Virus

Bonjour ,

Commence par faire ceci :

~~~~~~~~~~~~~~~> Hijack This <~~~~~~~~~~~~~~~~~~~

• Telecharger Hijack
› http://www.infos-du-net.com/telecharger/HijackThis.html

Une fois Hijack installer, exécuter le :
• Cliquer sur "Do a system scan and save a logfile"

• Un fichier texte s'ouvre, si ce n'est pas le cas celui-ci se trouve dans le même dossier que hijackthis.exe .
• Faire édition / sélectionner tout
• Clic droit / copier

• Poste moi le rapport entier

Zeb Help Process v2.34.55 by Nicolas Coolman - Rapport Général du 06/09/2009 16:46:59

Rapport de ZHPDiag v1.24.08 par Nicolas Coolman
Run by seb at 24/08/2009 20:02:36
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Platform : Microsoft Windows XP (5.1.2600) Service Pack 3
MSIE: Internet Explorer v7.0.5730.13
MFIE: Mozilla Firefox (3.5.2)

Total RAM: 255,5 Mb (38 % free)
System drive C: 40 Go (26 Go free)

---\\ Processus lancés
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\Adobe\Updater6\Adobe_Updater.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe

---\\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/

---\\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html

---\\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL

---\\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe
O4 - HKCU\..\Run: [goako] c:\documents and settings\seb\local settings\application data\goako.exe" goako
O4 - HKCU\..\Run: [AdobeUpdater6] C:\Program Files\Fichiers communs\Adobe\Updater6\Adobe_Updater.exe
O4 - HKLM\..\policies\Explorer: [HonorAutoRunSetting] Data=1
O4 - HKLM\..\policies\Explorer: [NoCDBurning] Data=0
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe

---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8_2\hoticon.ico
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe,302

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: DirectAnimation Java Classes (DirectAnimation Java Classes) - file://C:\WINDOWS\Java\classes\dajava.cab
O16 - DPF: Microsoft XML Parser for Java (Microsoft XML Parser for Java) - file://C:\WINDOWS\Java\classes\xmldso.cab
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {C79F0120-EF94-4FAC-8248-6F30B92E9524} (AdValiderInterface Class) - http://www.journal-officiel.gouv.fr/verifier/AdValiderWeb_DJO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

---\\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll
O18 - Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\Windows\System32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\Windows\system32\SHELL32.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\System32\avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\System32\%SystemRoot%\System32\dimsntfy.dll

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\System32\stobject.dll

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\System32\browseui.dll

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: AVG Free8 WatchDog (avg8wd) - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
O23 - Service: MpService (MpService) - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: Spouleur d'impression (Spooler) - C:\WINDOWS\system32\spoolsv.exe

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GlaryInitialize.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{1FBAF2B2-5D40-41F5-83D3-00866A99BBB7}.job

---\\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: IE7 Uninstall Stub - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Lecteur Windows Media - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Personnalisation du navigateur - >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Microsoft VM - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Internet Explorer Classes for Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Lecteur Windows Media Microsoft 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - (not file)
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectShow - {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - (not file)
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: KB918899 - {4d64f3ba-f112-4efe-a02e-96680859937c} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.7 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: KB918439 - {5b7bf89d-d196-4c32-a303-a57b8ab7f18d} - (not file)
O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub
O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file)
O40 - ASIC: Web Folders - {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: .NET Framework - {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - (not file)
O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)
O40 - ASIC: Planificateur de tâches - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\System32\Macromed\Flash\Flash10a.ocx
O40 - ASIC: KB925486 - {dd772a76-bef3-44d7-8b39-502c8504c1f1} - (not file)
O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)
O40 - ASIC: KB911567 - {f15ee071-deb7-4cbb-951f-431c98338d8e} - (not file)

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: acedrv10 (acedrv10) - C:\WINDOWS\system32\drivers\acedrv10.sys
O41 - Driver: acehlp10 (acehlp10) - C:\WINDOWS\system32\drivers\acehlp10.sys
O41 - Driver: Suppresseur d'écho acoustique (Noyau Microsoft) (aec) - C:\WINDOWS\system32\drivers\aec.sys
O41 - Driver: Environnement de prise en charge de réseau AFD (AFD) - C:\WINDOWS\System32\drivers\afd.sys
O41 - Driver: Service for Realtek AC97 Audio (WDM) (ALCXWDM) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS
O41 - Driver: Pilote de média asynchrone RAS (AsyncMac) - C:\WINDOWS\System32\DRIVERS\asyncmac.sys
O41 - Driver: Protocole client ATM ARP (Atmarpc) - C:\WINDOWS\System32\DRIVERS\atmarpc.sys
O41 - Driver: Pilote audio Stub (audstub) - C:\WINDOWS\System32\DRIVERS\audstub.sys
O41 - Driver: AVG Free AVI Loader Driver x86 (AvgLdx86) - C:\WINDOWS\System32\Drivers\avgldx86.sys
O41 - Driver: AVG Free On-access Scanner Minifilter Driver x86 (AvgMfx86) - C:\WINDOWS\System32\Drivers\avgmfx86.sys
O41 - Driver: (no object) (basic2) - C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys
O41 - Driver: (no object) (dmboot) - C:\WINDOWS\System32\drivers\dmboot.sys
O41 - Driver: (no object) (dmio) - C:\WINDOWS\System32\drivers\dmio.sys
O41 - Driver: (no object) (dmload) - C:\WINDOWS\System32\drivers\dmload.sys
O41 - Driver: Synthétiseur DLS du noyau Microsoft (DMusic) - C:\WINDOWS\system32\drivers\DMusic.sys
O41 - Driver: Filtre de décodeur DRM (Noyau Microsoft) (drmkaud) - C:\WINDOWS\system32\drivers\drmkaud.sys
O41 - Driver: (no object) (Fallback) - C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys
O41 - Driver: (no object) (Fsks) - C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys
O41 - Driver: Énumérateur de port jeu (gameenum) - C:\WINDOWS\System32\DRIVERS\gameenum.sys
O41 - Driver: Classificateur de paquets générique (Gpc) - C:\WINDOWS\System32\DRIVERS\msgpc.sys
O41 - Driver: Pilote de classe HID Microsoft (HidUsb) - C:\WINDOWS\system32\DRIVERS\hidusb.sys
O41 - Driver: (no object) (HSFHWBS2) - C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys
O41 - Driver: (no object) (HSF_DP) - C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys
O41 - Driver: (no object) (hsf_msft) - C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys
O41 - Driver: Pilote pour clavier i8042 et souris sur port PS/2 (i8042prt) - C:\WINDOWS\System32\DRIVERS\i8042prt.sys
O41 - Driver: Pilote de processeur Intel (intelppm) - C:\WINDOWS\System32\DRIVERS\intelppm.sys
O41 - Driver: Pilote de filtre de trafic IP (IpFilterDriver) - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys
O41 - Driver: Pilote de tunnelage IP dans IP (IpInIp) - C:\WINDOWS\System32\DRIVERS\ipinip.sys
O41 - Driver: Traducteur d'adresses réseau IP (IpNat) - C:\WINDOWS\System32\DRIVERS\ipnat.sys
O41 - Driver: Pilote IPSEC (IPSec) - C:\WINDOWS\System32\DRIVERS\ipsec.sys
O41 - Driver: Service énumérateur IR (IRENUM) - C:\WINDOWS\System32\DRIVERS\irenum.sys
O41 - Driver: (no object) (K56) - C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys
O41 - Driver: Mélangeur audio Wave de noyau Microsoft (kmixer) - C:\WINDOWS\system32\drivers\kmixer.sys
O41 - Driver: (no object) (mdmxsdk) - C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys
O41 - Driver: Pilote HID de souris (mouhid) - C:\WINDOWS\System32\DRIVERS\mouhid.sys
O41 - Driver: Redirecteur client WebDav (MRxDAV) - C:\WINDOWS\System32\DRIVERS\mrxdav.sys
O41 - Driver: MRXSMB (MRxSmb) - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
O41 - Driver: Proxy de service de répartition Microsoft (MSKSSRV) - C:\WINDOWS\system32\drivers\MSKSSRV.sys
O41 - Driver: Proxy d'horloge de répartition Microsoft (MSPCLOCK) - C:\WINDOWS\system32\drivers\MSPCLOCK.sys
O41 - Driver: Proxy de gestion de qualité de répartition Microsoft (MSPQM) - C:\WINDOWS\system32\drivers\MSPQM.sys
O41 - Driver: Pilote BIOS de gestion de systèmes Microsoft (mssmbios) - C:\WINDOWS\System32\DRIVERS\mssmbios.sys
O41 - Driver: Pilote UART MIDI MPU-401 Microsoft (ms_mpu401) - C:\WINDOWS\system32\drivers\msmpu401.sys
O41 - Driver: Pilote TAPI NDIS d'accès distant (NdisTapi) - C:\WINDOWS\System32\DRIVERS\ndistapi.sys
O41 - Driver: NDIS mode utilisateur E/S Protocole (Ndisuio) - C:\WINDOWS\System32\DRIVERS\ndisuio.sys
O41 - Driver: Pilote réseau étendu NDIS d'accès distant (NdisWan) - C:\WINDOWS\System32\DRIVERS\ndiswan.sys
O41 - Driver: Interface NetBIOS (NetBIOS) - C:\WINDOWS\System32\DRIVERS\netbios.sys
O41 - Driver: NetBIOS sur TCP/IP (NetBT) - C:\WINDOWS\System32\DRIVERS\netbt.sys
O41 - Driver: (no object) (nv) - C:\WINDOWS\System32\DRIVERS\nv4_mini.sys
O41 - Driver: Pilote de filtre de trafic IPX (NwlnkFlt) - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys
O41 - Driver: Pilote de transfert de trafic IPX (NwlnkFwd) - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys
O41 - Driver: Miniport réseau étendu (PPTP) (PptpMiniport) - C:\WINDOWS\System32\DRIVERS\raspptp.sys
O41 - Driver: Pilote processeur (Processor) - C:\WINDOWS\System32\DRIVERS\processr.sys
O41 - Driver: Planificateur de paquets QoS (PSched) - C:\WINDOWS\System32\DRIVERS\psched.sys
O41 - Driver: Pilote de liaison parallèle directe (Ptilink) - C:\WINDOWS\System32\DRIVERS\ptilink.sys
O41 - Driver: PxHelp20 (PxHelp20) - C:\WINDOWS\System32\Drivers\PxHelp20.sys
O41 - Driver: Pilote de connexion automatique d'accès distant (RasAcd) - C:\WINDOWS\System32\DRIVERS\rasacd.sys
O41 - Driver: Miniport réseau étendu (L2TP) (Rasl2tp) - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
O41 - Driver: Pilote PPPOE d'accès à distance (RasPppoe) - C:\WINDOWS\System32\DRIVERS\raspppoe.sys
O41 - Driver: Parallèle direct (Raspti) - C:\WINDOWS\System32\DRIVERS\raspti.sys
O41 - Driver: Rdbss (Rdbss) - C:\WINDOWS\System32\DRIVERS\rdbss.sys
O41 - Driver: Pilote de filtre de lecture digitale de CD audio (redbook) - C:\WINDOWS\System32\DRIVERS\redbook.sys
O41 - Driver: (no object) (Rksample) - C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys
O41 - Driver: Secdrv (Secdrv) - C:\WINDOWS\System32\DRIVERS\secdrv.sys
O41 - Driver: Pilote de filtre Serenum (serenum) - C:\WINDOWS\System32\DRIVERS\serenum.sys
O41 - Driver: Filtre de bus AGP SIS (sisagp) - C:\WINDOWS\System32\DRIVERS\sisagp.sys
O41 - Driver: Pilote de carte Fast Ethernet PCI SiS (SISNIC) - C:\WINDOWS\System32\DRIVERS\sisnic.sys
O41 - Driver: (no object) (SoftFax) - C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys
O41 - Driver: Splitter audio du noyau Microsoft (splitter) - C:\WINDOWS\system32\drivers\splitter.sys
O41 - Driver: (no object) (sptd) - C:\WINDOWS\System32\Drivers\sptd.sys
O41 - Driver: Pilote de filtre de restauration système (sr) - C:\WINDOWS\System32\DRIVERS\sr.sys
O41 - Driver: Srv (Srv) - C:\WINDOWS\System32\DRIVERS\srv.sys
O41 - Driver: Pilote de bus logiciel (swenum) - C:\WINDOWS\System32\DRIVERS\swenum.sys
O41 - Driver: Synthétiseur de table de sons GC noyau Microsoft (swmidi) - C:\WINDOWS\system32\drivers\swmidi.sys
O41 - Driver: Périphérique audio système du noyau Microsoft (sysaudio) - C:\WINDOWS\system32\drivers\sysaudio.sys
O41 - Driver: Pilote du protocole TCP/IP (Tcpip) - C:\WINDOWS\System32\DRIVERS\tcpip.sys
O41 - Driver: (no object) (Tones) - C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys
O41 - Driver: Pilote de mise à jour microcode (Update) - C:\WINDOWS\System32\DRIVERS\update.sys
O41 - Driver: Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft (usbehci) - C:\WINDOWS\System32\DRIVERS\usbehci.sys
O41 - Driver: Concentrateur USB2 (usbhub) - C:\WINDOWS\System32\DRIVERS\usbhub.sys
O41 - Driver: Pilote miniport de contrôleur hôte ouvert USB Microsoft (usbohci) - C:\WINDOWS\System32\DRIVERS\usbohci.sys
O41 - Driver: Pilote de scanneur USB (usbscan) - C:\WINDOWS\System32\DRIVERS\usbscan.sys
O41 - Driver: Pilote de stockage de masse USB (usbstor) - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
O41 - Driver: Carte ISDN USB (usb_rndisx) - C:\WINDOWS\system32\DRIVERS\usb8023x.sys
O41 - Driver: (no object) (V124) - C:\WINDOWS\System32\DRIVERS\HSF_V124.sys
O41 - Driver: Pilote ARP IP d'accès distant (Wanarp) - C:\WINDOWS\System32\DRIVERS\wanarp.sys
O41 - Driver: Pilote WINMM de compatibilité audio WDM Microsoft (wdmaud) - C:\WINDOWS\system32\drivers\wdmaud.sys
O41 - Driver: (no object) (winachsf) - C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys

voici la suite

---\\ Logiciels installés (O42)
O42 - Logiciel: AVG Free 8.5
O42 - Logiciel: Adobe Flash Player 10 ActiveX
O42 - Logiciel: Adobe Photoshop 6.0
O42 - Logiciel: Adobe Reader 9 - Français
O42 - Logiciel: Adobe SVG Viewer
O42 - Logiciel: CANON iMAGE GATEWAY Task for ZoomBrowser EX
O42 - Logiciel: Canon Camera Window DC_DV 5 for ZoomBrowser EX
O42 - Logiciel: Canon Camera Window DC_DV 6 for ZoomBrowser EX
O42 - Logiciel: Canon Camera Window MC 6 for ZoomBrowser EX
O42 - Logiciel: Canon Internet Library for ZoomBrowser EX
O42 - Logiciel: Canon MultiPASS Suite 4.40
O42 - Logiciel: Canon RAW Image Task for ZoomBrowser EX
O42 - Logiciel: Canon RemoteCapture Task for ZoomBrowser EX
O42 - Logiciel: Canon Utilities Digital Photo Professional 2.2
O42 - Logiciel: Canon Utilities ZoomBrowser EX
O42 - Logiciel: Favorit
O42 - Logiciel: Firebird SQL Server - MAGIX Edition
O42 - Logiciel: Glary Utilities 2.9.0.518
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5)
O42 - Logiciel: MAGIX PC Visit
O42 - Logiciel: MSXML 4.0 SP2 (KB954430)
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft ActiveSync
O42 - Logiciel: Microsoft Internationalized Domain Names Mitigation APIs
O42 - Logiciel: Microsoft National Language Support Downlevel APIs
O42 - Logiciel: Microsoft Office Access MUI (French) 2007
O42 - Logiciel: Microsoft Office Enterprise 2007
O42 - Logiciel: Microsoft Office Excel MUI (French) 2007
O42 - Logiciel: Microsoft Office Groove MUI (French) 2007
O42 - Logiciel: Microsoft Office InfoPath MUI (French) 2007
O42 - Logiciel: Microsoft Office OneNote MUI (French) 2007
O42 - Logiciel: Microsoft Office Outlook MUI (French) 2007
O42 - Logiciel: Microsoft Office PowerPoint MUI (French) 2007
O42 - Logiciel: Microsoft Office Proof (Arabic) 2007
O42 - Logiciel: Microsoft Office Proof (Dutch) 2007
O42 - Logiciel: Microsoft Office Proof (English) 2007
O42 - Logiciel: Microsoft Office Proof (French) 2007
O42 - Logiciel: Microsoft Office Proof (German) 2007
O42 - Logiciel: Microsoft Office Proof (Spanish) 2007
O42 - Logiciel: Microsoft Office Proofing (French) 2007
O42 - Logiciel: Microsoft Office Publisher MUI (French) 2007
O42 - Logiciel: Microsoft Office Shared MUI (French) 2007
O42 - Logiciel: Microsoft Office Word MUI (French) 2007
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
O42 - Logiciel: Microsoft Works 2000
O42 - Logiciel: Mozilla Firefox (3.5.2)
O42 - Logiciel: Mozilla Thunderbird (2.0.0.19)
O42 - Logiciel: MyBuy 1.11.12
O42 - Logiciel: Notepad++
O42 - Logiciel: OpenOffice.org 3.0
O42 - Logiciel: PDF Editeur 2
O42 - Logiciel: Picasa 2
O42 - Logiciel: ProtectDisc Helper Driver 10
O42 - Logiciel: Realtek AC'97 Audio
O42 - Logiciel: Samplitude Music Studio 2008 14.0.0.0 (F)
O42 - Logiciel: Tiscali ADSL - Installation principale
O42 - Logiciel: WampServer 2.0
O42 - Logiciel: Web Acappella
O42 - Logiciel: Windows Internet Explorer 7
O42 - Logiciel: Windows XP Service Pack 3

---\\ Contenu des dossiers Fichiers Communs (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Alwil Software
O43 - CFD:Common File Directory ----D- C:\Program Files\AVG
O43 - CFD:Common File Directory ----D- C:\Program Files\AxBx
O43 - CFD:Common File Directory ----D- C:\Program Files\AXEL
O43 - CFD:Common File Directory ----D- C:\Program Files\Canon
O43 - CFD:Common File Directory ----D- C:\Program Files\ComPlus Applications
O43 - CFD:Common File Directory ----D- C:\Program Files\DAEMON Tools
O43 - CFD:Common File Directory ----D- C:\Program Files\EasyPHP 3.0
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\Ghost Navigator2_8_2
O43 - CFD:Common File Directory ----D- C:\Program Files\Glary Utilities
O43 - CFD:Common File Directory ----D- C:\Program Files\Google
O43 - CFD:Common File Directory ----D- C:\Program Files\IKEA HomePlanner
O43 - CFD:Common File Directory --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\Intuisphere
O43 - CFD:Common File Directory ----D- C:\Program Files\JCA2000
O43 - CFD:Common File Directory ----D- C:\Program Files\JRE
O43 - CFD:Common File Directory ----D- C:\Program Files\LivePad
O43 - CFD:Common File Directory ----D- C:\Program Files\MAGIX
O43 - CFD:Common File Directory ----D- C:\Program Files\Messenger
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft ActiveSync
O43 - CFD:Common File Directory ----D- C:\Program Files\microsoft frontpage
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Visual Studio
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Visual Studio 8
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Works
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft.NET
O43 - CFD:Common File Directory ----D- C:\Program Files\Movie Maker
O43 - CFD:Common File Directory ----D- C:\Program Files\Mozilla Firefox
O43 - CFD:Common File Directory ----D- C:\Program Files\Mozilla Thunderbird
O43 - CFD:Common File Directory ----D- C:\Program Files\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD:Common File Directory ----D- C:\Program Files\MSXML 4.0
O43 - CFD:Common File Directory ----D- C:\Program Files\NetMeeting
O43 - CFD:Common File Directory ----D- C:\Program Files\NewGet-eDocfr
O43 - CFD:Common File Directory ----D- C:\Program Files\Notepad++
O43 - CFD:Common File Directory ----D- C:\Program Files\OpenOffice.org 3
O43 - CFD:Common File Directory ----D- C:\Program Files\Outlook Express
O43 - CFD:Common File Directory ----D- C:\Program Files\PDF Editeur 2
O43 - CFD:Common File Directory ----D- C:\Program Files\Picasa2
O43 - CFD:Common File Directory ----D- C:\Program Files\ProtectDisc Driver Installer
O43 - CFD:Common File Directory ----D- C:\Program Files\Realtek AC97
O43 - CFD:Common File Directory ----D- C:\Program Files\Reference Assemblies
O43 - CFD:Common File Directory ----D- C:\Program Files\Services en ligne
O43 - CFD:Common File Directory ----D- C:\Program Files\Tiscali_Triway_WiFi
O43 - CFD:Common File Directory --H-D- C:\Program Files\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files\WhenUSearch
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows NT
O43 - CFD:Common File Directory --H-D- C:\Program Files\WindowsUpdate
O43 - CFD:Common File Directory ----D- C:\Program Files\xerox
O43 - CFD:Common File Directory ----D- C:\Program Files\Yahoo!
O43 - CFD:Common File Directory ----D- C:\Program Files\ZHPDiag
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Canon
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\DESIGNER
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\InstallShield
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\MSSoap
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\ODBC
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Services
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\SpeechEngines
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\System
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\WhenU

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:Last File Created 05/08/2009 - 10:00:38 ---A- C:\WINDOWS\System32\mswebdvd.dll
O44 - LFC:Last File Created 07/08/2009 - 18:28:04 ---A- C:\WINDOWS\System32\drivers\avgldx86.sys
O44 - LFC:Last File Created 07/08/2009 - 18:28:23 ---A- C:\WINDOWS\System32\avgrsstx.dll
O44 - LFC:Last File Created 07/08/2009 - 18:28:23 ---A- C:\WINDOWS\System32\drivers\avgmfx86.sys
O44 - LFC:Last File Created 07/08/2009 - 19:02:03 ---A- C:\WINDOWS\setupact.log
O44 - LFC:Last File Created 08/08/2009 - 12:25:49 ---A- C:\WINDOWS\SYSTEM.INI
O44 - LFC:Last File Created 09/08/2009 - 17:49:53 ---A- C:\WINDOWS\WMSysPr9.prx
O44 - LFC:Last File Created 09/08/2009 - 17:50:19 ---A- C:\WINDOWS\mgxoschk.ini
O44 - LFC:Last File Created 10/08/2009 - 12:33:58 ---A- C:\WINDOWS\Robota.INI
O44 - LFC:Last File Created 10/08/2009 - 13:21:46 ---A- C:\WINDOWS\win.ini
O44 - LFC:Last File Created 10/08/2009 - 13:21:54 ---A- C:\WINDOWS\MusicStudio.INI
O44 - LFC:Last File Created 10/08/2009 - 13:22:09 ---A- C:\WINDOWS\BeatBox.INI
O44 - LFC:Last File Created 10/08/2009 - 14:05:17 ---A- C:\WINDOWS\msxml4-KB954430-enu.LOG
O44 - LFC:Last File Created 12/08/2009 - 18:12:00 ---A- C:\WINDOWS\KB973815.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:25 ---A- C:\WINDOWS\KB973540.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:25 ---A- C:\WINDOWS\wmsetup.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:39 ---A- C:\WINDOWS\KB973354.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:44 ---A- C:\WINDOWS\updspapi.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:45 ---A- C:\WINDOWS\KB973507.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:52 ---A- C:\WINDOWS\KB973869.log
O44 - LFC:Last File Created 12/08/2009 - 18:15:59 ---A- C:\WINDOWS\KB956744.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:06 ---A- C:\WINDOWS\KB971557.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:12 ---A- C:\WINDOWS\KB971657.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:12 ---A- C:\WINDOWS\imsins.BAK
O44 - LFC:Last File Created 12/08/2009 - 18:16:19 ---A- C:\WINDOWS\FaxSetup.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:19 ---A- C:\WINDOWS\setupapi.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\KB960859.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\comsetup.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\iis6.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\imsins.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\msgsocm.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\ntdtcsetup.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\ocgen.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\ocmsn.log
O44 - LFC:Last File Created 12/08/2009 - 18:16:20 ---A- C:\WINDOWS\tsoc.log
O44 - LFC:Last File Created 22/08/2009 - 11:40:30 ---A- C:\WINDOWS\System32\PerfStringBackup.INI
O44 - LFC:Last File Created 22/08/2009 - 11:40:30 ---A- C:\WINDOWS\System32\perfc009.dat
O44 - LFC:Last File Created 22/08/2009 - 11:40:30 ---A- C:\WINDOWS\System32\perfc00C.dat
O44 - LFC:Last File Created 22/08/2009 - 11:40:30 ---A- C:\WINDOWS\System32\perfh009.dat
O44 - LFC:Last File Created 22/08/2009 - 11:40:30 ---A- C:\WINDOWS\System32\perfh00C.dat
O44 - LFC:Last File Created 22/08/2009 - 14:43:14 ---A- C:\WINDOWS\System32\FNTCACHE.DAT
O44 - LFC:Last File Created 22/08/2009 - 14:45:18 ---A- C:\WINDOWS\spupdsvc.log
O44 - LFC:Last File Created 22/08/2009 - 15:23:15 ---A- C:\WINDOWS\SchedLgU.Txt
O44 - LFC:Last File Created 24/08/2009 - 18:18:45 -S-A- C:\WINDOWS\bootstat.dat
O44 - LFC:Last File Created 24/08/2009 - 18:18:49 ---A- C:\WINDOWS\System32\wpa.dbl
O44 - LFC:Last File Created 24/08/2009 - 18:20:04 ---A- C:\WINDOWS\wiaservc.log
O44 - LFC:Last File Created 24/08/2009 - 18:20:08 ---A- C:\WINDOWS\wiadebug.log
O44 - LFC:Last File Created 24/08/2009 - 18:20:25 ---A- C:\WINDOWS\0.log
O44 - LFC:Last File Created 24/08/2009 - 18:29:49 ---A- C:\WINDOWS\WindowsUpdate.log
O44 - LFC:Last File Created 28/07/2009 - 11:06:27 ---A- C:\WINDOWS\ie8_main.log
O44 - LFC:Last File Created 29/07/2009 - 16:40:05 ---A- C:\WINDOWS\KB972260-IE7.log
O44 - LFC:Last File Created 30/07/2009 - 01:49:14 ---A- C:\WINDOWS\System32\MRT.exe

---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:12:45 ---A- C:\WINDOWS\Prefetch\VK_PLANRUN.EXE-1488A61A.pf
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:16:22 ---A- C:\WINDOWS\Prefetch\VK_WATCHOP.EXE-2265C839.pf
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:16:23 ---A- C:\WINDOWS\Prefetch\VK_SCANPROCESS.EXE-2708D53E.pf
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:21:47 ---A- C:\WINDOWS\Prefetch\VK_SCANFILE.EXE-1F321421.pf
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:21:50 ---A- C:\WINDOWS\Prefetch\AVWSC.EXE-0283F9DD.pf
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:23:42 ---A- C:\WINDOWS\Prefetch\VK_SERVICE.EXE-0B626D8E.pf
O45 - LFCP:Last File Created Prefetch 07/08/2009 - 18:24:25 ---A- C:\WINDOWS\Prefetch\PCTSSVC.EXE-3A239962.pf
O45 - LFCP:Last File Created Prefetch 09/08/2009 - 17:49:10 ---A- C:\WINDOWS\Prefetch\GRPCONV.EXE-111CD845.pf
O45 - LFCP:Last File Created Prefetch 11/08/2009 - 10:57:47 ---A- C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
O45 - LFCP:Last File Created Prefetch 12/08/2009 - 17:24:54 ---A- C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf
O45 - LFCP:Last File Created Prefetch 12/08/2009 - 17:25:41 ---A- C:\WINDOWS\Prefetch\DWWIN.EXE-30875ADC.pf
O45 - LFCP:Last File Created Prefetch 12/08/2009 - 17:25:54 ---A- C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 21:18:33 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-15629478.pf
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 21:35:52 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-496632C4.pf
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 21:40:26 ---A- C:\WINDOWS\Prefetch\WINWORD.EXE-07381162.pf
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 22:04:28 ---A- C:\WINDOWS\Prefetch\CALC.EXE-02CD573A.pf
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 23:07:42 ---A- C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 23:12:26 ---A- C:\WINDOWS\Prefetch\Layout.ini
O45 - LFCP:Last File Created Prefetch 17/08/2009 - 23:12:39 ---A- C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf
O45 - LFCP:Last File Created Prefetch 19/08/2009 - 12:14:55 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-3F3D4A7A.pf
O45 - LFCP:Last File Created Prefetch 19/08/2009 - 12:53:22 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-15830435.pf
O45 - LFCP:Last File Created Prefetch 20/08/2009 - 17:32:33 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-28E70035.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 10:57:31 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-2FF812D2.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 10:57:40 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-2F43742A.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:26:40 ---A- C:\WINDOWS\Prefetch\DOTNETFX35_X86.EXE-2AF130B4.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:26:44 ---A- C:\WINDOWS\Prefetch\DOTNETFX35SETUP.EXE-321715C6.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:26:58 ---A- C:\WINDOWS\Prefetch\SETUP.EXE-0B9241F3.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:27:42 ---A- C:\WINDOWS\Prefetch\CLWIREG.EXE-13D4F7BB.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:32:53 ---A- C:\WINDOWS\Prefetch\WMIADAP.EXE-2DF425B2.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:33:27 ---A- C:\WINDOWS\Prefetch\XPSEPSC-X86-EN-US.EXE-04A92942.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:33:37 ---A- C:\WINDOWS\Prefetch\UPDATE.EXE-3502E767.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:33:54 ---A- C:\WINDOWS\Prefetch\PRINTFILTERPIPELINESVC.EXE-372FC6AE.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:33:56 ---A- C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:33:57 ---A- C:\WINDOWS\Prefetch\PRINTFILTERPIPELINESVC.EXE-0F2B9E77.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:35:21 ---A- C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:35:22 ---A- C:\WINDOWS\Prefetch\PERFORMANCECOUNTERINSTALLER.E-334D54EC.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:36:53 ---A- C:\WINDOWS\Prefetch\NDP20SP2-KB958481-X86.EXE-23D510BC.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:37:04 ---A- C:\WINDOWS\Prefetch\HOTFIXINSTALLER.EXE-36BF0D43.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:39:39 ---A- C:\WINDOWS\Prefetch\REGTLIBV12.EXE-0E2FA54B.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:40:30 ---A- C:\WINDOWS\Prefetch\ASPNET_REGIIS.EXE-009D6E80.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:40:39 ---A- C:\WINDOWS\Prefetch\REGSVCS.EXE-11A17120.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:40:50 ---A- C:\WINDOWS\Prefetch\LODCTR.EXE-1009C3B4.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:40:57 ---A- C:\WINDOWS\Prefetch\NDP30SP2-KB958483-X86.EXE-22F3E440.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:41:09 ---A- C:\WINDOWS\Prefetch\HOTFIXINSTALLER.EXE-1C30B01A.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:41:18 ---A- C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:41:51 ---A- C:\WINDOWS\Prefetch\CSC.EXE-01730C27.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:41:51 ---A- C:\WINDOWS\Prefetch\CVTRES.EXE-2329DCD5.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:41:53 ---A- C:\WINDOWS\Prefetch\SERVICEMODELREG.EXE-1FB5DD06.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:42:08 ---A- C:\WINDOWS\Prefetch\NGEN.EXE-38021CCC.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:42:22 ---A- C:\WINDOWS\Prefetch\NDP35SP1-KB958484-X86.EXE-05577CF4.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:42:24 ---A- C:\WINDOWS\Prefetch\HOTFIXINSTALLER.EXE-396ADB7B.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:42:37 ---A- C:\WINDOWS\Prefetch\MOFCOMP.EXE-01718E95.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 11:42:39 ---A- C:\WINDOWS\Prefetch\WFSERVICESREG.EXE-063492A2.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 14:45:22 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-4B4D1AE9.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 14:45:22 ---A- C:\WINDOWS\Prefetch\SPUPDSVC.EXE-21B36524.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 14:49:18 ---A- C:\WINDOWS\Prefetch\MSCORSVW.EXE-1BF30400.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 14:59:45 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-33B4C618.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:02:23 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:02:57 ---A- C:\WINDOWS\Prefetch\EXCEL.EXE-34CB65E9.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:04:18 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-188DF14E.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:04:20 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-26A25ABF.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:04:54 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-44C75994.pf
O45 - LFCP:Last File Created Prefetch 22/08/2009 - 15:23:05 ---A- C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\AVGRSX.EXE-1893543C.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\MPSERVIC.EXE-20A65674.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\MSFEEDSSYNC.EXE-25E13438.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:34 ---A- C:\WINDOWS\Prefetch\WKSCAL.EXE-175A3279.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:20:39 ---A- C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:21:20 ---A- C:\WINDOWS\Prefetch\AVGUPD.EXE-388A6FCA.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:21:26 ---A- C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:21:37 ---A- C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:21:53 ---A- C:\WINDOWS\Prefetch\RUNDLL32.EXE-2DE47FF5.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:24:33 ---A- C:\WINDOWS\Prefetch\FIXCFG.EXE-293DC071.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:25:33 ---A- C:\WINDOWS\Prefetch\ACRORD32.EXE-3A1F13AE.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:25:40 ---A- C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:26:12 ---A- C:\WINDOWS\Prefetch\INFOCARD.EXE-14622E55.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:31:42 ---A- C:\WINDOWS\Prefetch\MPDBMGR.EXE-16A77614.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:39:18 ---A- C:\WINDOWS\Prefetch\ADOBE_UPDATER.EXE-32E1E9B7.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 18:58:44 ---A- C:\WINDOWS\Prefetch\ZHPDIAG 1.24.08.TMP-2B8CD4FE.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 19:01:14 ---A- C:\WINDOWS\Prefetch\ZHPDIAG 1.24.08.EXE-04278C91.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 19:01:14 ---A- C:\WINDOWS\Prefetch\ZHPDIAG 1.24.08.TMP-1F4BDAED.pf
O45 - LFCP:Last File Created Prefetch 24/08/2009 - 19:01:39 ---A- C:\WINDOWS\Prefetch\ZHPDIAG.EXE-021B7932.pf

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL

---\\ Export de clé d'application autorisée (ECAA)(O47)
O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
O47 - AAKE:Key Export SP - "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
O47 - AAKE:Key Export SP - "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
O47 - AAKE:Key Export SP - "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
O47 - AAKE:Key Export SP - "C:\Program Files\EasyPHP 3.0\mysql\bin\mysqld.exe"="C:\Program Files\EasyPHP 3.0\mysql\bin\mysqld.exe:*:Enabled:mysqld"
O47 - AAKE:Key Export SP - "C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe"="C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe:*:Enabled:Apache HTTP Server"
O47 - AAKE:Key Export SP - "C:\wamp\www\wamp\bin\apache\Apache2.2.11\bin\httpd.exe"="C:\wamp\www\wamp\bin\apache\Apache2.2.11\bin\httpd.exe:*:Enabled:Apache HTTP Server"
O47 - AAKE:Key Export SP - "C:\Program Files\Tiscali_Triway_WiFi\Wizard\CTD_FirmwareUpgrader.exe"="C:\Program Files\Tiscali_Triway_WiFi\Wizard\CTD_FirmwareUpgrader.exe:*:Enabled:CTD_FirmwareUpgrader"
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
O47 - AAKE:Key Export SP - "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
O47 - AAKE:Key Export DP - "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
O47 - AAKE:Key Export DP - "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
O47 - AAKE:Key Export DP - "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
O47 - AAKE:Key Export DP - "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

---\\ Déni du service (Local Security Authority) (LSA) (O48)

et encore

O48 - LSA:Local Security Authority Authentication Packages - C:\WINDOWS\System32\msv1_0.dll
O48 - LSA:Local Security Authority Notification Packages - C:\WINDOWS\System32\scecli.dll

---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\rdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\vgasave.sys

---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d

---\\ Trojan Driver Search Data (TDSD) (O52)
O52 - TDSD:HKLM\...\Drivers\"timer"="timer.drv"
O52 - TDSD:HKLM\...\Drivers32\"midimapper"="midimap.dll"
O52 - TDSD:HKLM\...\Drivers32\"msacm.imaadpcm"="imaadp32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msadpcm"="msadp32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msg711"="msg711.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msgsm610"="msgsm32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.trspch"="tssoft32.acm"
O52 - TDSD:HKLM\...\Drivers32\"vidc.cvid"="iccvid.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.I420"="msh263.drv"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv31"="ir32_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv32"="ir32_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iyuv"="iyuv_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.mrle"="msrle32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.msvc"="msvidc32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.uyvy"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.yuy2"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.yvu9"="tsbyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.yvyu"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"wavemapper"="msacm32.drv"
O52 - TDSD:HKLM\...\Drivers32\"midi"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msg723"="msg723.acm"
O52 - TDSD:HKLM\...\Drivers32\"vidc.M263"="msh263.drv"
O52 - TDSD:HKLM\...\Drivers32\"vidc.M261"="msh261.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msaudio1"="msaud32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.sl_anet"="sl_anet.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm"
O52 - TDSD:HKLM\...\Drivers32\"wave"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"midi1"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"mixer"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.MPG4"="mpg4c32.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.MP42"="mpg4c32.dll"
O52 - TDSD:HKLM\...\drivers.desc\"wdmaud.drv"="Realtek AC'97 Audio"
O52 - TDSD:HKLM\...\drivers.desc\"msaud32.acm"="Windows Media Audio"
O52 - TDSD:HKLM\...\drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec"
O52 - TDSD:HKLM\...\drivers.desc\"C:\WINDOWS\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec"
O52 - TDSD:HKLM\...\drivers.desc\"mpg4c32.dll"="Microsoft MPEG-4 Video Codec"

---\\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

---\\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\Policies\Explorer] - "NoDriveTypeAutoRun"=145
O56 - MWPE:[HKLM\...\Policies\Explorer] - "HonorAutoRunSetting"=1
O56 - MWPE:[HKLM\...\Policies\Explorer] - "NoCDBurning"=0

---\\ Liste des Drivers Système (SDL) (O58)
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ACEDRV10.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acehlp10.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acpi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acpiec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\afd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\alcxwdm.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amdk6.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amdk7.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\arp1394.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\asyncmac.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmarpc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmepvc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmlane.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmuni.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\audstub.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\avgldx86.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\avgmfx86.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\avgntflt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\beep.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\bridge.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cbidf2k.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdaudio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdrom.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cinemst2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\classpnp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cpqdap01.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\crusoe.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\disk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\diskdump.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmboot.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmload.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmusic.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\drmk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\drmkaud.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxg.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxgthk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fastfat.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fdc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fips.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\flpydisk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fsvga.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fs_rec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ftdisk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\gameenum.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidclass.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidparse.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidusb.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_AMOS.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_BSC2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_FALL.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_FAXX.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_FSKS.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_K56K.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_MSFT.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_SAMP.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_SOAR.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_SPKP.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_TONE.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_V124.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\i8042prt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\imapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ipfltdrv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ipinip.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ipnat.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ipsec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\irenum.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\isapnp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\kbdclass.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\kmixer.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ks.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ksecdd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mcd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mf.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mnmdd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\modem.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mouclass.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mouhid.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mountmgr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mrxdav.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mrxsmb.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\msfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\msgpc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mskssrv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\msmpu401.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mspclock.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mspqm.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\mup.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ndis.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ndistapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ndisuio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ndiswan.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ndproxy.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\netbios.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\netbt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nic1394.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nikedrv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nmnt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\npfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ntfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\null.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nv4_mini.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nwlnkflt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nwlnkfwd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nwlnkipx.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nwlnknb.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\nwlnkspx.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\oprghdlr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\p3.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\parport.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\partmgr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\parvdm.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\pci.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\pciide.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\pciidex.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\pcmcia.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\portcls.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\processr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\psched.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ptilink.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rasacd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rasl2tp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\raspppoe.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\raspptp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\raspti.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rawwan.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rdbss.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rdpcdd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rdpdr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rdpwd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\redbook.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rio8drv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\riodrv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rmcast.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rndismp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\rootmdm.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\scsiport.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\secdrv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\serenum.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\serial.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sfloppy.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sisagp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sisnic.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\smclib.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sonydcam.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\splitter.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sptd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sr.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\srv.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\stream.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\swenum.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\swmidi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\sysaudio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tape.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tcpip.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tcpip6.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tdi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tdpipe.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tdtcp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\termdd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tosdvd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tsbvcap.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\tunmp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\udfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\update.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usb8023.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbcamd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbcamd2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbehci.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbhub.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbintel.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbohci.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbport.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbscan.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\usbstor.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\vdmindvd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\vga.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\videoprt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\volsnap.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\wanarp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\wdmaud.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\wmilib.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ws2ifsl.sys

---\\ Liste des outils de nettoyage (LATC) (O63)
O63 - Logiciel: ZHPDiag 1.24

End of the scan: 869 lines

Ligne traitée : 817/834

~~~~~~~~~~~~~~> Navilog <~~~~~~~~~~~~~~~~~~~

• Télécharge Navilog1 (par IL-MAFIOSO) sur ton bureau

› http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

• Enregistre la cible (du lien) sous... et enregistre-le sur ton bureau.
• Ensuite double clique sur navilog1.exe pour lancer l'installation.
• Une fois l'installation terminée, double droit sur le raccourci Navilog1 présent sur le bureau.

• Laisse-toi guider. Appuie sur une touche quand on te le demande.
• Au menu principal, choisis 1 et valide.

/!\ Ne fais pas le choix 2 /!\

Patiente le temps du scan.

Note
Il te sera peut-être demandé de redémarrer ton PC.
Laisse l'outil le faire automatiquement, sinon redémarre ton PC normalement s'il te le demande.

• Patiente jusqu'au message "Scan terminé le......"
• Appuie sur une touche comme demandé ; le bloc-notes va s'ouvrir.

• Copie-colle l'intégralité dans ta réponse. Referme le bloc-notes.

• PS : le rapport est, aussi, sauvegardé à la racine du disque dur C:\cleannavi.txt

O4 - HKCU\..\Run: [goako] c:\documents and settings\seb\local settings\application data\goako.exe" goako
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job
O42 - Logiciel: Favorit
O43 - CFD:Common File Directory ----D- C:\Program Files\WhenUSearch
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\WhenU

il semblerait mais pour moi c'est un peu de l'hebreu que ces lignes correspondent a des virus mon pc rame enormement

est ce que navilog resoud ce genre de choses ? merci de m'expliquer .

Fait un log Navilog , et tu vas voir .

-> La magie va opérer

ok c'est parti

Fix Navipromo version 4.0.2 commencé le 06/09/2009 17:11:34,14

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 27.08.2009 à 11h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.66GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : seb ( Administrator )
BOOT : Normal boot

Antivirus : AVG Anti-Virus Free 8.5 (Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:26 Go)
D:\ (Local Disk) - NTFS - Total:34 Go (Free:33 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (CD or DVD)
K:\ (CD or DVD)

Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\seb\locals~1\Temp effectué !

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

*** Scan terminé 06/09/2009 17:26:10,01 ***

voila ou j'en suis ;-)

merci de ton aide . bonne fin de week end.

~~~~~~~~~~~~~~~> Lop S&D <~~~~~~~~~~~~~~~~~~

• Téléchargez Lop S&D d'Eric 71 & Angeldark à partir de ce lien

› https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

• Cliquez sur Enregistrer et placez le sur le Bureau

• Une fois le Téléchargement terminé, cliquez sur Fermer
• Double-cliquez sur l'icône pour lancer l'installation

• Acceptez les termes d'utilisation et cliquez sur Suivant
• Cliquez sur Oui pour créer un répertoire

• Double-cliquez sur le nouvel icône placé sur votre bureau pour lancer l'outil

• Choisissez votre langue : dans notre cas, ce sera Français, tapez F et pressez la touche Entrée de votre clavier
• Ensuite , choisir l'option 1
• Un rapport apparait automatiquement, Poste le dans ton prochain message

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.66GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : seb ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.5 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:26 Go)
D:\ (Local Disk) - NTFS - Total:34 Go (Free:33 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (CD or DVD)
K:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 06/09/2009|18:07 )

--------------------\\ Listing des dossiers dans APPLIC~1

[09/11/2008|21:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[07/08/2009|19:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
[25/11/2008|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[20/08/2008|11:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Canon
[11/05/2009|19:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/11/2008|16:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IsolatedStorage
[27/08/2009|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
[09/08/2009|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MAGIX
[31/10/2008|21:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[06/08/2009|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[01/09/2008|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[07/08/2009|19:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[03/01/2009|12:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[24/10/2008|16:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ZoomBrowser

[20/08/2008|10:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[07/08/2009|19:26] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[06/08/2009|23:15] C:\DOCUME~1\LOCALS~1\APPLIC~1\Mozilla

[07/08/2009|19:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[16/05/2009|16:20] C:\DOCUME~1\seb\APPLIC~1\Adobe
[24/10/2008|16:23] C:\DOCUME~1\seb\APPLIC~1\Canon
[03/01/2009|12:40] C:\DOCUME~1\seb\APPLIC~1\GlarySoft
[20/08/2008|11:12] C:\DOCUME~1\seb\APPLIC~1\Google
[23/02/2009|20:19] C:\DOCUME~1\seb\APPLIC~1\Help
[20/08/2008|10:56] C:\DOCUME~1\seb\APPLIC~1\Identities
[10/12/2008|18:22] C:\DOCUME~1\seb\APPLIC~1\LimeWire
[20/08/2008|11:09] C:\DOCUME~1\seb\APPLIC~1\Macromedia
[06/08/2009|12:15] C:\DOCUME~1\seb\APPLIC~1\Microsoft
[22/01/2009|18:35] C:\DOCUME~1\seb\APPLIC~1\Mozilla
[01/09/2008|20:25] C:\DOCUME~1\seb\APPLIC~1\MSN6
[16/01/2009|19:01] C:\DOCUME~1\seb\APPLIC~1\Notepad++
[04/02/2009|22:53] C:\DOCUME~1\seb\APPLIC~1\OpenOffice.org
[25/11/2008|14:29] C:\DOCUME~1\seb\APPLIC~1\RegistrySmart
[10/12/2008|18:12] C:\DOCUME~1\seb\APPLIC~1\Sun
[22/01/2009|18:35] C:\DOCUME~1\seb\APPLIC~1\Talkback
[22/01/2009|18:35] C:\DOCUME~1\seb\APPLIC~1\Thunderbird
[24/12/2008|20:09] C:\DOCUME~1\seb\APPLIC~1\Yahoo!
[24/10/2008|16:24] C:\DOCUME~1\seb\APPLIC~1\ZoomBrowser EX

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[06/09/2009 16:41][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{1FBAF2B2-5D40-41F5-83D3-00866A99BBB7}.job
[06/09/2009 17:47][--a------] C:\WINDOWS\tasks\GlaryInitialize.job
[16/01/2009 04:30][--a------] C:\WINDOWS\tasks\RegistrySmart Scheduled Scan.job
[06/09/2009 17:47][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[09/11/2008|21:50] C:\Program Files\Adobe
[20/08/2008|11:08] C:\Program Files\Alwil Software
[07/08/2009|19:28] C:\Program Files\AVG
[07/08/2009|19:24] C:\Program Files\AxBx
[01/03/2009|01:37] C:\Program Files\AXEL
[31/10/2008|21:17] C:\Program Files\Canon
[20/08/2008|10:48] C:\Program Files\ComPlus Applications
[27/08/2009|18:36] C:\Program Files\Conduit
[07/08/2009|19:07] C:\Program Files\DAEMON Tools
[16/01/2009|18:42] C:\Program Files\EasyPHP 3.0
[27/08/2009|18:36] C:\Program Files\Eazel-FR
[24/08/2009|20:22] C:\Program Files\Fichiers communs
[31/10/2008|21:19] C:\Program Files\Ghost Navigator2_8_2
[16/01/2009|14:37] C:\Program Files\Glary Utilities
[11/05/2009|20:55] C:\Program Files\Google
[25/11/2008|17:24] C:\Program Files\IKEA HomePlanner
[25/11/2008|13:50] C:\Program Files\InstallShield Installation Information
[29/07/2009|17:39] C:\Program Files\Internet Explorer
[26/11/2008|19:35] C:\Program Files\Intuisphere
[21/07/2009|18:40] C:\Program Files\JCA2000
[04/02/2009|22:48] C:\Program Files\JRE
[30/11/2008|16:59] C:\Program Files\LivePad
[09/08/2009|18:50] C:\Program Files\MAGIX
[05/02/2009|10:38] C:\Program Files\Messenger
[11/01/2009|21:51] C:\Program Files\Microsoft ActiveSync
[20/08/2008|10:51] C:\Program Files\microsoft frontpage
[14/04/2009|20:42] C:\Program Files\Microsoft Office
[14/04/2009|20:42] C:\Program Files\Microsoft Visual Studio
[14/04/2009|20:33] C:\Program Files\Microsoft Visual Studio 8
[14/04/2009|20:43] C:\Program Files\Microsoft Works
[14/04/2009|20:40] C:\Program Files\Microsoft.NET
[04/02/2009|23:16] C:\Program Files\Movie Maker
[25/08/2009|18:28] C:\Program Files\Mozilla Firefox
[03/04/2009|18:26] C:\Program Files\Mozilla Thunderbird
[22/08/2009|12:34] C:\Program Files\MSBuild
[20/08/2008|10:47] C:\Program Files\MSN
[20/08/2008|10:47] C:\Program Files\MSN Gaming Zone
[10/08/2009|15:05] C:\Program Files\MSXML 4.0
[06/09/2009|17:26] C:\Program Files\Navilog1
[04/02/2009|23:12] C:\Program Files\NetMeeting
[25/11/2008|13:57] C:\Program Files\NewGet-eDocfr
[23/01/2009|18:46] C:\Program Files\Notepad++
[04/02/2009|22:48] C:\Program Files\OpenOffice.org 3
[12/08/2009|19:15] C:\Program Files\Outlook Express
[09/11/2008|21:44] C:\Program Files\PDF Editeur 2
[31/10/2008|21:33] C:\Program Files\Picasa2
[09/08/2009|18:52] C:\Program Files\ProtectDisc Driver Installer
[20/08/2008|10:57] C:\Program Files\Realtek AC97
[22/08/2009|12:34] C:\Program Files\Reference Assemblies
[20/08/2008|10:49] C:\Program Files\Services en ligne
[20/08/2008|11:03] C:\Program Files\Tiscali_Triway_WiFi
[01/12/2008|17:45] C:\Program Files\Uninstall Information
[07/05/2009|19:43] C:\Program Files\WhenUSearch
[04/02/2009|23:17] C:\Program Files\Windows Media Player
[04/02/2009|23:12] C:\Program Files\Windows NT
[20/08/2008|11:06] C:\Program Files\WindowsUpdate
[20/08/2008|10:51] C:\Program Files\xerox
[07/08/2009|19:48] C:\Program Files\Yahoo!
[06/09/2009|17:33] C:\Program Files\ZebHelpProcess
[01/09/2009|11:51] C:\Program Files\ZHPDiag

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[09/11/2008|21:51] C:\Program Files\Fichiers communs\Adobe
[24/08/2009|20:22] C:\Program Files\Fichiers communs\Borland Shared
[24/10/2008|16:20] C:\Program Files\Fichiers communs\Canon
[14/04/2009|20:42] C:\Program Files\Fichiers communs\DESIGNER
[20/08/2008|11:02] C:\Program Files\Fichiers communs\InstallShield
[14/04/2009|20:43] C:\Program Files\Fichiers communs\Microsoft Shared
[20/08/2008|10:48] C:\Program Files\Fichiers communs\MSSoap
[20/08/2008|11:42] C:\Program Files\Fichiers communs\ODBC
[20/08/2008|10:48] C:\Program Files\Fichiers communs\Services
[20/08/2008|11:42] C:\Program Files\Fichiers communs\SpeechEngines
[14/04/2009|20:33] C:\Program Files\Fichiers communs\System
[25/11/2008|13:27] C:\Program Files\Fichiers communs\WhenU

--------------------\\ Process

( 30 Processes )

IEXPLORE.EXE ~ [PID:3540]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\seb\Cookies\seb@advertstream[2].txt
C:\DOCUME~1\seb\Cookies\seb@advertising[1].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 18:08:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:11][D:1]-> C:\DOCUME~1\seb\LOCALS~1\Temp
[F:340][D:0]-> C:\DOCUME~1\seb\Cookies
[F:3728][D:9]-> C:\DOCUME~1\seb\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 06/09/2009|18:09 - Option : [1]

--------------------\\ Fin du rapport a 18:09:51

voila y-a-il une suite?

~~~~~~~~~~~~~~> Malwarebytes <~~~~~~~~~~~~~~~~~~~

• Télécharger Malwarebytes

› https://download.cnet.com/malwarebytes-anti-malware/windows.html?part=dl-10804572&subj=dl&tag=button

• Enregistre le sur le bureau
• Double clique sur le fichier téléchargé pour lancer le processus d’installation
• Lorsqu’il te le sera demandé, mets à jour Malwarebytes anti malware
• Si le pare-feu demande l’autorisation de se connecter pour malwarebytes, acceptes
• Une fois la mise à jour terminée, ferme Malwarebytes

• Double-clique sur l’icône de malwarebytes pour le relancer
• Dans l’onglet, Recherche, probablement ouvert par défaut,
• Sélectionne Exécuter un examen complet
• Clique sur Rechercher
• Le scan démarre

• A la fin de l’analyse, un message s’affiche : L’examen s’est terminé normalement. Cliquez sur ‘Afficher les résultats’ pour afficher tous les objets trouvés.
• Clique sur Ok pour poursuivre.
• Si des malwares ont été détectés, cliques sur Afficher les résultats
• Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

• Malwarebytes va ouvrir le bloc-notes et y copier le rapport d’analyse.
• Rends toi dans l’onglet rapport/log
• Tu clique dessus pour l’afficher.
• Une fois affiché, cliques sur édition en haut du bloc notes, et puis sur sélectionner tout
• Tu recliques sur édition et puis sur copier et tu reviens sur le forum et dans ta réponse
• Tu clique droit dans le cadre de la réponse et coller

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2753
Windows 5.1.2600 Service Pack 3

07/09/2009 22:24:21
mbam-log-2009-09-07 (22-24-21).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)
Eléments examinés: 162512
Temps écoulé: 1 hour(s), 22 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\seb\Application Data\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\seb\Application Data\RegistrySmart\Log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{40AF7EBE-3743-4CC9-AC24-C290B7FE1408}\RP234\A0048420.exe (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\Documents and Settings\seb\Application Data\RegistrySmart\Log\2008 Nov 25 - 01_29_04 PM_453.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\seb\Application Data\RegistrySmart\Log\2008 Nov 25 - 02_00_39 PM_281.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\Documents and Settings\seb\Application Data\RegistrySmart\Log\2008 Nov 25 - 04_22_31 PM_765.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

• On va purger la restauration du systeme

• Suit ce tuto

› http://www.bibou0007.com/windows-xp-f101/purger-la-restauration-du-systeme-sous-windows-xp-t151.htm

Et tu vas créer un point de restauration propre

• Suit ce tuto

› https://www.micro-astuce.com/depannage/creer-restauration-systeme.php

Et refait un log Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:25:51, on 08/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\seb\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2095689
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O3 - Toolbar: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8_2\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8_2\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C79F0120-EF94-4FAC-8248-6F30B92E9524} (AdValiderInterface Class) - http://www.journal-officiel.gouv.fr/verifier/AdValiderWeb_DJO.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.30\bin\mysqld.exe

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:25:51, on 08/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\seb\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2095689
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O3 - Toolbar: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8_2\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8_2\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C79F0120-EF94-4FAC-8248-6F30B92E9524} (AdValiderInterface Class) - http://www.journal-officiel.gouv.fr/verifier/AdValiderWeb_DJO.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.30\bin\mysqld.exe

~~~~~~~~~~~~~~~> Ad-Remover <~~~~~~~~~~~~~~~~~~~

/!\ Désactive temporairement ton antivirus /!\

• Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

› http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

• Lance l'installation avec les paramètres par défaut.
• Double-clique sur le raccourci Ad-Remover sur ton Bureau.
• Choisit ta langue F pour française.
• Au menu principal, choisis l'option S.

/!\ Laisse travailler l'outil /!\

* Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

• Note :

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

~~~~~~~~~~~~~~~~> Toolbar-S&D <~~~~~~~~~~~~~~~~~~~

• Télécharger Toolbar-S&D (Team IDN) sur le Bureau.

› https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

• Lance l'installation du programme en exécutant le fichier téléchargé.

• Double-clique maintenant sur le raccourci de Toolbar-S&D.

• Sélectionne la langue souhaitée en tapant </gras>la lettre de ton choix</gras> puis en validant avec la touche </gras>Entrée.</gras>

• Choisis maintenant l'option 1 (Recherche).

/!\ Patiente jusqu'à la fin de la recherche. /!\

• Poste le rapport généré. (C:\TB.txt)

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_U | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 07/09/2009 à 8:30 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 15:59:24, 08/09/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: SEB-5KWJ8NEEMHI | Utilisateur actuel: seb
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
.
C:\Program Files\Fichiers communs\WhenU
C:\Program Files\WhenUSearch
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.2 *
.
Nom du profil: m37yh4k4.default (seb)
.
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.1.2");
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://search.conduit.com?SearchSource=10&ctid=CT2095689
Search Page: hxxp://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://fr.search.yahoo.com
Search Bar: hxxp://www.google.com/ie
Default_Search_URL: hxxp://www.google.com/ie
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://fr.yahoo.com
Default_Search_URL: hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://fr.search.yahoo.com
Search Page: hxxp://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://fr.search.yahoo.com
Start Page: hxxp://fr.yahoo.com
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
1800 Octet(s) - C:\Ad-Report-SCAN.log
.
14 Fichier(s) - C:\DOCUME~1\seb\LOCALS~1\Temp
1 Fichier(s) - C:\WINDOWS\Temp
.
1 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 16:08:59 | 08/09/2009
.
============== E.O.F ==============
.