DRIVERS\ohci1394.sys
O41 - Driver: Miniport réseau étendu (PPTP) (PptpMiniport) - C:\WINDOWS\system32\DRIVERSaspptp.sys
O41 - Driver: Planificateur de paquets QoS (PSched) - C:\WINDOWS\system32\DRIVERS\psched.sys
O41 - Driver: Pilote de liaison parallèle directe (Ptilink) - C:\WINDOWS\system32\DRIVERS\ptilink.sys
O41 - Driver: Mobile Connector USB Device for Legacy Serial Communication (qcusbser) - C:\WINDOWS\system32\DRIVERS\cmusbser.sys
O41 - Driver: Pilote de connexion automatique d'accès distant (RasAcd) - C:\WINDOWS\system32\DRIVERSasacd.sys
O41 - Driver: Miniport réseau étendu (L2TP) (Rasl2tp) - C:\WINDOWS\system32\DRIVERSasl2tp.sys
O41 - Driver: Pilote PPPOE d'accès à distance (RasPppoe) - C:\WINDOWS\system32\DRIVERSaspppoe.sys
O41 - Driver: Parallèle direct (Raspti) - C:\WINDOWS\system32\DRIVERSaspti.sys
O41 - Driver: Rdbss (Rdbss) - C:\WINDOWS\system32\DRIVERSdbss.sys
O41 - Driver: Pilote de redirecteur de périphérique Terminal Server (rdpdr) - C:\WINDOWS\system32\DRIVERSdpdr.sys
O41 - Driver: Pilote de filtre de lecture digitale de CD audio (redbook) - C:\WINDOWS\system32\DRIVERSedbook.sys
O41 - Driver: Secdrv (Secdrv) - C:\WINDOWS\system32\DRIVERS\secdrv.sys
O41 - Driver: SAGEM 802.11g XG762 1211B Driver (SG762_XP) - C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys
O41 - Driver: Splitter audio du noyau Microsoft (splitter) - C:\WINDOWS\system32\drivers\splitter.sys
O41 - Driver: (no object) (sptd) - C:\WINDOWS\System32\Drivers\sptd.sys
O41 - Driver: Pilote de filtre de restauration système (sr) - C:\WINDOWS\system32\DRIVERS\sr.sys
O41 - Driver: Srv (Srv) - C:\WINDOWS\system32\DRIVERS\srv.sys
O41 - Driver: Pilote de bus logiciel (swenum) - C:\WINDOWS\system32\DRIVERS\swenum.sys
O41 - Driver: Synthétiseur de table de sons GC noyau Microsoft (swmidi) - C:\WINDOWS\system32\drivers\swmidi.sys
O41 - Driver: Périphérique audio système du noyau Microsoft (sysaudio) - C:\WINDOWS\system32\drivers\sysaudio.sys
O41 - Driver: Pilote du protocole TCP/IP (Tcpip) - C:\WINDOWS\system32\DRIVERS	cpip.sys
O41 - Driver: Pilote de mise à jour microcode (Update) - C:\WINDOWS\system32\DRIVERS\update.sys
O41 - Driver: Pilote parent générique USB Microsoft (usbccgp) - C:\WINDOWS\system32\DRIVERS\usbccgp.sys
O41 - Driver: Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0 (usbehci) - C:\WINDOWS\system32\DRIVERS\usbehci.sys
O41 - Driver: Concentrateur USB2 (usbhub) - C:\WINDOWS\system32\DRIVERS\usbhub.sys
O41 - Driver: Classe d'imprimantes USB Microsoft (usbprint) - C:\WINDOWS\system32\DRIVERS\usbprint.sys
O41 - Driver: Pilote de stockage de masse USB (usbstor) - C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
O41 - Driver: Pilote miniport de contrôleur hôte universel USB Microsoft (usbuhci) - C:\WINDOWS\system32\DRIVERS\usbuhci.sys
O41 - Driver: ADI Remote NDIS Network Device Driver (USB_RNDIS) - C:\WINDOWS\system32\DRIVERS\usb8023.sys
O41 - Driver: Pilote ARP IP d'accès distant (Wanarp) - C:\WINDOWS\system32\DRIVERS\wanarp.sys
O41 - Driver: Pilote WINMM de compatibilité audio WDM Microsoft (wdmaud) - C:\WINDOWS\system32\drivers\wdmaud.sys
O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Platform Driver (WudfPf) - C:\WINDOWS\system32\DRIVERS\WudfPf.sys
O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Reflector (WudfRd) - C:\WINDOWS\system32\DRIVERS\wudfrd.sys
O41 - Driver: ZDCndis5 Protocol Driver (ZDCndis5) - C:\WINDOWS\system32\ZDCndis5.SYS
O41 - Driver: ZDPNDIS5 NDIS Protocol Driver (ZDPNDIS5) - C:\WINDOWS\system32\ZDPNDIS5.SYS
O41 - Driver: ZDPSp50 NDIS Protocol Driver (ZDPSp50) - C:\WINDOWS\System32\Drivers\ZDPSp50.sys

---\ Logiciels installés (O42)
O42 - Logiciel: 18 Wheels of Steel: American Long Haul 
O42 - Logiciel: ASIO4ALL
O42 - Logiciel: AV Voice Changer Software DIAMOND 6.0
O42 - Logiciel: Adobe Audition 3.0
O42 - Logiciel: Adobe Flash Player 10 ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin
O42 - Logiciel: Adobe Reader 6.0 - Français
O42 - Logiciel: Archiveur WinRAR
O42 - Logiciel: Ares 2.1.1
O42 - Logiciel: Ask Toolbar
O42 - Logiciel: Ask.com Search Assistant 1.0.1
O42 - Logiciel: Assistant de connexion Windows Live
O42 - Logiciel: BearShare
O42 - Logiciel: Choice Guard
O42 - Logiciel: Cool Edit Pro 2.1
O42 - Logiciel: DAEMON Tools Toolbar
O42 - Logiciel: DVD Decrypter (Remove Only)
O42 - Logiciel: Enemy Territory - Quake Wars(TM)
O42 - Logiciel: FL Studio 8
O42 - Logiciel: GM-4200 Gamer Mouse Optical
O42 - Logiciel: GtkRadiant-1.3.8-ET
O42 - Logiciel: HSDPA USB MODEM version 4.112
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
O42 - Logiciel: Hotfix for Windows Media Format 11 SDK (KB929399)
O42 - Logiciel: Hotfix for Windows XP (KB926239)
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5)
O42 - Logiciel: Image Line ToxicIII v1.41 VSTi
O42 - Logiciel: Intel(R) Network Connections 13.5.32.0
O42 - Logiciel: Internet Download Manager
O42 - Logiciel: Java(TM) 6 Update 14
O42 - Logiciel: Kit de Connexion MENARA
O42 - Logiciel: Le Centre de Contrôle de Licences de Syncrosoft
O42 - Logiciel: Lecteur Windows Media 11
O42 - Logiciel: LinPlug CronoX VSTi v3.02
O42 - Logiciel: MSXML 6 Service Pack 2 (KB954459)
O42 - Logiciel: Malwarebytes' Anti-Malware
O42 - Logiciel: Messenger Plus! Live & Sponsor (CiD)
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2
O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack - fra
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft Compression Client Pack 1.0 for Windows XP
O42 - Logiciel: Microsoft Silverlight
O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable
O42 - Logiciel: Module linguistique Microsoft .NET Framework 3.5 - fra
O42 - Logiciel: Mozilla Firefox (3.0.13)
O42 - Logiciel: MyDSC2
O42 - Logiciel: NVIDIA Drivers
O42 - Logiciel: Nero 6 Ultra Edition
O42 - Logiciel: Nero 7 Essentials
O42 - Logiciel: PSP Video Converter 2.0
O42 - Logiciel: REALTEK GbE & FE Ethernet PCI NIC Driver
O42 - Logiciel: Realtek High Definition Audio Driver
O42 - Logiciel: Rob Papen Blue VSTi v1.01 
O42 - Logiciel: RocketDock 1.3.5
O42 - Logiciel: SAGEM F@st 33xx
O42 - Logiciel: Sagem Wi-Fi 11g USB adapter
O42 - Logiciel: Security Task Manager 1.7h
O42 - Logiciel: Shutdown-IT
O42 - Logiciel: Skype™ 4.0
O42 - Logiciel: Slayer2 Demo 2.5
O42 - Logiciel: Super Bloc-notes 2.1
O42 - Logiciel: SyncroSoft Emu (Remove only)
O42 - Logiciel: TeamSpeak 2 RC2
O42 - Logiciel: ToxicIII v1.2 Orion Edition Unlocked VSTi
O42 - Logiciel: TuneUp Utilities 2009
O42 - Logiciel: UBox 2.02
O42 - Logiciel: USB Dual Vibration Joystick
O42 - Logiciel: Uniblue RegistryBooster 2009
O42 - Logiciel: Windows Genuine Advantage Notifications (KB905474)
O42 - Logiciel: Windows Imaging Component
O42 - Logiciel: Windows Installer 3.1 (KB893803)
O42 - Logiciel: Windows Installer Clean Up
O42 - Logiciel: Windows Internet Explorer 8
O42 - Logiciel: Windows Live Messenger
O42 - Logiciel: Windows Media Format 11 runtime
O42 - Logiciel: Windows Media Player 11
O42 - Logiciel: Wolfenstein - Enemy Territory
O42 - Logiciel: World of Warcraft
O42 - Logiciel: Wow Cartographe 1.07
O42 - Logiciel: XML Paper Specification Shared Components Language Pack 1.0
O42 - Logiciel: XML Paper Specification Shared Components Pack 1.0
O42 - Logiciel: Xfire (remove only)
O42 - Logiciel: avast! Antivirus
O42 - Logiciel: free-downloads.net Toolbar
O42 - Logiciel: iZotope Ozone 3
O42 - Logiciel: reFX Vanguard VSTi v1.6.3
O42 - Logiciel: rgcAudio z3ta Plus v1.40

Nowax · Answer

---\ Contenu des dossiers Fichiers Communs (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\18 Wheels of Steel American Long Haul
O43 - CFD:Common File Directory ----D- C:\Program Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\AGEIA Technologies
O43 - CFD:Common File Directory ----D- C:\Program Files\Alcohol Soft
O43 - CFD:Common File Directory ----D- C:\Program Files\AlienGUIse
O43 - CFD:Common File Directory ----D- C:\Program Files\Alwil Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Ares
O43 - CFD:Common File Directory ----D- C:\Program Files\ArKaos VJ 3.6 FC5
O43 - CFD:Common File Directory ----D- C:\Program Files\Arturia
O43 - CFD:Common File Directory ----D- C:\Program Files\ASIO4ALL v2
O43 - CFD:Common File Directory ----D- C:\Program Files\Ask Search Assistant
O43 - CFD:Common File Directory ----D- C:\Program Files\AskBarDis
O43 - CFD:Common File Directory ----D- C:\Program Files\AV VCS 4.0 DIAMOND
O43 - CFD:Common File Directory ----D- C:\Program Files\AV Vcs 6.0 DIAMOND
O43 - CFD:Common File Directory ----D- C:\Program Files\BearShare
O43 - CFD:Common File Directory ----D- C:\Program Files\BearShare Applications
O43 - CFD:Common File Directory ----D- C:\Program Files\BitTorrent
O43 - CFD:Common File Directory ----D- C:\Program Files\CHRYOPROD
O43 - CFD:Common File Directory ----D- C:\Program Files\Circle Developemet
O43 - CFD:Common File Directory ----D- C:\Program Files\Circle Dvelopement
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files
O43 - CFD:Common File Directory ----D- C:\Program Files\ComPlus Applications
O43 - CFD:Common File Directory ----D- C:\Program Files\Conduit
O43 - CFD:Common File Directory ----D- C:\Program Files\coolpro2
O43 - CFD:Common File Directory ----D- C:\Program Files\CyberLink
O43 - CFD:Common File Directory ----D- C:\Program Files\DAEMON Tools Lite
O43 - CFD:Common File Directory ----D- C:\Program Files\DAEMON Tools Toolbar
O43 - CFD:Common File Directory ----D- C:\Program Files\Digidesign
O43 - CFD:Common File Directory ----D- C:\Program Files\DNA
O43 - CFD:Common File Directory ----D- C:\Program Files\DreamStation DXi
O43 - CFD:Common File Directory ----D- C:\Program Files\DVD Decrypter
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\free-downloads.net
O43 - CFD:Common File Directory ----D- C:\Program Files\GtkRadiant-ET-1.3
O43 - CFD:Common File Directory ----D- C:\Program Files\Hewlett-Packard
O43 - CFD:Common File Directory ----D- C:\Program Files\HSDPA USB MODEM
O43 - CFD:Common File Directory ----D- C:\Program Files\id Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Image-Line
O43 - CFD:Common File Directory --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Intel
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Download Manager
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\iZotope
O43 - CFD:Common File Directory ----D- C:\Program Files\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Kaspersky Lab
O43 - CFD:Common File Directory ----D- C:\Program Files\ma-config.com
O43 - CFD:Common File Directory ----D- C:\Program Files\MagicISO
O43 - CFD:Common File Directory ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD:Common File Directory ----D- C:\Program Files\Menara
O43 - CFD:Common File Directory ----D- C:\Program Files\Messenger Plus! Live
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Visual Studio
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Works
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft.NET
O43 - CFD:Common File Directory ----D- C:\Program Files\Movie Maker
O43 - CFD:Common File Directory ----D- C:\Program Files\Mozilla Firefox
O43 - CFD:Common File Directory ----D- C:\Program Files\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files\MSECACHE
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Messenger
O43 - CFD:Common File Directory ----D- C:\Program Files\MSXML 6.0
O43 - CFD:Common File Directory ----D- C:\Program Files\MyDSC2
O43 - CFD:Common File Directory ----D- C:\Program Files\Native Instruments
O43 - CFD:Common File Directory ----D- C:\Program Files\Nero
O43 - CFD:Common File Directory ----D- C:\Program Files\NetMeeting
O43 - CFD:Common File Directory ----D- C:\Program Files\Olivetti
O43 - CFD:Common File Directory ----D- C:\Program Files\Outlook Express
O43 - CFD:Common File Directory ----D- C:\Program Files\Outsim
O43 - CFD:Common File Directory ----D- C:\Program Files\Pcsx2
O43 - CFD:Common File Directory ----D- C:\Program Files\PhotoFiltre
O43 - CFD:Common File Directory ----D- C:\Program Files\PhotoFiltre Studio
O43 - CFD:Common File Directory ----D- C:\Program Files\Playlogic
O43 - CFD:Common File Directory ----D- C:\Program Files\ProxyFirewall
O43 - CFD:Common File Directory ----D- C:\Program Files\PSP Video Converter
O43 - CFD:Common File Directory ----D- C:\Program Files\PSPaudioware
O43 - CFD:Common File Directory ----D- C:\Program Files\Realtek
O43 - CFD:Common File Directory ----D- C:\Program Files\Reference Assemblies
O43 - CFD:Common File Directory ----D- C:\Program Filesgcaudio software
O43 - CFD:Common File Directory ----D- C:\Program Files\RocketDock
O43 - CFD:Common File Directory ----D- C:\Program Files\Rockstar Games
O43 - CFD:Common File Directory ----D- C:\Program Files\SAGEM
O43 - CFD:Common File Directory ----D- C:\Program Files\SAGEM WiFi manager
O43 - CFD:Common File Directory ----D- C:\Program Files\Security Task Manager
O43 - CFD:Common File Directory ----D- C:\Program Files\Services en ligne
O43 - CFD:Common File Directory ----D- C:\Program Files\SiS VGA Utilities V3.78
O43 - CFD:Common File Directory ----D- C:\Program Files\SiS7012
O43 - CFD:Common File Directory ----D- C:\Program Files\sisagp
O43 - CFD:Common File Directory R---D- C:\Program Files\Skype
O43 - CFD:Common File Directory ----D- C:\Program Files\SocksCapV2
O43 - CFD:Common File Directory ----D- C:\Program Files\Sony
O43 - CFD:Common File Directory ----D- C:\Program Files\Sony Setup
O43 - CFD:Common File Directory ----D- C:\Program Files\Spyware Doctor
O43 - CFD:Common File Directory ----D- C:\Program Files\Stardock
O43 - CFD:Common File Directory ----D- C:\Program Files\Steinberg
O43 - CFD:Common File Directory ----D- C:\Program Files\Supbn
O43 - CFD:Common File Directory ----D- C:\Program Files\Syncrosoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Teamspeak2_RC2
O43 - CFD:Common File Directory ----D- C:\Program Files\Trust
O43 - CFD:Common File Directory ----D- C:\Program Files\TuneUp Utilities 2009
O43 - CFD:Common File Directory ----D- C:\Program Files\u-he
O43 - CFD:Common File Directory ----D- C:\Program Files\Ufasoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Uniblue
O43 - CFD:Common File Directory --H-D- C:\Program Files\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files\UtopiaBOX 2.02
O43 - CFD:Common File Directory ----D- C:\Program Files\VideoLAN
O43 - CFD:Common File Directory ----D- C:\Program Files\VID_0E8F&PID_0012
O43 - CFD:Common File Directory ----D- C:\Program Files\VOCALOID2
O43 - CFD:Common File Directory ----D- C:\Program Files\VstPlugins
O43 - CFD:Common File Directory ----D- C:\Program Files\VVSN
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Installer Clean Up
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Live
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Live SkyDrive
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Connect 2
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows NT
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Sidebar
O43 - CFD:Common File Directory ----D- C:\Program Files\WindowsSecurity
O43 - CFD:Common File Directory --H-D- C:\Program Files\WindowsUpdate
O43 - CFD:Common File Directory ----D- C:\Program Files\WinRAR
O43 - CFD:Common File Directory ----D- C:\Program Files\Wolfenstein - Enemy Territory
O43 - CFD:Common File Directory ----D- C:\Program Files\World of Warcraft
O43 - CFD:Common File Directory ----D- C:\Program Files\WowCartographe
O43 - CFD:Common File Directory ----D- C:\Program Files\Xfire
O43 - CFD:Common File Directory ----D- C:\Program Files\Yodm
O43 - CFD:Common File Directory ----D- C:\Program Files\Zero-X
O43 - CFD:Common File Directory ----D- C:\Program Files\ZHPDiag
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe AIR
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe Systems Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Ahead
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Blizzard Entertainment
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\DESIGNER
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Digidesign
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\InstallShield
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\iZotope
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\MSSoap
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\ODBC
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Services
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\snpstd3
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Stardock
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\System
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Windows Live
O43 - CFD:Common File Directory -SH-D- C:\Program Files\Fichiers Communs\WindowsLiveInstaller
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Wise Installation Wizard
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Digidesign

---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:Last File Created 01/08/2009 - 07:40:54 ---A- C:\WINDOWS\System32\drivers\adidsl.cfg
O44 - LFC:Last File Created 01/08/2009 - 07:40:54 ---A- C:\WINDOWS\adidsl.ini
O44 - LFC:Last File Created 03/08/2009 - 12:36:06 ---A- C:\WINDOWS\System32\drivers\mbam.sys
O44 - LFC:Last File Created 03/08/2009 - 12:36:28 ---A- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
O44 - LFC:Last File Created 05/08/2009 - 09:06:31 ---A- C:\WINDOWS\System32\mswebdvd.dll
O44 - LFC:Last File Created 06/08/2009 - 02:29:42 ---A- C:\WINDOWS\setuplog.txt
O44 - LFC:Last File Created 07/08/2009 - 13:37:45 ---A- C:\WINDOWS\System32\PnkBstrB.exe
O44 - LFC:Last File Created 07/08/2009 - 13:37:53 ---A- C:\WINDOWS\System32\drivers\PnkBstrK.sys
O44 - LFC:Last File Created 13/08/2009 - 10:50:22 ---A- C:\WINDOWS\KB971032.log
O44 - LFC:Last File Created 13/08/2009 - 10:50:29 ---A- C:\WINDOWS\KB973815.log
O44 - LFC:Last File Created 13/08/2009 - 10:50:38 ---A- C:\WINDOWS\KB958470.log
O44 - LFC:Last File Created 13/08/2009 - 10:51:59 ---A- C:\WINDOWS\KB973354.log
O44 - LFC:Last File Created 13/08/2009 - 10:52:05 ---A- C:\WINDOWS\KB973507.log
O44 - LFC:Last File Created 13/08/2009 - 10:52:12 ---A- C:\WINDOWS\KB973540.log
O44 - LFC:Last File Created 13/08/2009 - 10:52:18 ---A- C:\WINDOWS\KB973869.log
O44 - LFC:Last File Created 13/08/2009 - 10:52:23 ---A- C:\WINDOWS\KB971557.log
O44 - LFC:Last File Created 13/08/2009 - 10:52:29 ---A- C:\WINDOWS\KB971657.log
O44 - LFC:Last File Created 13/08/2009 - 10:52:35 ---A- C:\WINDOWS\KB960859.log
O44 - LFC:Last File Created 13/08/2009 - 19:53:54 ---A- C:\WINDOWS\System32\xfcodec.dll
O44 - LFC:Last File Created 14/08/2009 - 19:17:59 ---A- C:\WINDOWS\SIERRA.INI
O44 - LFC:Last File Created 14/08/2009 - 19:58:09 ---A- C:\WINDOWS\NeroDigital.ini
O44 - LFC:Last File Created 15/08/2009 - 21:21:04 ---A- C:\WINDOWS\updspapi.log
O44 - LFC:Last File Created 15/08/2009 - 21:48:25 ---A- C:\WINDOWS\spupdsvc.log
O44 - LFC:Last File Created 17/08/2009 - 06:25:49 ---A- C:\WINDOWS\System32\command.PIF
O44 - LFC:Last File Created 17/08/2009 - 06:25:49 ---A- C:\WINDOWS\System32\command.com
O44 - LFC:Last File Created 17/08/2009 - 06:51:02 ---A- C:\WINDOWS\system.ini
O44 - LFC:Last File Created 17/08/2009 - 15:10:54 ---A- C:\WINDOWS\System32\PerfStringBackup.INI
O44 - LFC:Last File Created 17/08/2009 - 15:10:54 ---A- C:\WINDOWS\System32\perfc009.dat
O44 - LFC:Last File Created 17/08/2009 - 15:10:54 ---A- C:\WINDOWS\System32\perfc00C.dat
O44 - LFC:Last File Created 17/08/2009 - 15:10:54 ---A- C:\WINDOWS\System32\perfh009.dat
O44 - LFC:Last File Created 17/08/2009 - 15:10:54 ---A- C:\WINDOWS\System32\perfh00C.dat
O44 - LFC:Last File Created 17/08/2009 - 22:50:14 ---A- C:\WINDOWS\KB961118.log
O44 - LFC:Last File Created 17/08/2009 - 22:50:14 ---A- C:\WINDOWS\imsins.BAK
O44 - LFC:Last File Created 22/08/2009 - 16:29:48 ---A- C:\WINDOWS\wmsetup.log
O44 - LFC:Last File Created 23/08/2009 - 00:13:35 ---A- C:\WINDOWS\wiadebug.log
O44 - LFC:Last File Created 23/08/2009 - 00:13:39 ---A- C:\WINDOWS\wiaservc.log
O44 - LFC:Last File Created 24/08/2009 - 12:52:51 ---A- C:\WINDOWS\setupapi.log.0.old
O44 - LFC:Last File Created 24/08/2009 - 13:11:50 ---A- C:\WINDOWS\w.ini
O44 - LFC:Last File Created 24/08/2009 - 17:26:39 ---A- C:\WINDOWS\KB893803v2.log
O44 - LFC:Last File Created 25/08/2009 - 01:43:27 ---A- C:\WINDOWS\setupact.log
O44 - LFC:Last File Created 25/08/2009 - 01:43:32 ---A- C:\WINDOWS\setupapi.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:39 ---A- C:\WINDOWS\FaxSetup.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:39 ---A- C:\WINDOWS\System32\TZLog.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:39 ---A- C:\WINDOWS\msgsocm.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:39 ---A- C:\WINDOWS\msmqinst.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:39 ---A- C:\WINDOWS\ocgen.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:40 ---A- C:\WINDOWS\KB970653-v3.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:40 ---A- C:\WINDOWS\comsetup.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:40 ---A- C:\WINDOWS\iis6.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:40 ---A- C:\WINDOWS\imsins.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:40 ---A- C:\WINDOWS
tdtcsetup.log
O44 - LFC:Last File Created 26/08/2009 - 00:39:40 ---A- C:\WINDOWS	soc.log
O44 - LFC:Last File Created 30/08/2009 - 07:06:33 ---A- C:\WINDOWS\win.ini
O44 - LFC:Last File Created 30/08/2009 - 07:37:25 ---A- C:\WINDOWS\System32\FNTCACHE.DAT
O44 - LFC:Last File Created 30/08/2009 - 16:35:21 ---A- C:\WINDOWS
tbtlog.txt
O44 - LFC:Last File Created 30/08/2009 - 21:13:53 ---A- C:\WINDOWS\SchedLgU.Txt
O44 - LFC:Last File Created 30/08/2009 - 21:15:19 -S-A- C:\WINDOWS\bootstat.dat
O44 - LFC:Last File Created 30/08/2009 - 21:15:27 ---A- C:\WINDOWS\0.log
O44 - LFC:Last File Created 30/08/2009 - 21:15:29 ---A- C:\WINDOWS\System32\wpa.dbl
O44 - LFC:Last File Created 30/08/2009 - 21:15:33 ---A- C:\WINDOWS\System32
vapps.xml
O44 - LFC:Last File Created 30/08/2009 - 21:16:39 ---A- C:\WINDOWS\WindowsUpdate.log

---\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:14:44 ---A- C:\WINDOWS\Prefetch\SPOOLSV.EXE-282F76A7.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:16:23 ---A- C:\WINDOWS\Prefetch\SETUP.EXE-393E66AE.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:16:33 ---A- C:\WINDOWS\Prefetch\SWAY.EXE-0476AEC3.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:17:45 ---A- C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:30:43 ---A- C:\WINDOWS\Prefetch\30RPWIN.EXE-23DBBF88.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 16:11:37 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-2631756A.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 16:29:30 ---A- C:\WINDOWS\Prefetch\SETUP_WM.EXE-3135CBD6.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 19:36:36 ---A- C:\WINDOWS\Prefetch\CALC.EXE-02CD573A.pf
O45 - LFCP:Last File Created Prefetch 23/08/2009 - 17:00:24 ---A- C:\WINDOWS\Prefetch\TEAMSPEAK.EXE-3A2528B1.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 00:56:14 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-19654D12.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 02:59:03 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-4CD9F1D0.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 12:47:32 ---A- C:\WINDOWS\Prefetch\SPTDINST-X86.EXE-13A13998.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 12:50:30 ---A- C:\WINDOWS\Prefetch\DAEMON-TOOLS_DAEMON_TOOLS_4.3-32D0A9FC.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 12:50:33 ---A- C:\WINDOWS\Prefetch\DAEMON TOOLS SMART INSTALLER.-25C6C0B7.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 12:51:02 ---A- C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 12:52:48 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-3C38E586.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 12:54:28 ---A- C:\WINDOWS\Prefetch\EBU7.EXE-084C25D8.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:01:10 ---A- C:\WINDOWS\Prefetch\EBU9.EXE-2FB02CA1.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:05:17 ---A- C:\WINDOWS\Prefetch\MGSI.EXE-007212B8.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:05:39 ---A- C:\WINDOWS\Prefetch\MGSVR.EXE-3490B8E7.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:07:16 ---A- C:\WINDOWS\Prefetch\EBUC.EXE-014A696E.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:11:50 ---A- C:\WINDOWS\Prefetch\PCCAM.EXE-070B9C5A.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:14:25 ---A- C:\WINDOWS\Prefetch\INSTALL.EXE-17C222D4.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 13:14:35 ---A- C:\WINDOWS\Prefetch\EBUF.EXE-25E2A83C.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:30:30 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-384E8910.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:31:40 ---A- C:\WINDOWS\Prefetch\NWIZ.EXE-2D0F9FBC.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:31:40 ---A- C:\WINDOWS\Prefetch\WGATRAY.EXE-0ED38BED.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:31:43 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-415F88EC.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:31:46 ---A- C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:31:50 ---A- C:\WINDOWS\Prefetch\DSLMON.EXE-1AE46AAB.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:31:50 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-1340EF7F.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 14:40:21 ---A- C:\WINDOWS\Prefetch\M625.EXE-3B8150FC.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:26:15 ---A- C:\WINDOWS\Prefetch\UPDATE.EXE-0D228B64.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:26:19 ---A- C:\WINDOWS\Prefetch\WINDOWSINSTALLER-KB893803-V2--0C91D487.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:26:45 ---A- C:\WINDOWS\Prefetch\MICROSOFT-NET-FRAMEWORK_MICRO-15DB0094.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:26:56 ---A- C:\WINDOWS\Prefetch\INSTALL.EXE-2D12BF5A.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:27:02 ---A- C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:27:30 ---A- C:\WINDOWS\Prefetch\DW20.EXE-0F7C73AD.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:27:45 ---A- C:\WINDOWS\Prefetch\IS-1HQ20.TMP-3010997A.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:27:45 ---A- C:\WINDOWS\Prefetch\UBOX 2.02 SETUP.EXE-001C171B.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:27:53 ---A- C:\WINDOWS\Prefetch\UTOPIABOX 2.EXE-0238535C.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:31:32 ---A- C:\WINDOWS\Prefetch\EBU15.EXE-35B567DD.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:35:58 ---A- C:\WINDOWS\Prefetch\DOSBOX.EXE-00538381.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 17:53:41 ---A- C:\WINDOWS\Prefetch\EBU1C.EXE-35E36C05.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 00:25:16 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-23093C86.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 01:38:21 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-147710F4.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 01:38:37 ---A- C:\WINDOWS\Prefetch\MMC.EXE-39071BCC.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 01:43:42 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-1DFA2DFC.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 01:43:42 ---A- C:\WINDOWS\Prefetch\RUNONCE.EXE-2803F297.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 01:53:11 ---A- C:\WINDOWS\Prefetch\SP37294.EXE-00FA3703.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 01:53:41 ---A- C:\WINDOWS\Prefetch\INSTALL.EXE-0E55319F.pf
O45 - LFCP:Last File Created Prefetch 25/08/2009 - 17:51:27 ---A- C:\WINDOWS\Prefetch\EBU1.EXE-044D0189.pf
O45 - LFCP:Last File Created Prefetch 26/08/2009 - 00:39:39 ---A- C:\WINDOWS\Prefetch\UPDATE.EXE-14DCE17C.pf
O45 - LFCP:Last File Created Prefetch 26/08/2009 - 09:55:01 ---A- C:\WINDOWS\Prefetch\EBU18.EXE-2A7DA0F8.pf
O45 - LFCP:Last File Created Prefetch 26/08/2009 - 13:50:33 ---A- C:\WINDOWS\Prefetch\EBU1E.EXE-20B01C93.pf
O45 - LFCP:Last File Created Prefetch 26/08/2009 - 18:03:38 ---A- C:\WINDOWS\Prefetch\INSTALL.EXE-3AEF1D3F.pf
O45 - LFCP:Last File Created Prefetch 26/08/2009 - 18:03:48 ---A- C:\WINDOWS\Prefetch\EBU24.EXE-2532538B.pf
O45 - LFCP:Last File Created Prefetch 26/08/2009 - 19:29:14 ---A- C:\WINDOWS\Prefetch\MGSI.EXE-0C4469D0.pf
O45 - LFCP:Last File Created Prefetch 27/08/2009 - 19:12:34 ---A- C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf
O45 - LFCP:Last File Created Prefetch 27/08/2009 - 19:25:21 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-12E27DD0.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 05:45:35 ---A- C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 05:45:35 ---A- C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 12:55:20 ---A- C:\WINDOWS\Prefetch\ALH.EXE-387438C4.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 12:55:23 ---A- C:\WINDOWS\Prefetch\PRISM3D.EXE-0E72F5B1.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 16:15:29 ---A- C:\WINDOWS\Prefetch\ONECLICK.EXE-02BCF6B7.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 16:16:03 ---A- C:\WINDOWS\Prefetch\REGISTRYCLEANER.EXE-07EF48DE.pf
O45 - LFCP:Last File Created Prefetch 28/08/2009 - 16:19:21 ---A- C:\WINDOWS\Prefetch\TUNEUPDEFRAGSERVICE.EXE-24FF2B48.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 00:28:12 ---A- C:\WINDOWS\Prefetch\UNINSTAL.EXE-00C2A99D.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 00:28:47 ---A- C:\WINDOWS\Prefetch\UNINSTAL.EXE-099B8553.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 00:31:02 ---A- C:\WINDOWS\Prefetch\ARES.EXE-2E644AE0.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 00:32:52 ---A- C:\WINDOWS\Prefetch\VLC.EXE-22DF01AA.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 02:57:57 ---A- C:\WINDOWS\Prefetch\WOWEMUHACKER3.0.9.EXE-068F20E3.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 04:39:55 ---A- C:\WINDOWS\Prefetch\SHUTDOWN-IT.EXE-1E7F12FC.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 05:39:01 ---A- C:\WINDOWS\Prefetch\SHUTDOWN.EXE-12DAD820.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 14:58:00 ---A- C:\WINDOWS\Prefetch\NEROSTARTSMART.EXE-34F7076D.pf
O45 - LFCP:Last File Created Prefetch 29/08/2009 - 14:58:18 ---A- C:\WINDOWS\Prefetch\NERO.EXE-11EFF40F.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 00:30:16 ---A- C:\WINDOWS\Prefetch\VCS6CORE.EXE-162D0671.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 00:31:05 ---A- C:\WINDOWS\Prefetch\XFIRE_EXCEPTION.EXE-1A65DB0D.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 00:32:42 ---A- C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 03:57:06 ---A- C:\WINDOWS\Prefetch\GHOST GOLD WOW V1.2 ++.EXE-0C07B489.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 03:57:22 ---A- C:\WINDOWS\Prefetch\PHOTOSNAPVIEWER.EXE-2371ED62.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 04:50:45 ---A- C:\WINDOWS\Prefetch\WOWHACK - 8.9.2.EXE-1EB8BF33.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 04:51:18 ---A- C:\WINDOWS\Prefetch\WOWHACK - 8.9.2.EXE-38CE08D2.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 04:53:40 ---A- C:\WINDOWS\Prefetch\SEND.EXE-2A1DD5AC.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 06:20:45 ---A- C:\WINDOWS\Prefetch\ALCMTR.EXE-235F9538.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 06:20:46 ---A- C:\WINDOWS\Prefetch\DAEMON.EXE-208767E0.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 06:20:46 ---A- C:\WINDOWS\Prefetch\MSNMSGR.EXE-366A1A81.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 06:20:46 ---A- C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 06:20:46 ---A- C:\WINDOWS\Prefetch\RTHDCPL.EXE-06918CFA.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 06:25:44 ---A- C:\WINDOWS\Prefetch\ASHQUICK.EXE-13F2975D.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 13:44:55 ---A- C:\WINDOWS\Prefetch\SYSTEMX32.EXE-33117410.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:05:40 ---A- C:\WINDOWS\Prefetch\BITTORRENT.EXE-15EBE065.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:10:42 ---A- C:\WINDOWS\Prefetch\WINRAR.EXE-39C6DAD9.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:11:16 ---A- C:\WINDOWS\Prefetch\DRWTSN32.EXE-2B4B52AC.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:14:40 ---A- C:\WINDOWS\Prefetch\ASHMAISV.EXE-12E27032.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:23:27 ---A- C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEF9C.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:36:24 ---A- C:\WINDOWS\Prefetch\LAUNCHER.EXE-32675156.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:36:32 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-2A94BB85.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 14:36:38 ---A- C:\WINDOWS\Prefetch\WOW.EXE-02137854.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 16:02:21 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-268BFF96.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 16:04:30 ---A- C:\WINDOWS\Prefetch\NOTEPAD.EXE-189578DA.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 16:20:17 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 16:42:22 ---A- C:\WINDOWS\Prefetch\ASHWEBSV.EXE-0548EF0A.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 16:52:58 ---A- C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 16:56:04 ---A- C:\WINDOWS\Prefetch\Layout.ini
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 17:41:58 ---A- C:\WINDOWS\Prefetch\SUPBN32.EXE-021E2AF0.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 17:53:43 ---A- C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:00:07 ---A- C:\WINDOWS\Prefetch\ONECLICKSTARTER.EXE-31B195B2.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:11:04 ---A- C:\WINDOWS\Prefetch\SYSTEMR1.EXE-21AEA2DB.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:11:05 ---A- C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:21 ---A- C:\WINDOWS\Prefetch\FILE.EXE-2FA0538B.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:21 ---A- C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:21 ---A- C:\WINDOWS\Prefetch\SYSTEMR2.EXE-2D503AD7.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:22 ---A- C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:22 ---A- C:\WINDOWS\Prefetch\AVAST.SETUP-032170A8.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:22 ---A- C:\WINDOWS\Prefetch\IEMONITOR.EXE-2D8B91C4.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:22 ---A- C:\WINDOWS\Prefetch\WMIAPSRV.EXE-1E2270A5.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:22 ---A- C:\WINDOWS\Prefetch\XFIRE.EXE-10307267.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:24 ---A- C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:16:31 ---A- C:\WINDOWS\Prefetch\USNSVC.EXE-373E4DBC.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:23:55 ---A- C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:25:38 ---A- C:\WINDOWS\Prefetch\SKYPE.EXE-30AE1A60.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:25:50 ---A- C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:26:40 ---A- C:\WINDOWS\Prefetch\WOW.EXE-06DC34A8.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:26:57 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-2E5AF1D7.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:27:47 ---A- C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:28:09 ---A- C:\WINDOWS\Prefetch\JQSNOTIFY.EXE-24AE4A36.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:40:03 ---A- C:\WINDOWS\Prefetch\MSFEEDSSYNC.EXE-25E13438.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:40:06 ---A- C:\WINDOWS\Prefetch\SEND.EXE-2C925C62.pf
O45 - LFCP:Last File Created Prefetch 30/08/2009 - 21:40:15 ---A- C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf

---\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
O46 - SEH:ShellExecuteHooks - (no name) - {8DCB0AE8-533C-A1D2-29E1-3A811135D25A} - C:\WINDOWS\system32\lpad32.dll

Nowax · Answer

---\ Export de clé d'application autorisée (ECAA)(O47)
O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
O47 - AAKE:Key Export SP - "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
O47 - AAKE:Key Export SP - "C:\Documents and Settings\Administrateur.WINDOWS_XP\Bureau\Noureddine dossier\WOW\WoW-3.0.8.9506-to-3.0.9.9551-frFR-downloader.exe"="C:\Documents and Settings\Administrateur.WINDOWS_XP\Bureau\Noureddine dossier\WOW\WoW-3.0.8.9506-to-3.0.9.9551-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
O47 - AAKE:Key Export SP - "C:\Program Files\Xfire\xfire.exe"="C:\Program Files\Xfire\xfire.exe:*:Enabled:Xfire"
O47 - AAKE:Key Export SP - "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
O47 - AAKE:Key Export SP - "C:\Program Files\Counter-Strike 1.6\hl.exe"="C:\Program Files\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32undll32.exe"="C:\WINDOWS\system32undll32.exe:*:Enabled:Exécuter une DLL en tant qu'application"
O47 - AAKE:Key Export SP - "C:\Program Files\Ufasoft\SocksChain\SocksChain.exe"="C:\Program Files\Ufasoft\SocksChain\SocksChain.exe:*:Enabled:SocksChain GUI"
O47 - AAKE:Key Export SP - "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
O47 - AAKE:Key Export SP - "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
O47 - AAKE:Key Export SP - "C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
O47 - AAKE:Key Export SP - "C:\Program Files\Ares\Ares.exe"="C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows"
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
O47 - AAKE:Key Export SP - "C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqw.exe"="C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM)"
O47 - AAKE:Key Export SP - "C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe"="C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe:*:Enabled:etqwded.exe"
O47 - AAKE:Key Export SP - "C:\Program Files\Wolfenstein - Enemy Territory\ET.exe"="C:\Program Files\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET"
O47 - AAKE:Key Export SP - "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
O47 - AAKE:Key Export DP - "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
O47 - AAKE:Key Export DP - "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

---\ Déni du service (Local Security Authority) (LSA) (O48)
O48 - LSA:Local Security Authority Authentication Packages - C:\WINDOWS\System32\msv1_0.dll
O48 - LSA:Local Security Authority Notification Packages - C:\WINDOWS\System32\scecli.dll

---\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Networkdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Networkdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Networkdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network	dpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network	dtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Networkdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Networkdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Networkdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network	dpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network	dtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Networkdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Networkdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Networkdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network	dpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network	dtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\vgasave.sys

---\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d

---\ MountPoints2 Shell Key (MPSK) (O51)
O51 - MPSK:{2d33e302-0335-11de-970e-4d6564696130}\Shell\explore\command - 
O51 - MPSK:{2d33e302-0335-11de-970e-4d6564696130}\Shell\open\command - 
O51 - MPSK:{5d1d01a8-1569-11de-972b-4d6564696130}\Shell\explore\command - 
O51 - MPSK:{5d1d01a8-1569-11de-972b-4d6564696130}\Shell\open\command - 
O51 - MPSK:{752476d5-0bf8-11de-971c-4d6564696130}\Shell\explore\command - 
O51 - MPSK:{752476d5-0bf8-11de-971c-4d6564696130}\Shell\open\command -

Nowax · Answer

---\ Trojan Driver Search Data (TDSD) (O52)
O52 - TDSD:HKLM\...\Drivers\"timer"="timer.drv"
O52 - TDSD:HKLM\...\Drivers32\"midimapper"="midimap.dll"
O52 - TDSD:HKLM\...\Drivers32\"msacm.imaadpcm"="imaadp32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msadpcm"="msadp32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msg711"="msg711.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msgsm610"="msgsm32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.trspch"="tssoft32.acm"
O52 - TDSD:HKLM\...\Drivers32\"vidc.cvid"="iccvid.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.I420"="msh263.drv"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv31"="ir32_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv32"="ir32_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv41"="ir41_32.ax"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iyuv"="iyuv_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.mrle"="msrle32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.msvc"="msvidc32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.uyvy"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.yuy2"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.yvu9"="tsbyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.yvyu"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"wavemapper"="msacm32.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msg723"="msg723.acm"
O52 - TDSD:HKLM\...\Drivers32\"vidc.M263"="msh263.drv"
O52 - TDSD:HKLM\...\Drivers32\"vidc.M261"="msh261.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv50"="ir50_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm"
O52 - TDSD:HKLM\...\Drivers32\"wave"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"midi"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"mixer"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"aux"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.vorbis"="vorbis.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.lhacm"="lhacm.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.siren"="sirenacm.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.XFR1"="xfcodec.dll"
O52 - TDSD:HKLM\...\drivers.desc\"C:\WINDOWS\system32\iac25_32.ax"="Indeo® audio software"
O52 - TDSD:HKLM\...\drivers.desc\"ir50_32.dll"="Indeo® video 5.10"
O52 - TDSD:HKLM\...\drivers.desc\"C:\WINDOWS\system32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec"
O52 - TDSD:HKLM\...\drivers.desc\"wdmaud.drv"="Realtek High Definition Audio"
O52 - TDSD:HKLM\...\drivers.desc\"vorbis.acm"="Ogg Vorbis Audio CODEC"
O52 - TDSD:HKLM\...\drivers.desc\"lhacm.acm"="lhacm.acm"
O52 - TDSD:HKLM\...\drivers.desc\"sirenacm.dll"="Messenger Audio Codec"
O52 - TDSD:HKLM\...\drivers.desc\"xfcodec.dll"="Xfire video codec [XFR1]"

---\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

---\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

---\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\Policies\Explorer] - "HonorAutoRunSetting"=1

---\ Liste des Drivers Système (SDL) (O58)
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\1394bus.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aavmker4.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acpi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acpiec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\adildr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\adiusbaw.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\afd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amdk6.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amdk7.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\arp1394.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aswFsBlk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aswmon.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aswmon2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aswRdr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aswSP.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aswTdi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\asyncmac.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmarpc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmepvc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmlane.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmuni.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\audstub.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\beep.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\BRGSp50.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\BRGSp50a64.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\bridge.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\Camd905c.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\Capt905c.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cbidf2k.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdaudio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdrom.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cinemst2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\classpnp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cledx.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cmusbser.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cpqdap01.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\crusoe.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\disk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\diskdump.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmboot.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmload.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\DMusic.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\drmk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\drmkaud.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxg.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxgthk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\e100b325.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\enum1394.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fastfat.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fdc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fips.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\flpydisk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fltmgr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fsvga.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fs_rec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ftdisk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\GMFilter.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hamachi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidclass.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidparse.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidusb.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\http.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\i8042prt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ianswxp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\imagedrv.sys

Nowax · Answer

JE peux plus en coller la suite,quand je la colle,je vois rien qui se met sur le forum : \

jfkpresident · Answer

Pour me poster un rapport complet ,utilise ce site d'hébergement : https://www.cjoint.com/

*Clique sur parcourir puis sélectionne le rapport .
*Un lien va etre créer ,copie/colle ce lien dans ta prochaine réponse .

Nowax · Answer

Ahhh c'est beaucoup plus facile a mettre un lien,le voiçi.^^
https://www.cjoint.com/?iFqUHh8l6G

jfkpresident · Answer

Déconnecte toi d'Internet et ferme toutes les applications ouvertes.
Copie dans le Presse-papier les lignes ci-dessous (sélectionne les avec la souris et fais simultanément Ctrl et C)

C:\Program Files\WindowsSecurity\SystemR1.exe       
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll       
O3 - Toolbar: C:\Program Files\AskBarDis\bar\bin\askBar.dll - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net	bfree.dll       
O3 - Toolbar: C:\Program Files\free-downloads.net	bfree.dll - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll       
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe       
O42 - Logiciel: Ask Toolbar       
O42 - Logiciel: DAEMON Tools Toolbar       
O43 - CFD:Common File Directory ----D- C:\Program Files\AskBarDis       
O43 - CFD:Common File Directory ----D- C:\Program Files\DAEMON Tools Toolbar       
O43 - CFD:Common File Directory ----D- C:\Program Files\VVSN       

Relance ZHPDiag sur ton Bureau.

Clique sur la loupe.

Clique sur l'icône Bouclier qui est apparue à coté de la clé à molette.

Clique successivement sur l'icône H puis sur l'icône du moniteur.

Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

Clique sur OK, ce qui fait apparaaître un carré à gauche de chaque ligne.

Clique sur "Tous" puis sur "Nettoyer".

Laisse l'outil travailler.

Si il te demande de redémarrer l'ordi pour achever le nettoyage, fais le immmédiatement.

Le rapport d'exécution va apparaître dans la fenêtre.

Copie le dans ta réponse.

Nowax · Answer

J'obiten d'abord une erreur avant que je puisse copier le rapport qu'il faut que je te mette içi,l'erreur est:

*Zhpfix*
Erreur système. Code : 2.
le fichier spécifié est introuvable.



*Et voila le rapport:

ZHPFix v1.12.10  by Nicolas Coolman - Rapport de suppression du 31/08/2009 22:41:03
Fichier Registre : 
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
C:\Program Files\WindowsSecurity\SystemR1.exe  => File not found

Module mémoire :
(Néant)

Clé du Registre :
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll  => Registry key not found

Valeur du Registre :
O4 - HKLM\..\Run: [Systemx32] C:\Program Files\WindowsSecurity\SystemR1.exe  => Registry key value not found

Elément de données du Registre :
(Néant)

Dossier :
C:\Program Files\AskBarDis  => Folder not found
C:\Program Files\DAEMON Tools Toolbar  => Folder not found
C:\Program Files\VVSN  => Folder not found

Fichier :
C:\Program Files\AskBarDis\bar\bin\askBar.dll  => File not found
C:\Program Files\free-downloads.net	bfree.dll  => File not found
C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll  => File not found
C:\Program Files\WindowsSecurity\SystemR1.exe  => File not found

Logiciel :
O42 - Logiciel: Ask Toolbar  => Software not found
O42 - Logiciel: DAEMON Tools Toolbar  => Software not found

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 1
Module mémoire : 0
Clé du Registre : 1
Valeur du Registre : 1
Elément de données du Registre : 0
Dossier : 3
Fichier : 4
Logiciel : 2
Autre : 0



End of the scan

jfkpresident · Answer

ça va pas du tout .....

Télécharge OTM de OldTimer sur ton Bureau en cliquant sur ce lien :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Double-clique sur OTMoveIt3.exe pour le lancer.

Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".


:processes
explorer.exe


:Reg


:files
C:\Program Files\WindowsSecurity\SystemR1.exe       
C:\Program Files\WindowsSecurity\Send.exe       
C:\Program Files\WindowsSecurity\Systemx32.exe   
 C:\Program Files\WindowsSecurity\SystemR2.exe 
:services

:commands
[emptytemp]
[start explorer]




Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

Nowax · Answer

Le voiçi le raporrt :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\Program Files\WindowsSecurity\SystemR1.exe not found.
C:\Program Files\WindowsSecurity\Send.exe moved successfully.
C:\Program Files\WindowsSecurity\Systemx32.exe moved successfully.
C:\Program Files\WindowsSecurity\SystemR2.exe moved successfully.
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 431433904 bytes
->Temporary Internet Files folder emptied: 18909647 bytes
->FireFox cache emptied: 95020166 bytes
 
User: Administrateur.WINDOWS_XP
->Temp folder emptied: 344508579 bytes
->Temporary Internet Files folder emptied: 20497826 bytes
->Java cache emptied: 8533585 bytes
->FireFox cache emptied: 83842062 bytes
 
User: ADMINI~1~WIN
 
User: All Users
 
User: All Users.WINDOWS
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService.AUTORITE NT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
 
User: NetworkService.AUTORITE NT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114937 bytes
%systemroot%\System32 .tmp files removed: 4371456 bytes
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_448.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 1901107 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 964,45 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 09012009_165522

Files moved on Reboot...
File C:\WINDOWS	emp\_avast4_\Webshlock.txt not found!
C:\WINDOWS	emp\Perflib_Perfdata_448.dat moved successfully.

Registry entries deleted on Reboot...

jfkpresident · Answer

Tres bien ,maintenant recolle moi un nouveau log Hijackthis .

Nowax · Answer

Le voila . =)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:23, on 01/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\AEIWLSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS
otepad.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Menara\dslmon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\HiJackThis_2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Trust Gaming mouse] "C:\Program Files\Trust\GM-4200 Gamer Mouse Optical\Panel.exe"
O4 - HKLM\..\Run: [OlStatusMon] "C:\Program Files\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{0664814D-FC67-46EA-8C84-6F3B0A408565}: NameServer = 62.251.229.237 62.251.229.223
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Aeiwsvc - Unknown owner - C:\WINDOWS\system32\AEIWLSVC.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: olMntrService - Olivetti - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

jfkpresident · Answer

c'est beaucoup mieux ;)

Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. 

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\AEIWLSVC.EXE       

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

                                           ======================

Te sert tu de la barre d'outils : "BearShare MediaBar " ?

Ensuite peux tu lancer MBAM (examen complet) et me coller le rapport .

Nowax · Answer

Après avoir clické sur afficher le dernier rapport,non je n'utilise pas bearshare mediabar :

a-squared 	4.0.0.101 	2009.03.18 	-
AhnLab-V3 	5.0.0.2 	2009.03.18 	-
AntiVir 	7.9.0.120 	2009.03.18 	-
Authentium 	5.1.2.4 	2009.03.18 	-
Avast 	4.8.1335.0 	2009.03.18 	-
AVG 	8.0.0.237 	2009.03.18 	-
BitDefender 	7.2 	2009.03.18 	-
CAT-QuickHeal 	10.00 	2009.03.18 	-
ClamAV 	0.94.1 	2009.03.18 	-
Comodo 	1066 	2009.03.18 	-
DrWeb 	4.44.0.09170 	2009.03.18 	-
eSafe 	7.0.17.0 	2009.03.18 	-
eTrust-Vet 	31.6.6388 	2009.03.09 	-
F-Prot 	4.4.4.56 	2009.03.18 	-
F-Secure 	8.0.14470.0 	2009.03.18 	-
Fortinet 	3.117.0.0 	2009.03.18 	-
GData 	19 	2009.03.18 	-
Ikarus 	T3.1.1.48.0 	2009.03.18 	-
K7AntiVirus 	7.10.674 	2009.03.17 	-
Kaspersky 	7.0.0.125 	2009.03.18 	-
McAfee 	5557 	2009.03.18 	-
McAfee+Artemis 	5557 	2009.03.18 	-
Microsoft 	1.4502 	2009.03.18 	-
NOD32 	3946 	2009.03.18 	-
Norman 	6.00.06 	2009.03.18 	-
nProtect 	2009.1.8.0 	2009.03.18 	-
Panda 	10.0.0.10 	2009.03.18 	-
PCTools 	4.4.2.0 	2009.03.18 	-
Prevx1 	V2 	2009.03.18 	-
Rising 	21.21.22.00 	2009.03.18 	-
Sophos 	4.39.0 	2009.03.18 	-
Sunbelt 	3.2.1858.2 	2009.03.18 	-
Symantec 	1.4.4.12 	2009.03.18 	-
TheHacker 	6.3.3.0.283 	2009.03.16 	-
TrendMicro 	8.700.0.1004 	2009.03.18 	-
VBA32 	3.12.10.1 	2009.03.17 	-
ViRobot 	2009.3.18.1654 	2009.03.18 	-
VirusBuster 	4.6.5.0 	2009.03.18 	-
Information additionnelle
File size: 69632 bytes
MD5   : f71d3a1bcc1226bae1fbed3438f58034
SHA1  : 5a9d0015724212c834840fda82475017d4b0868e
SHA256: a73edadfee12170a3cd0b7b372092cd2cd2fc339f741d35bdae678971b548b68
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x5414
timedatestamp.....: 0x3BC53F78 (Thu Oct 11 08:43:04 2001)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9500 0xA000 6.30 048ab0f80f8ff9b4e0b649382a205ad8
.rdata 0xB000 0x183E 0x2000 4.41 a5baf12db8e5af5bb18acbcb37fd9616
.data 0xD000 0x2988 0x2000 1.80 d2814c7116658dc42b32092f145dfdc0
.rsrc 0x10000 0x1038 0x2000 2.65 598c58e93497211aded74194b02e3927

( 6 imports )

> advapi32.dll: OpenThreadToken, GetTokenInformation, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueA, RegQueryInfoKeyA, RegEnumKeyExA, RegCreateKeyExA, RegDeleteKeyA, RegOpenKeyExA, StartServiceCtrlDispatcherA, ControlService, DeleteService, CreateServiceA, RegDeleteValueA, RegSetValueExA, RegCloseKey, RegQueryValueExA, SetServiceStatus, RegisterServiceCtrlHandlerA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, OpenSCManagerA, OpenServiceA, CloseServiceHandle
> kernel32.dll: lstrcatA, CloseHandle, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, EnterCriticalSection, lstrcpyA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, LoadLibraryA, GetProcAddress, IsDBCSLeadByte, lstrcpynA, LoadLibraryExA, GetLastError, FindResourceA, LoadResource, SizeofResource, FreeLibrary, WideCharToMultiByte, GetShortPathNameA, MultiByteToWideChar, lstrlenW, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameA, lstrlenA, GetCommandLineA, lstrcmpiA, GetCurrentThreadId, InterlockedDecrement, SetStdHandle, FlushFileBuffers, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, SetFilePointer, WriteFile, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetVersion, ExitProcess, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA
> ole32.dll: CoUninitialize, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, CoTaskMemRealloc, CoRegisterClassObject, CoRevokeClassObject, CoCreateInstance, CoInitializeSecurity
> oleaut32.dll: -, -, -, -, -, -, -
> setupapi.dll: SetupDiCallClassInstaller, SetupDiSetClassInstallParamsA, SetupDiOpenDevRegKey, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, CM_Get_DevNode_Status, SetupDiDestroyDeviceInfoList
> user32.dll: PostThreadMessageA, MessageBoxA, LoadStringA, GetMessageA, DispatchMessageA, CharNextA

( 0 exports )
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:boO0y1uy5MhOAysYjTVapJrmcWI0pjyOKweKG:uyTsjTKdIkyOKweKG
PEiD  : Armadillo v1.71
RDS   : NSRL Reference Data Set
-

jfkpresident · Answer

Il me manque l'entete du rapport VT ,peux tu me le poster en entier ?

Nowax · Answer

VOila j'ai recopier tous le rapport VT :

 Fichier AEIWLSVC.EXE reçu le 2009.03.18 20:16:28 (UTC)
Situation actuelle: terminé
Résultat: 0/38 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.0.0.101 	2009.03.18 	-
AhnLab-V3 	5.0.0.2 	2009.03.18 	-
AntiVir 	7.9.0.120 	2009.03.18 	-
Authentium 	5.1.2.4 	2009.03.18 	-
Avast 	4.8.1335.0 	2009.03.18 	-
AVG 	8.0.0.237 	2009.03.18 	-
BitDefender 	7.2 	2009.03.18 	-
CAT-QuickHeal 	10.00 	2009.03.18 	-
ClamAV 	0.94.1 	2009.03.18 	-
Comodo 	1066 	2009.03.18 	-
DrWeb 	4.44.0.09170 	2009.03.18 	-
eSafe 	7.0.17.0 	2009.03.18 	-
eTrust-Vet 	31.6.6388 	2009.03.09 	-
F-Prot 	4.4.4.56 	2009.03.18 	-
F-Secure 	8.0.14470.0 	2009.03.18 	-
Fortinet 	3.117.0.0 	2009.03.18 	-
GData 	19 	2009.03.18 	-
Ikarus 	T3.1.1.48.0 	2009.03.18 	-
K7AntiVirus 	7.10.674 	2009.03.17 	-
Kaspersky 	7.0.0.125 	2009.03.18 	-
McAfee 	5557 	2009.03.18 	-
McAfee+Artemis 	5557 	2009.03.18 	-
Microsoft 	1.4502 	2009.03.18 	-
NOD32 	3946 	2009.03.18 	-
Norman 	6.00.06 	2009.03.18 	-
nProtect 	2009.1.8.0 	2009.03.18 	-
Panda 	10.0.0.10 	2009.03.18 	-
PCTools 	4.4.2.0 	2009.03.18 	-
Prevx1 	V2 	2009.03.18 	-
Rising 	21.21.22.00 	2009.03.18 	-
Sophos 	4.39.0 	2009.03.18 	-
Sunbelt 	3.2.1858.2 	2009.03.18 	-
Symantec 	1.4.4.12 	2009.03.18 	-
TheHacker 	6.3.3.0.283 	2009.03.16 	-
TrendMicro 	8.700.0.1004 	2009.03.18 	-
VBA32 	3.12.10.1 	2009.03.17 	-
ViRobot 	2009.3.18.1654 	2009.03.18 	-
VirusBuster 	4.6.5.0 	2009.03.18 	-
Information additionnelle
File size: 69632 bytes
MD5   : f71d3a1bcc1226bae1fbed3438f58034
SHA1  : 5a9d0015724212c834840fda82475017d4b0868e
SHA256: a73edadfee12170a3cd0b7b372092cd2cd2fc339f741d35bdae678971b548b68
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x5414
timedatestamp.....: 0x3BC53F78 (Thu Oct 11 08:43:04 2001)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9500 0xA000 6.30 048ab0f80f8ff9b4e0b649382a205ad8
.rdata 0xB000 0x183E 0x2000 4.41 a5baf12db8e5af5bb18acbcb37fd9616
.data 0xD000 0x2988 0x2000 1.80 d2814c7116658dc42b32092f145dfdc0
.rsrc 0x10000 0x1038 0x2000 2.65 598c58e93497211aded74194b02e3927

( 6 imports )

> advapi32.dll: OpenThreadToken, GetTokenInformation, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueA, RegQueryInfoKeyA, RegEnumKeyExA, RegCreateKeyExA, RegDeleteKeyA, RegOpenKeyExA, StartServiceCtrlDispatcherA, ControlService, DeleteService, CreateServiceA, RegDeleteValueA, RegSetValueExA, RegCloseKey, RegQueryValueExA, SetServiceStatus, RegisterServiceCtrlHandlerA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, OpenSCManagerA, OpenServiceA, CloseServiceHandle
> kernel32.dll: lstrcatA, CloseHandle, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, EnterCriticalSection, lstrcpyA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, LoadLibraryA, GetProcAddress, IsDBCSLeadByte, lstrcpynA, LoadLibraryExA, GetLastError, FindResourceA, LoadResource, SizeofResource, FreeLibrary, WideCharToMultiByte, GetShortPathNameA, MultiByteToWideChar, lstrlenW, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameA, lstrlenA, GetCommandLineA, lstrcmpiA, GetCurrentThreadId, InterlockedDecrement, SetStdHandle, FlushFileBuffers, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, SetFilePointer, WriteFile, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetVersion, ExitProcess, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA
> ole32.dll: CoUninitialize, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, CoTaskMemRealloc, CoRegisterClassObject, CoRevokeClassObject, CoCreateInstance, CoInitializeSecurity
> oleaut32.dll: -, -, -, -, -, -, -
> setupapi.dll: SetupDiCallClassInstaller, SetupDiSetClassInstallParamsA, SetupDiOpenDevRegKey, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, CM_Get_DevNode_Status, SetupDiDestroyDeviceInfoList
> user32.dll: PostThreadMessageA, MessageBoxA, LoadStringA, GetMessageA, DispatchMessageA, CharNextA

( 0 exports )
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:boO0y1uy5MhOAysYjTVapJrmcWI0pjyOKweKG:uyTsjTKdIkyOKweKG
PEiD  : Armadillo v1.71
RDS   : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

jfkpresident · Answer

-> Relance HijackThis cliques sur « scanner seulement » ou (« do a scan only »),
coche les cases devant ces lignes :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)  
O2 - BHO: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)  
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE   
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k  
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h     
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/fr/       
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb         

et ensuite ferme toutes les fenêtres actives autres que HijackThis!, navigateur inclus,
puis clique "Fix checked"( ou « fixer objet »). Ferme HijackThis! 

tutoriel en images:http://pageperso.aol.fr/balltrap34/Hijenr.gif

Ensuite dis moi si tu as encore des soucis ?

Nowax · Answer

Non sayer c'est beaucoup mieux maintenant,je te remercie de ton soutien et du temps précieux que tu a du sacrifier pour m'aider,grâce a toi mon pc me souri de nouveau. =)

jfkpresident · Answer

Je viens de m'apercevoir que j'ai oublié une chose :)

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

Nowax · Answer

Je peux pas l'exécuter il m'affiche le même problème qui est apparut sur l'autre programme, ça me dit Windows ne trouve pas '''C:\ToolBar SD\ToolBarSD.cmd'.verifiez que vous avez entré le nom correctement et essayez à nouveau. Pour rechercher un fichier , clique sur le bouton démarrer  , puis sur rechercher.

jfkpresident · Answer

Double-clique sur OTMoveIt3.exe pour le lancer.

Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".


:processes
explorer.exe


:Reg


:files
C:\Program Files\AskBarDis\bar\bin\askBar.dll       
C:\Program Files\free-downloads.net	bfree.dll       
:services

:commands
[start explorer]
[reboot]



Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

Ensuite regarde si ces logiciels sont toujours éxistants (si tel est le cas supprimes les ) :

 C:\Program Files\AskBarDis       
C:\Program Files\DAEMON Tools Toolbar       
C:\Program Files\VVSN

Nowax · Answer

Voiçi le rapport .log :

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\Program Files\AskBarDis\bar\bin\askBar.dll not found.
File/Folder C:\Program Files\free-downloads.net	bfree.dll not found.
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========
 
OTM by OldTimer - Version 3.0.0.6 log created on 09022009_191502

Files moved on Reboot...

Registry entries deleted on Reboot...

 Et à propos des logiciels,ils n'y sont pas dans.

Nowax · Answer

Et à propos des logiciels,ils n'y sont pas dans C:\program files.

jfkpresident · Answer

C'est tout bon ,on finalise :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques : 

· Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
http://pc-system.fr/
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
                                   ====================
Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la afin de créer un point de restauration sain. 

* Désactivation : 
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer patiente jusqu a que cela soit marqué "désactivée" puis Ok. 

* Activation : 
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarrer l'ordinateur.. 
                                 ====================
Tu utilise les logiciels de P2P ,alors je te conseille de lire ceci : danger du P2P et des cracks

également un exemple concret ici ou l'internaute ne pouvait plus rien faire de sa machine ...

VoiloO ,bon surf et @ jamais ;)

Nowax · Answer

Voila le rapport du TCleaner :

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\SDFIX: trouvé !
C:\_OTM: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\OTM.exe: trouvé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\SDFix\catchme.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\Administrateur.WINDOWS_XP\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\OTM.exe: supprimé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\ToolBarSD.exe: supprimé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\SDFix\catchme.exe: supprimé !
C:\Documents and Settings\Administrateur.WINDOWS_XP\Mes documents\Downloads\Programs\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\_OTM: supprimé !
C:\Toolbar SD: supprimé !
C:\Program Files\ZHPDiag: supprimé !

Send.exe (impossible de surpimer)

37 réponses

Newsletters