PC infecté

Merci pour votre aide :-)

Voici le résultat des deux premières analyses:

Fichier E_S00RP2.EXE_ reçu le 2009.11.02 17:24:23 (UTC)
Résultat: 1/41 (2.44%)

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.02 -
AhnLab-V3 5.0.0.2 2009.11.02 -
AntiVir 7.9.1.53 2009.11.02 -
Antiy-AVL 2.0.3.7 2009.11.02 -
Authentium 5.1.2.4 2009.11.02 -
Avast 4.8.1351.0 2009.11.01 -
AVG 8.5.0.423 2009.11.02 -
BitDefender 7.2 2009.11.02 -
CAT-QuickHeal 10.00 2009.11.02 -
ClamAV 0.94.1 2009.11.02 -
Comodo 2816 2009.11.02 -
DrWeb 5.0.0.12182 2009.11.02 -
eSafe 7.0.17.0 2009.11.02 -
eTrust-Vet 35.1.7097 2009.11.02 -
F-Prot 4.5.1.85 2009.11.02 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.11.02 -
GData 19 2009.11.02 -
Ikarus T3.1.1.72.0 2009.11.02 -
Jiangmin 11.0.800 2009.11.02 -
K7AntiVirus 7.10.886 2009.11.02 -
Kaspersky 7.0.0.125 2009.11.02 -
McAfee 5789 2009.11.01 -
McAfee+Artemis 5789 2009.11.01 -
McAfee-GW-Edition 6.8.5 2009.11.02 Heuristic.BehavesLike.Win32.Backdoor.L
Microsoft 1.5202 2009.11.02 -
NOD32 4565 2009.11.02 -
Norman 6.03.02 2009.11.02 -
nProtect 2009.1.8.0 2009.11.02 -
Panda 10.0.2.2 2009.11.01 -
PCTools 7.0.3.5 2009.11.02 -
Prevx 3.0 2009.11.02 -
Rising 21.54.04.00 2009.11.02 -
Sophos 4.47.0 2009.11.02 -
Sunbelt 3.2.1858.2 2009.11.01 -
Symantec 1.4.4.12 2009.11.02 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.11.02 -
VBA32 3.12.10.11 2009.11.02 -
ViRobot 2009.11.2.2017 2009.11.02 -
VirusBuster 4.6.5.0 2009.11.02 -
Information additionnelle
File size: 62464 bytes
MD5...: 5f933159fa1e72c233905cdf25cc254a
SHA1..: eba17dab69dd7a8b78a615b2b91b0c273a142ba8
SHA256: 318fd4ad67e67aa2391290e98c5d83301b976eeabd3efe5694dcbd9a970d­c181
ssdeep: 1536:P6YYfQf+ankfupkFsroN2QVE2Bkp9gtiHby:PrYfQf+CwupkFCo3VDS­9gtM
by

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x49f0
timedatestamp.....: 0x3d1ffffc (Mon Jul 01 07:08:44 2002)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9522 0x9600 6.35 52ffa2c974bf85978be9eff5d4129d41
.rdata 0xb000 0x1aca 0x1c00 5.15 9e596d386e94f37600319889f05feb0c
.data 0xd000 0x5294 0x3a00 1.94 8f2bf8849b7426b8e854166c03aa1a42
.rsrc 0x13000 0x378 0x400 2.90 04aa92cc81edf64ac9f089c9552f6227

( 6 imports )
> KERNEL32.dll: SetConsoleCtrlHandler, lstrlenA, FormatMessageA, Sleep, LocalFree, GetLocaleInfoW, SetStdHandle, CreateEventA, GetModuleFileNameA, ExitProcess, SetEvent, WaitForSingleObject, CloseHandle, FreeLibrary, SetLastError, GetProcAddress, MultiByteToWideChar, LoadLibraryA, GetVersionExA, FlushFileBuffers, InterlockedDecrement, SetFilePointer, LCMapStringW, GetStringTypeA, LCMapStringA, GetLocaleInfoA, WriteFile, VirtualFree, VirtualAlloc, GetStringTypeW, InterlockedIncrement, HeapDestroy, GetLastError, HeapCreate, UnhandledExceptionFilter, RtlUnwind, TerminateProcess, GetCurrentProcess, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, HeapFree, HeapAlloc, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetACP, GetCPInfo, TlsGetValue, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, WideCharToMultiByte, TlsSetValue, TlsAlloc, GetOEMCP, SetHandleCount, GetStdHandle, GetFileType, GetCurrentThreadId
> USER32.dll: wsprintfA
> WINSPOOL.DRV: OpenPrinterA, OpenPrinterW, ClosePrinter, GetPrinterDriverA
> ADVAPI32.dll: DeleteService, ControlService, OpenServiceA, StartServiceA, QueryServiceStatus, CreateServiceA, CloseServiceHandle, OpenSCManagerA, ReportEventA, DeregisterEventSource, RegisterEventSourceA, RegisterServiceCtrlHandlerA, SetServiceStatus, StartServiceCtrlDispatcherA
> RPCRT4.dll: RpcServerUnregisterIf, RpcMgmtStopServerListening, RpcServerListen, RpcMgmtWaitServerListen, RpcServerUseProtseqEpA, NdrConformantVaryingArrayUnmarshall, NdrConformantVaryingArrayBufferSize, NdrConformantVaryingArrayMarshall, NdrServerInitializeNew, NdrPointerFree, NdrServerContextUnmarshall, RpcRaiseException, NdrConvert, NdrConformantStringUnmarshall, NdrServerContextMarshall, NDRSContextUnmarshall, I_RpcGetBuffer, RpcServerRegisterIf
> RPCNS4.dll: RpcNsBindingUnexportA

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: SEIKO EPSON CORPORATION
copyright....: Copyright (C) SEIKO EPSON CORP. 2002
product......: EPSON Status Monitor 3
description..: EPSON Status Monitor 3
original name: E_S00RP2.EXE
internal name: E_S00RP2
file version.: 2.02
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Fichier mcqkg.dll reçu le 2009.11.02 17:29:37 (UTC)
Résultat: 19/41 (46.35%)

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.02 Trojan.Generic!IK
AhnLab-V3 5.0.0.2 2009.11.02 Win-Trojan/Xema.variant
AntiVir 7.9.1.53 2009.11.02 TR/Healsock.A.2
Antiy-AVL 2.0.3.7 2009.11.02 -
Authentium 5.1.2.4 2009.11.02 -
Avast 4.8.1351.0 2009.11.01 Win32:Trojan-gen
AVG 8.5.0.423 2009.11.02 -
BitDefender 7.2 2009.11.02 Trojan.Generic.2253255
CAT-QuickHeal 10.00 2009.11.02 Trojan.Healsock
ClamAV 0.94.1 2009.11.02 -
Comodo 2816 2009.11.02 UnclassifiedMalware
DrWeb 5.0.0.12182 2009.11.02 -
eSafe 7.0.17.0 2009.11.02 -
eTrust-Vet 35.1.7097 2009.11.02 -
F-Prot 4.5.1.85 2009.11.02 -
F-Secure 9.0.15370.0 2009.10.30 Trojan.Generic.2253255
Fortinet 3.120.0.0 2009.11.02 -
GData 19 2009.11.02 Trojan.Generic.2253255
Ikarus T3.1.1.72.0 2009.11.02 Trojan.Generic
Jiangmin 11.0.800 2009.11.02 -
K7AntiVirus 7.10.886 2009.11.02 Trojan.Win32.Malware
Kaspersky 7.0.0.125 2009.11.02 -
McAfee 5789 2009.11.01 Generic BackDoor.t
McAfee+Artemis 5789 2009.11.01 Generic BackDoor.t
McAfee-GW-Edition 6.8.5 2009.11.02 Heuristic.BehavesLike.Win32.Suspicious.L
Microsoft 1.5202 2009.11.02 Trojan:Win32/Healsock
NOD32 4565 2009.11.02 Win32/AdProt.AC
Norman 6.03.02 2009.11.02 W32/Healsock.A
nProtect 2009.1.8.0 2009.11.02 -
Panda 10.0.2.2 2009.11.01 -
PCTools 7.0.3.5 2009.11.02 -
Prevx 3.0 2009.11.02 -
Rising 21.54.04.00 2009.11.02 -
Sophos 4.47.0 2009.11.02 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.11.01 -
Symantec 1.4.4.12 2009.11.02 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.11.02 -
VBA32 3.12.10.11 2009.11.02 -
ViRobot 2009.11.2.2017 2009.11.02 -
VirusBuster 4.6.5.0 2009.11.02 Trojan.Healsock.D
Information additionnelle
File size: 86016 bytes
MD5...: 4e250fbd84097dac8effb426374bfc7b
SHA1..: 4e4b6ae7634a414ac7f2ec72c28f08036ec16b26
SHA256: afea2ab4e85d5f1e04e45384d52d85e7f7172a936981d85cfb45b3243af98cec
ssdeep: 1536:g8+ybMbsYUqxPxlsWJDsNMmGn5RRrjJBdiPl5UYxV:gZBmqxp9oX+xX4Pl5
U8V

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x94ab
timedatestamp.....: 0x49232876 (Tue Nov 18 20:41:26 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xdca4 0xe000 6.66 732c1b618ba0e4808f4f3835def91562
.rdata 0xf000 0x2847 0x3000 4.39 c2f48b1f784efbd364d96881260c050e
.data 0x12000 0x1640 0x1000 2.20 f8c36145dd6aeb7a5b608ca95cb4794b
.reloc 0x14000 0x14f6 0x2000 3.28 6d5ed2db75ba5953f99b3858f87f70a1

( 4 imports )
> KERNEL32.dll: InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, CloseHandle, WriteFile, CreateFileA, DeleteFileA, CreateDirectoryA, Sleep, GetTickCount, GetEnvironmentVariableA, InterlockedExchange, GetACP, GetLocaleInfoA, GetThreadLocale, GetVersionExA, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GlobalFree, FreeLibrary, GetProcAddress, LoadLibraryA, lstrlenW, lstrlenA, HeapAlloc, GetProcessHeap, HeapDestroy, HeapFree, TerminateThread, GetCurrentThread, SetUnhandledExceptionFilter, GetModuleFileNameA, LoadLibraryW, ExpandEnvironmentStringsW, HeapCreate, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, RtlUnwind, RaiseException, GetCurrentThreadId, GetCommandLineA, TlsAlloc, SetLastError, GetLastError, TlsFree, TlsSetValue, TlsGetValue, GetModuleHandleA, VirtualFree, VirtualAlloc, HeapReAlloc, IsBadWritePtr, ExitProcess, TerminateProcess, GetCurrentProcess, HeapSize, LCMapStringA, LCMapStringW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, GetOEMCP, GetCPInfo, VirtualQuery, VirtualProtect, GetSystemInfo, GetStringTypeA, GetStringTypeW
> USER32.dll: wsprintfA
> WS2_32.dll: WSCInstallProvider, WSCEnumProtocols, -, -, WSCGetProviderPath
> RPCRT4.dll: UuidCreate

( 4 exports )
DllMain, DllRegisterServer, DllUnregisterServer, WSPStartup


RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Voici le lien demandé
http://www.cijoint.fr/cjlink.php?file=cj200911/cijTchHFvl.tx­t

Encore merci
mjlb

re,


c'est quoi ça ?

qui t'as demandé ce screen shoot ?


pas moi ... j'espère que tu n'as pas créer d'autre sujet ( ici ou sur d'autre forum ) , c'est le meilleur moyen d'embrouiller tout le monde et de mettre plus longtemps à résoudre le prb ...


bref , ce que je t'ai demandé c'est ça > https://forums.commentcamarche.net/forum/affich-15012433-pc-infecte#5


j'attends donc les rapports ...

J'espère que c'est la bonne:
Cop/col rapport Malwarebytes et HiJackthis

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3091
Windows 5.1.2600 Service Pack 2

03/11/2009 11:02:57
mbam-log-2009-11-03 (11-02-57).txt

Type de recherche: Examen rapide
Eléments examinés: 106286
Temps écoulé: 7 minute(s), 32 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Propriétaire\Local Settings\Temp\QRC.exe (Adware.QUADRegClean) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\acrsecB.fon (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\acrsecI.fon (Trojan.Agent) -> Quarantined and deleted successfully.



Log Hijackthis

Rapport de ZHPDiag v1.24.25 par Nicolas Coolman
Run by Propriétaire at 03/11/2009 13:41:31
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
MSIE: Internet Explorer v7.0.5730.11

Boot mode: Normal (Normal boot)
Total RAM: 511 MB (31% free)
System drive C: has 58 GB (75%) free of 76 GB

---\\ Processus lancés
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\lsass.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe

---\\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

---\\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

---\\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: C:\Program Files\AOL Toolbar\toolbar.dll - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
O3 - Toolbar: C:\Program Files\AOL Toolbar\toolbar.dll - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll

---\\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\HOMERunner.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - Global Startup: 3D!Turbo Experience.lnk - C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Notification de cadeaux MSN.lnk - C:\Documents and Settings\Propriétaire\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\favicon.ico
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFBARH.ICO
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aimres.dll,144
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Program Files\Real\RealPlayer\eb_act.ico
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe,302

---\\ Piratage de l'Option 'Rétablir les paramètres Web' (O14)
O14 - IERESET.INF: START_PAGE_URL=START_PAGE_URL=https://fr.creative.com/

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} () - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab

---\\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\system32\inetcomm.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Handler: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\Windows\System32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\Windows\system32\SHELL32.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\System32\WgaLogon.dll

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\System32\browseui.dll

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: AOL Connectivity Service (AOL ACS) - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: Fax (Fax) - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Norton Internet Security (Norton Internet Security) - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe" /s "Norton Internet Security" /m "C:\Program Files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll" /prefetch:1
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag (O&O Defrag) - C:\WINDOWS\system32\oodag.exe
O23 - Service: Office Source Engine (ose) - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
O23 - Service: Planificateur LiveUpdate automatique (Planificateur LiveUpdate automatique) - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spouleur d'impression (Spooler) - C:\WINDOWS\system32\spoolsv.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMDM PMSP Service (WMDM PMSP Service) - C:\WINDOWS\System32\MsPMSPSv.exe

---\\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: IE7 Uninstall Stub - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Lecteur Windows Media - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE
O40 - ASIC: Personnalisation du navigateur - >{D1FD0340-1521-11D3-B619-00AA00BCDEC6}S08718 - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
O40 - ASIC: Viewpoint Media Player - {03F998B2-0E00-11D3-A498-00104B6EB52E} - C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll
O40 - ASIC: Q824145 - {057997dd-71e4-43cc-b161-3f8180691a9e} - (not file)
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)
O40 - ASIC: Viewpoint Media Player - {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\msdxm.ocx
O40 - ASIC: Q867801 - {2298d453-bcae-4519-bf33-1cbf3faf1524} - (not file)
O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\msdxm.ocx
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - C:\WINDOWS\system32\danim.dll
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll
O40 - ASIC: Q837009 - {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - (not file)
O40 - ASIC: Liaison de données Dynamic HTML pour Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)
O40 - ASIC: KB834707 - {3e7bb08a-a7a3-4692-8eac-ac5e7895755b} - (not file)
O40 - ASIC: Création avancée - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
O40 - ASIC: DirectShow - {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - (not file)
O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)
O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)
O40 - ASIC: Classes Java DirectAnimation - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)
O40 - ASIC: Microsoft Windows Script 5.7 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
O40 - ASIC: Microsoft Data Access Components KB870669 - {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - (not file)
O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)
O40 - ASIC: Dossiers Web - {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - (not file)
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
O40 - ASIC: Q831167 - {795d0712-722c-43ec-906a-fc5e678eada9} - (not file)
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
O40 - ASIC: Fax - {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)
O40 - ASIC: Fax Provider - {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - (not file)
O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)
O40 - ASIC: Planificateur de tâches - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx
O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)
O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)
O40 - ASIC: Q832894 - {eddbec60-89cb-44ef-8291-0850fd28ff6a} - (not file)
O40 - ASIC: Q823353 - {f5173cf0-1dfb-4978-8e50-a90169ee7ca9} - (not file)
O40 - ASIC: Q330994 - {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - (not file)

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: Environnement de prise en charge de réseau AFD (AFD) - C:\WINDOWS\System32\drivers\afd.sys
O41 - Driver: Symantec Heuristics Driver (BHDrvx86) - C:\WINDOWS\System32\Drivers\NIS\1007020.00B\BHDrvx86.sys
O41 - Driver: Symantec Hash Provider (ccHP) - C:\WINDOWS\System32\Drivers\NIS\1007020.00B\ccHPx86.sys
O41 - Driver: Pilote de CD-ROM (Cdrom) - C:\WINDOWS\System32\DRIVERS\cdrom.sys
O41 - Driver: Symantec Eraser Control driver (eeCtrl) - C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\eeCtrl.sys
O41 - Driver: Pilote pour clavier i8042 et souris sur port PS/2 (i8042prt) - C:\WINDOWS\System32\DRIVERS\i8042prt.sys
O41 - Driver: IDSxpx86 (IDSxpx86) - C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20091102.002\IDSxpx86.sys
O41 - Driver: Pilote de filtre de gravure CD (Imapi) - C:\WINDOWS\System32\DRIVERS\imapi.sys
O41 - Driver: Pilote de processeur Intel (intelppm) - C:\WINDOWS\System32\DRIVERS\intelppm.sys
O41 - Driver: Pilote IPSEC (IPSec) - C:\WINDOWS\System32\DRIVERS\ipsec.sys
O41 - Driver: Pilote de la classe Clavier (Kbdclass) - C:\WINDOWS\System32\DRIVERS\kbdclass.sys
O41 - Driver: Pilote de la classe Souris (Mouclass) - C:\WINDOWS\System32\DRIVERS\mouclass.sys
O41 - Driver: MRXSMB (MRxSmb) - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
O41 - Driver: Interface NetBIOS (NetBIOS) - C:\WINDOWS\System32\DRIVERS\netbios.sys
O41 - Driver: NetBT (NetBT) - C:\WINDOWS\System32\DRIVERS\netbt.sys
O41 - Driver: PCLEPCI (PCLEPCI) - C:\WINDOWS\system32\drivers\pclepci.sys
O41 - Driver: Pilote processeur (Processor) - C:\WINDOWS\System32\DRIVERS\processr.sys
O41 - Driver: Pilote de connexion automatique d'accès distant (RasAcd) - C:\WINDOWS\System32\DRIVERS\rasacd.sys
O41 - Driver: Rdbss (Rdbss) - C:\WINDOWS\System32\DRIVERS\rdbss.sys
O41 - Driver: (no object) (RDPCDD) - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
O41 - Driver: Pilote de filtre de lecture digitale de CD audio (redbook) - C:\WINDOWS\System32\DRIVERS\redbook.sys
O41 - Driver: Pilote de port série (Serial) - C:\WINDOWS\System32\DRIVERS\serial.sys
O41 - Driver: Symantec Real Time Storage Protection (PEL) (SRTSPX) - C:\WINDOWS\system32\drivers\NIS\1007020.00B\SRTSPX.SYS
O41 - Driver: Symantec Network Dispatch Driver (SYMTDI) - C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMTDI.SYS
O41 - Driver: Pilote du protocole TCP/IP (Tcpip) - C:\WINDOWS\System32\DRIVERS\tcpip.sys
O41 - Driver: Pilote de périphérique terminal (TermDD) - C:\WINDOWS\System32\DRIVERS\termdd.sys
O41 - Driver: Carte vidéo VGA. (VgaSave) - C:\WINDOWS\System32\drivers\vga.sys

---\\ Logiciels installés (O42)
O42 - Logiciel: 3D!Turbo Experience
O42 - Logiciel: AIM
O42 - Logiciel: AOL - Assistant de désinstallation
O42 - Logiciel: AOL Auto-diagnostic
O42 - Logiciel: AOL Coach Version 1.0(Build:20040229.1 fr)
O42 - Logiciel: AOL Toolbar
O42 - Logiciel: AOL Uninstaller
O42 - Logiciel: Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player Plugin
O42 - Logiciel: Adobe Reader 8.1.2 - Français
O42 - Logiciel: ArcSoft Software Suite
O42 - Logiciel: Assistant de connexion Windows Live
O42 - Logiciel: Digimax Viewer 1.0
O42 - Logiciel: EPSON CardMonitor
O42 - Logiciel: EPSON Copy Utility
O42 - Logiciel: EPSON Logiciel imprimante
O42 - Logiciel: EPSON PRINT Image Framer Tool2.1
O42 - Logiciel: EPSON Photo Print
O42 - Logiciel: EPSON PhotoQuicker3.5
O42 - Logiciel: EPSON PhotoStarter3.1
O42 - Logiciel: EPSON Scan
O42 - Logiciel: EPSON Smart Panel
O42 - Logiciel: ESPRX500 Guide de référence
O42 - Logiciel: ESPRX500 Guide des logiciels
O42 - Logiciel: ESPRX500 Guide fonctionnement
O42 - Logiciel: Ecran de veille AOL Photos
O42 - Logiciel: Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP
O42 - Logiciel: Galerie de photos Windows Live
O42 - Logiciel: Hotfix for Windows Media Format 11 SDK (KB929399)
O42 - Logiciel: Hotfix for Windows XP (KB915865)
O42 - Logiciel: Hotfix for Windows XP (KB926239)
O42 - Logiciel: Installation Windows Live
O42 - Logiciel: Intel(R) PRO Network Adapters and Drivers
O42 - Logiciel: Java(TM) 6 Update 2
O42 - Logiciel: Java(TM) 6 Update 3
O42 - Logiciel: Learn2 Player (Uninstall Only)
O42 - Logiciel: Lecteur Windows Media 11
O42 - Logiciel: Logiciel QuickCam de Logitech
O42 - Logiciel: MSVCRT
O42 - Logiciel: MSXML 4.0 SP2 (KB927978)
O42 - Logiciel: MSXML 4.0 SP2 (KB936181)
O42 - Logiciel: MSXML 4.0 SP2 (KB954430)
O42 - Logiciel: Malwarebytes' Anti-Malware
O42 - Logiciel: MediaRing Talk Release 7.2.026
O42 - Logiciel: Microsoft Choice Guard
O42 - Logiciel: Microsoft Compression Client Pack 1.0 for Windows XP
O42 - Logiciel: Microsoft Data Access Components KB870669
O42 - Logiciel: Microsoft Internationalized Domain Names Mitigation APIs
O42 - Logiciel: Microsoft National Language Support Downlevel APIs
O42 - Logiciel: Microsoft Office Professional Edition 2003
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU]
O42 - Logiciel: Microsoft Silverlight
O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable
O42 - Logiciel: Microsoft Works 7.0
O42 - Logiciel: Microsoft® Winter Fun Pack 2004 for Windows® XP
O42 - Logiciel: NVIDIA Windows 2000/XP Display Drivers
O42 - Logiciel: Nero Suite
O42 - Logiciel: Neuf - Kit de connexion
O42 - Logiciel: Norton Internet Security
O42 - Logiciel: O&O Defrag Professional Edition
O42 - Logiciel: OLITEC PCI V92 Ready V2 Modem
O42 - Logiciel: Outil de téléchargement Windows Live
O42 - Logiciel: PIF DESIGNER2.1
O42 - Logiciel: PixMaker Lite
O42 - Logiciel: PixScreen
O42 - Logiciel: Programme de gestion Camera de Logitech®
O42 - Logiciel: QuickTime
O42 - Logiciel: RealPlayer Basic
O42 - Logiciel: Samsung New PC Studio
O42 - Logiciel: ScanToWeb
O42 - Logiciel: Security Update for CAPICOM (KB931906)
O42 - Logiciel: Segoe UI
O42 - Logiciel: SmartSound Quicktracks Plugin
O42 - Logiciel: SoundMAX
O42 - Logiciel: Symantec Technical Support Web Controls
O42 - Logiciel: TomTom HOME 2.5.2.60
O42 - Logiciel: VC_MergeModuleToMSI
O42 - Logiciel: Viewpoint Media Player
O42 - Logiciel: WebCam PhotoEditor
O42 - Logiciel: Windows Genuine Advantage Notifications (KB905474)
O42 - Logiciel: Windows Genuine Advantage v1.3.0254.0
O42 - Logiciel: Windows Imaging Component
O42 - Logiciel: Windows Installer 3.1 (KB893803)
O42 - Logiciel: Windows Internet Explorer 7
O42 - Logiciel: Windows Live Call
O42 - Logiciel: Windows Live Communications Platform
O42 - Logiciel: Windows Live FolderShare
O42 - Logiciel: Windows Live Messenger
O42 - Logiciel: Windows Live OneCare safety scanner
O42 - Logiciel: Windows Media Format 11 runtime
O42 - Logiciel: Windows Media Player 11
O42 - Logiciel: Windows Resource Kit Tools - SubInAcl.exe
O42 - Logiciel: eMule

---\\ Contenu des dossiers Fichiers Communs (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Ahead
O43 - CFD:Common File Directory ----D- C:\Program Files\AIM95
O43 - CFD:Common File Directory ----D- C:\Program Files\Analog Devices
O43 - CFD:Common File Directory ----D- C:\Program Files\AOL
O43 - CFD:Common File Directory ----D- C:\Program Files\AOL 8.0a
O43 - CFD:Common File Directory ----D- C:\Program Files\AOL 9.0
O43 - CFD:Common File Directory ----D- C:\Program Files\AOL Compagnon
O43 - CFD:Common File Directory ----D- C:\Program Files\AOL Toolbar
O43 - CFD:Common File Directory ----D- C:\Program Files\ArcSoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files
O43 - CFD:Common File Directory ----D- C:\Program Files\ComPlus Applications
O43 - CFD:Common File Directory ----D- C:\Program Files\CONEXANT
O43 - CFD:Common File Directory ----D- C:\Program Files\directx
O43 - CFD:Common File Directory ----D- C:\Program Files\EPSON
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\HighMAT CD Writing Wizard
O43 - CFD:Common File Directory --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Intel
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Labtec
O43 - CFD:Common File Directory ----D- C:\Program Files\Lavasoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Learn2.com
O43 - CFD:Common File Directory ----D- C:\Program Files\Logitech
O43 - CFD:Common File Directory ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD:Common File Directory ----D- C:\Program Files\MarkAny
O43 - CFD:Common File Directory ----D- C:\Program Files\McAfee.com
O43 - CFD:Common File Directory ----D- C:\Program Files\Messenger
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft CAPICOM 2.1.0.2
O43 - CFD:Common File Directory ----D- C:\Program Files\microsoft frontpage
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Works
O43 - CFD:Common File Directory ----D- C:\Program Files\Movie Maker
O43 - CFD:Common File Directory ----D- C:\Program Files\MSI
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Games
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD:Common File Directory ----D- C:\Program Files\MSXML 4.0
O43 - CFD:Common File Directory ----D- C:\Program Files\Multi_Media
O43 - CFD:Common File Directory ----D- C:\Program Files\NetMeeting
O43 - CFD:Common File Directory ----D- C:\Program Files\Neuf
O43 - CFD:Common File Directory ----D- C:\Program Files\Norton AntiVirus
O43 - CFD:Common File Directory ----D- C:\Program Files\Norton Internet Security
O43 - CFD:Common File Directory R--AD- C:\Program Files\Norton Support
O43 - CFD:Common File Directory ----D- C:\Program Files\NortonInstaller
O43 - CFD:Common File Directory ----D- C:\Program Files\Nullsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Oberon Media
O43 - CFD:Common File Directory ----D- C:\Program Files\OO Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Outlook Express
O43 - CFD:Common File Directory ----D- C:\Program Files\PC Connectivity Solution
O43 - CFD:Common File Directory ----D- C:\Program Files\PixAround.com
O43 - CFD:Common File Directory ----D- C:\Program Files\QUAD Utilities
O43 - CFD:Common File Directory ----D- C:\Program Files\QuickTime
O43 - CFD:Common File Directory ----D- C:\Program Files\Real
O43 - CFD:Common File Directory ----D- C:\Program Files\Smart Panel
O43 - CFD:Common File Directory ----D- C:\Program Files\SmartSound Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Spybot - Search & Destroy
O43 - CFD:Common File Directory ----D- C:\Program Files\Symantec
O43 - CFD:Common File Directory ----D- C:\Program Files\TechCity Solutions
O43 - CFD:Common File Directory ----D- C:\Program Files\TomTom HOME 2
O43 - CFD:Common File Directory --H-D- C:\Program Files\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Viewpoint
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Live
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Live Safety Center
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Live SkyDrive
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Connect 2
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows NT
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Resource Kits
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Sidebar
O43 - CFD:Common File Directory --H-D- C:\Program Files\WindowsUpdate
O43 - CFD:Common File Directory ----D- C:\Program Files\xerox
O43 - CFD:Common File Directory ----D- C:\Program Files\Yahoo!
O43 - CFD:Common File Directory ----D- C:\Program Files\ZHPDiag
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Ahead
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\AOL
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\aolback
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\aolshare
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\DESIGNER
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\hncflntj
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\InstallShield
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Logitech
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\MSSoap
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\NSV
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Nullsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Oberon Media
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\ODBC
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\PixAround.com
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Real
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Scanner
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\SpeechEngines
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Symantec Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\System
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Windows Live
O43 - CFD:Common File Directory -SH-D- C:\Program Files\Fichiers Communs\WindowsLiveInstaller
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\System

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:Last File Created 01/11/2009 - 19:46:15 ---A- C:\WINDOWS\ie8_main.log
O44 - LFC:Last File Created 02/11/2009 - 18:11:07 ---A- C:\WINDOWS\win.ini
O44 - LFC:Last File Created 03/11/2009 - 13:27:56 ---A- C:\WINDOWS\SchedLgU.Txt
O44 - LFC:Last File Created 03/11/2009 - 13:28:58 ---A- C:\WINDOWS\System32\oodbs.lor
O44 - LFC:Last File Created 03/11/2009 - 13:29:01 -S-A- C:\WINDOWS\bootstat.dat
O44 - LFC:Last File Created 03/11/2009 - 13:29:21 ---A- C:\WINDOWS\wiaservc.log
O44 - LFC:Last File Created 03/11/2009 - 13:29:25 ---A- C:\WINDOWS\ModemLog_OLITEC PCI V92 Ready V2 Data,Fax Modem.txt
O44 - LFC:Last File Created 03/11/2009 - 13:29:25 ---A- C:\WINDOWS\wiadebug.log
O44 - LFC:Last File Created 03/11/2009 - 13:29:31 ---A- C:\WINDOWS\0.log
O44 - LFC:Last File Created 03/11/2009 - 13:29:42 ---A- C:\WINDOWS\System32\wpa.dbl
O44 - LFC:Last File Created 03/11/2009 - 13:30:15 ---A- C:\WINDOWS\WindowsUpdate.log
O44 - LFC:Last File Created 03/11/2009 - 13:33:23 ---A- C:\WINDOWS\System32\PerfStringBackup.INI
O44 - LFC:Last File Created 03/11/2009 - 13:33:24 ---A- C:\WINDOWS\System32\perfc009.dat
O44 - LFC:Last File Created 03/11/2009 - 13:33:24 ---A- C:\WINDOWS\System32\perfc00C.dat
O44 - LFC:Last File Created 03/11/2009 - 13:33:24 ---A- C:\WINDOWS\System32\perfh009.dat
O44 - LFC:Last File Created 03/11/2009 - 13:33:24 ---A- C:\WINDOWS\System32\perfh00C.dat
O44 - LFC:Last File Created 10/10/2009 - 11:30:42 ---A- C:\WINDOWS\wmsetup10.log
O44 - LFC:Last File Created 14/10/2009 - 13:24:33 ---A- C:\WINDOWS\QTFont.for
O44 - LFC:Last File Created 19/10/2009 - 11:15:25 ---A- C:\WINDOWS\ModemLog_SAMSUNG CDMA Modem.txt
O44 - LFC:Last File Created 25/10/2009 - 11:24:38 ---A- C:\WINDOWS\KB956844.log
O44 - LFC:Last File Created 25/10/2009 - 11:27:57 ---A- C:\WINDOWS\KB971557.log
O44 - LFC:Last File Created 25/10/2009 - 11:30:47 ---A- C:\WINDOWS\KB971657.log
O44 - LFC:Last File Created 25/10/2009 - 11:32:26 ---A- C:\WINDOWS\KB973507.log
O44 - LFC:Last File Created 25/10/2009 - 11:34:19 ---A- C:\WINDOWS\KB973540.log
O44 - LFC:Last File Created 25/10/2009 - 12:09:40 ---A- C:\WINDOWS\KB932823-v3.log
O44 - LFC:Last File Created 25/10/2009 - 12:25:01 ---A- C:\WINDOWS\KB951748.log
O44 - LFC:Last File Created 25/10/2009 - 12:48:17 ---A- C:\WINDOWS\wmsetup.log
O44 - LFC:Last File Created 25/10/2009 - 12:48:37 ---A- C:\WINDOWS\Q828026.log
O44 - LFC:Last File Created 25/10/2009 - 13:00:45 ---A- C:\WINDOWS\xpsp1hfm.log
O44 - LFC:Last File Created 25/10/2009 - 14:14:34 ---A- C:\WINDOWS\DPINST.LOG
O44 - LFC:Last File Created 25/10/2009 - 14:44:05 ---A- C:\WINDOWS\KB954708.log
O44 - LFC:Last File Created 25/10/2009 - 14:44:12 ---A- C:\WINDOWS\DirectX.log
O44 - LFC:Last File Created 25/10/2009 - 15:34:04 ---A- C:\WINDOWS\updspapi.log
O44 - LFC:Last File Created 25/10/2009 - 15:34:27 ---A- C:\WINDOWS\KB974455-IE7.log
O44 - LFC:Last File Created 25/10/2009 - 15:38:55 ---A- C:\WINDOWS\KB973525.log
O44 - LFC:Last File Created 25/10/2009 - 15:38:55 ---A- C:\WINDOWS\imsins.BAK
O44 - LFC:Last File Created 25/10/2009 - 15:45:20 ---A- C:\WINDOWS\FaxSetup.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:20 ---A- C:\WINDOWS\msgsocm.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:20 ---A- C:\WINDOWS\ocgen.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\KB971486.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\comsetup.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\iis6.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\imsins.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\ntdtcsetup.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\ocmsn.log
O44 - LFC:Last File Created 25/10/2009 - 15:45:23 ---A- C:\WINDOWS\tsoc.log
O44 - LFC:Last File Created 25/10/2009 - 15:50:28 ---A- C:\WINDOWS\KB885894.log
O44 - LFC:Last File Created 25/10/2009 - 15:51:46 ---A- C:\WINDOWS\KB884020.log
O44 - LFC:Last File Created 25/10/2009 - 16:07:44 ---A- C:\WINDOWS\ODBC.INI
O44 - LFC:Last File Created 25/10/2009 - 16:13:56 ---A- C:\WINDOWS\System32\FNTCACHE.DAT
O44 - LFC:Last File Created 27/10/2009 - 12:22:46 --HA- C:\WINDOWS\QTFont.qfn
O44 - LFC:Last File Created 28/10/2009 - 17:54:34 ---A- C:\WINDOWS\msicpl.ini
O44 - LFC:Last File Created 29/10/2009 - 23:48:09 ---A- C:\WINDOWS\NeroDigital.ini
O44 - LFC:Last File Created 30/10/2009 - 16:00:00 ---A- C:\WINDOWS\Windows Update.log
O44 - LFC:Last File Created 30/10/2009 - 16:00:12 ---A- C:\WINDOWS\System32\amcompat.tlb
O44 - LFC:Last File Created 30/10/2009 - 16:00:12 ---A- C:\WINDOWS\System32\nscompat.tlb
O44 - LFC:Last File Created 30/10/2009 - 16:00:28 ---A- C:\WINDOWS\bitssetup.log
O44 - LFC:Last File Created 30/10/2009 - 19:23:28 ---A- C:\WINDOWS\ntbtlog.txt
O44 - LFC:Last File Created 30/10/2009 - 19:25:23 ---A- C:\WINDOWS\setupact.log
O44 - LFC:Last File Created 30/10/2009 - 20:33:37 ---A- C:\WINDOWS\setupapi.log

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll

---\\ Export de clé d'application autorisée (ECAA)(O47)
O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
O47 - AAKE:Key Export SP - "C:\Program Files\AIM95\aim.exe"="C:\Program Files\AIM95\aim.exe:*:Enabled:AOL Instant Messenger"
O47 - AAKE:Key Export SP - "E:\kazaa.exe"="E:\kazaa.exe:*:Disabled:Kazaa Media Desktop"
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\P2P Networking\P2P Networking.exe"="C:\WINDOWS\system32\P2P Networking\P2P Networking.exe:*:Disabled:P2P Networking"
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE"="C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE:*:Disabled:SAgent4"
O47 - AAKE:Key Export SP - "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Disabled:Yahoo! FT Server"
O47 - AAKE:Key Export SP - "C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Disabled:Yahoo! Messenger"
O47 - AAKE:Key Export SP - "C:\Program Files\WinMX\WinMX.exe"="C:\Program Files\WinMX\WinMX.exe:*:Enabled:WinMX Application"
O47 - AAKE:Key Export SP - "E:\eMule\emule.exe"="E:\eMule\emule.exe:*:Enabled:eMule"
O47 - AAKE:Key Export SP - "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"
O47 - AAKE:Key Export SP - "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
O47 - AAKE:Key Export SP - "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
O47 - AAKE:Key Export SP - "C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL Autoconnect"
O47 - AAKE:Key Export SP - "C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:module de connexion AOL"
O47 - AAKE:Key Export SP - "C:\Program Files\Fichiers communs\AOL\1135543833\ee\aolsoftware.exe"="C:\Program Files\Fichiers communs\AOL\1135543833\ee\aolsoftware.exe:*:Enabled:AOL Shared Components"
O47 - AAKE:Key Export SP - "E:\LimeWire\LimeWire.exe"="E:\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
O47 - AAKE:Key Export SP - "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40.exe:*:Enabled:@xpsp2res.dll,-22005"
O47 - AAKE:Key Export SP - "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22.exe:*:Enabled:@xpsp2res.dll,-22005"
O47 - AAKE:Key Export SP - "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\28.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\28.exe:*:Enabled:@xpsp2res.dll,-22005"
O47 - AAKE:Key Export SP - "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\56.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\56.exe:*:Enabled:@xpsp2res.dll,-22005"
O47 - AAKE:Key Export SP - "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\84.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\84.exe:*:Enabled:@xpsp2res.dll,-22005"
O47 - AAKE:Key Export SP - "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
O47 - AAKE:Key Export SP - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
O47 - AAKE:Key Export SP - "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
O47 - AAKE:Key Export DP - "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"
O47 - AAKE:Key Export DP - "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
O47 - AAKE:Key Export DP - "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
O47 - AAKE:Key Export DP - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
O47 - AAKE:Key Export DP - "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"

---\\ Déni du service (Local Security Authority) (LSA) (O48)
O48 - LSA:Local Security Authority Authentication Packages - C:\WINDOWS\System32\msv1_0.dll

---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\SymEFA.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\SymEFA.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\SymEFA.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vgasave.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\SymEFA.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vgasave.sys

---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d

---\\ MountPoints2 Shell Key (MPSK) (O51)
O51 - MPSK:{77112afa-ae17-11db-bc03-00038a000015}\Shell\AutoRun\command - G:\InstallTomTomHOME.exe

---\\ Trojan Driver Search Data (TDSD) (O52)
O52 - TDSD:HKLM\...\Drivers\"timer"="timer.drv"
O52 - TDSD:HKLM\...\Drivers32\"midimapper"="midimap.dll"
O52 - TDSD:HKLM\...\Drivers32\"msacm.imaadpcm"="imaadp32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msadpcm"="msadp32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msg711"="msg711.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msgsm610"="msgsm32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.trspch"="tssoft32.acm"
O52 - TDSD:HKLM\...\Drivers32\"vidc.cvid"="iccvid.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv31"="ir32_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv32"="ir32_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.IYUV"="iyuv_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.mrle"="msrle32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.msvc"="msvidc32.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.UYVY"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.YUY2"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.YVU9"="tsbyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.YVYU"="msyuv.dll"
O52 - TDSD:HKLM\...\Drivers32\"wavemapper"="msacm32.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msg723"="msg723.acm"
O52 - TDSD:HKLM\...\Drivers32\"vidc.M263"="msh263.drv"
O52 - TDSD:HKLM\...\Drivers32\"vidc.M261"="msh261.drv"
O52 - TDSD:HKLM\...\Drivers32\"msacm.msaudio1"="msaud32.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.sl_anet"="sl_anet.acm"
O52 - TDSD:HKLM\...\Drivers32\"msacm.l3acm"="C:\WINDOWS\System32\l3codeca.acm"
O52 - TDSD:HKLM\...\Drivers32\"wave"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"midi"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"mixer"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"MIDI1"="SYNCOR11.DLL"
O52 - TDSD:HKLM\...\Drivers32\"wave1"="serwvdrv.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.CJPG"="ctwbjpg.dll"
O52 - TDSD:HKLM\...\Drivers32\"MSVideo8"="VfWWDM32.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.MPG4"="mpg4c32.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.MP42"="mpg4c32.dll"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.MP43"="mpg4c32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv50"="ir50_32.dll"
O52 - TDSD:HKLM\...\Drivers32\"vidc.iv41"="ir41_32.ax"
O52 - TDSD:HKLM\...\Drivers32\"MSVideo"="vfwwdm32.dll"
O52 - TDSD:HKLM\...\Drivers32\"wave2"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"midi2"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"mixer1"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"aux"="wdmaud.drv"
O52 - TDSD:HKLM\...\Drivers32\"VIDC.WMV3"="wmv9vcm.dll"
O52 - TDSD:HKLM\...\Drivers32\"msacm.siren"="sirenacm.dll"
O52 - TDSD:HKLM\...\drivers.desc\"msaud32.acm"="Windows Media Audio"
O52 - TDSD:HKLM\...\drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec"
O52 - TDSD:HKLM\...\drivers.desc\"C:\WINDOWS\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec"
O52 - TDSD:HKLM\...\drivers.desc\"wdmaud.drv"="Périphérique audio USB"
O52 - TDSD:HKLM\...\drivers.desc\"SYNCOR11.DLL"="SoundMAX Wavetable Synth"
O52 - TDSD:HKLM\...\drivers.desc\"serwvdrv.dll"="Pilote de porteuse modem"
O52 - TDSD:HKLM\...\drivers.desc\"vfwwdm32.dll"="Vidéo WDM pour le pilote de capture Windows (Win32)"
O52 - TDSD:HKLM\...\drivers.desc\"mpg4c32.dll"="Microsoft MPEG-4 Video Codec v3"
O52 - TDSD:HKLM\...\drivers.desc\"ir32_32.dll"="Indeo® video R3.2 by Intel"
O52 - TDSD:HKLM\...\drivers.desc\"ir41_32.ax"="Indeo® video interactive R4.3 by Intel"
O52 - TDSD:HKLM\...\drivers.desc\"ir50_32.dll"="Indeo® video 5.10"
O52 - TDSD:HKLM\...\drivers.desc\"iyvu9_32.dll"="Indeo® video Raw YVU9 by Intel"
O52 - TDSD:HKLM\...\drivers.desc\"C:\WINDOWS\system32\Iac25_32.ax"="Indeo® audio software"
O52 - TDSD:HKLM\...\drivers.desc\"wmv9vcm.dll"="Microsoft Windows Media Video 9 VCM"
O52 - TDSD:HKLM\...\drivers.desc\"sirenacm.dll"="Messenger Audio Codec"

---\\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=2

---\\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\Policies\Explorer] - "NoDriveTypeAutoRun"=

---\\ Liste des Drivers Système (SDL) (O58)
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\1394bus.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\61883.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acpi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\acpiec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aeaudio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\aec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\afd.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\agp440.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amdk6.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amdk7.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\amosnt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\arp1394.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\asctrm.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\asyncmac.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmarpc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmepvc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmlane.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atmuni.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atwpkt2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\atwpkt264.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\audstub.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\avc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\basic2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\beep.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\bridge.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cbidf2k.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ccdecode.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdaudio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdfs.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdr4_2K.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdralw2k.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cdrom.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cinemst2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\classpnp.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cnxtdiag.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\cpqdap01.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\crusoe.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\disk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\diskdump.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmboot.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmio.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmload.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dmusic.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\drmk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\drmkaud.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxapi.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxg.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\dxgthk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\e100b325.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\enum1394.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fallback.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fastfat.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\faxnt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fdc.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fips.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\flpydisk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fsksnt.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fsvga.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\fs_rec.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\ftdisk.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidclass.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidparse.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\hidusb.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_AMOS.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_BSC2.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_CNXT.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_FALL.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\drivers\HSF_FAXX.sys
O58 - SDL:System Drivers List - C:\WINDOWS\system32\driv

Rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:34:53, on 03/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = ?
O4 - Global Startup: 3D!Turbo Experience.lnk = C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mcqkg.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mcqkg.dll
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: F-Secure Management Agent (FSMA) - Conexant Systems - (no file)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Voici le log

03/11/2009 ---- 15:39:19,54

----------------------------------
§§§§§§ [mcqkg] §§§§§§
----------------------------------
[X] Registre
[ ] Fichier (rapide)
[ ] Fichier (disque systeme)
[X] Fichier (complete)




********************
[Registre]
********************


[HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"001"="mcqkg.dll"

[HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"i"="C:\\Documents and Settings\\Propriétaire\\Bureau\\MCQKG.txt"

[HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"a"="C:\\Documents and Settings\\Propriétaire\\Mes documents\\mcqkg.dll"

[HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\txt]
"j"="C:\\Documents and Settings\\Propriétaire\\Bureau\\MCQKG.txt"

*******************
[Fichier]
*******************

c:\Documents and Settings\Propri‚taire\Mes documents\mcqkg.dll
c:\Documents and Settings\Propri‚taire\Recent\MCQKG.txt.lnk
c:\WINDOWS\system32\mcqkg.dll


*********************
[Même date]
*********************

C:\Photos
C:\pagefile.sys
C:\Program
C:\VETlog.dmp
C:\VETlog.txt
C:\WINDOWS\0.log
C:\WINDOWS\bootstat.dat
C:\WINDOWS\Fonts
C:\WINDOWS\ModemLog_OLITEC
C:\WINDOWS\Prefetch
C:\WINDOWS\SchedLgU.Txt
C:\WINDOWS\system32
C:\WINDOWS\Temp
C:\WINDOWS\wiadebug.log
C:\WINDOWS\wiaservc.log
C:\WINDOWS\win.ini
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\popcinfo.dat
C:\WINDOWS\system32\.
C:\WINDOWS\system32\..
C:\WINDOWS\system32\drivers
C:\WINDOWS\system32\oodbs.lor
C:\WINDOWS\system32\perfc009.dat
C:\WINDOWS\system32\perfc00C.dat
C:\WINDOWS\system32\perfh009.dat
C:\WINDOWS\system32\perfh00C.dat
C:\WINDOWS\system32\PerfStringBackup.INI
C:\WINDOWS\system32\wpa.dbl
C:\WINDOWS\system32\bkdkfrg.dll
C:\WINDOWS\system32\mcqkg.dll
C:\WINDOWS\system32\drivers\.
C:\WINDOWS\system32\drivers\..



----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

Merci

mjlb

cop/col virus total


Fichier bkdkfrg.dll reçu le 2009.11.03 14:54:10 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.03 Trojan.Generic!IK
AhnLab-V3 5.0.0.2 2009.11.03 Win-Trojan/Xema.variant
AntiVir 7.9.1.53 2009.11.03 TR/Healsock.A.2
Antiy-AVL 2.0.3.7 2009.11.03 -
Authentium 5.1.2.4 2009.11.03 -
Avast 4.8.1351.0 2009.11.03 Win32:Trojan-gen
AVG 8.5.0.423 2009.11.03 -
BitDefender 7.2 2009.11.03 Trojan.Generic.2253255
CAT-QuickHeal 10.00 2009.11.03 Trojan.Healsock
ClamAV 0.94.1 2009.11.03 -
Comodo 2827 2009.11.03 UnclassifiedMalware
DrWeb 5.0.0.12182 2009.11.03 -
eSafe 7.0.17.0 2009.11.03 -
eTrust-Vet 35.1.7099 2009.11.03 -
F-Prot 4.5.1.85 2009.11.02 -
F-Secure 9.0.15370.0 2009.10.30 Trojan.Generic.2253255
Fortinet 3.120.0.0 2009.11.03 -
GData 19 2009.11.03 Trojan.Generic.2253255
Ikarus T3.1.1.72.0 2009.11.03 Trojan.Generic
Jiangmin 11.0.800 2009.11.03 -
K7AntiVirus 7.10.886 2009.11.02 Trojan.Win32.Malware
Kaspersky 7.0.0.125 2009.11.03 -
McAfee 5790 2009.11.02 Generic BackDoor.t
McAfee+Artemis 5790 2009.11.02 Generic BackDoor.t
McAfee-GW-Edition 6.8.5 2009.11.03 Heuristic.BehavesLike.Win32.Suspicious.L
Microsoft 1.5202 2009.11.03 Trojan:Win32/Healsock
NOD32 4568 2009.11.03 Win32/AdProt.AC
Norman 6.03.02 2009.11.03 W32/Healsock.A
nProtect 2009.1.8.0 2009.11.03 -
Panda 10.0.2.2 2009.11.02 -
PCTools 7.0.3.5 2009.11.03 -
Prevx 3.0 2009.11.03 High Risk System Back Door
Rising 21.54.14.00 2009.11.03 -
Sophos 4.47.0 2009.11.03 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.11.02 -
Symantec 1.4.4.12 2009.11.03 -
TheHacker 6.5.0.2.059 2009.11.03 -
TrendMicro 8.950.0.1094 2009.11.03 -
VBA32 3.12.10.11 2009.11.02 -
ViRobot 2009.11.3.2019 2009.11.03 -
VirusBuster 4.6.5.0 2009.11.03 Trojan.Healsock.D
Information additionnelle
File size: 86016 bytes
MD5...: 4e250fbd84097dac8effb426374bfc7b
SHA1..: 4e4b6ae7634a414ac7f2ec72c28f08036ec16b26
SHA256: afea2ab4e85d5f1e04e45384d52d85e7f7172a936981d85cfb45b3243af98cec
ssdeep: 1536:g8+ybMbsYUqxPxlsWJDsNMmGn5RRrjJBdiPl5UYxV:gZBmqxp9oX+xX4Pl5
U8V

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x94ab
timedatestamp.....: 0x49232876 (Tue Nov 18 20:41:26 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xdca4 0xe000 6.66 732c1b618ba0e4808f4f3835def91562
.rdata 0xf000 0x2847 0x3000 4.39 c2f48b1f784efbd364d96881260c050e
.data 0x12000 0x1640 0x1000 2.20 f8c36145dd6aeb7a5b608ca95cb4794b
.reloc 0x14000 0x14f6 0x2000 3.28 6d5ed2db75ba5953f99b3858f87f70a1

( 4 imports )
> KERNEL32.dll: InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, CloseHandle, WriteFile, CreateFileA, DeleteFileA, CreateDirectoryA, Sleep, GetTickCount, GetEnvironmentVariableA, InterlockedExchange, GetACP, GetLocaleInfoA, GetThreadLocale, GetVersionExA, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GlobalFree, FreeLibrary, GetProcAddress, LoadLibraryA, lstrlenW, lstrlenA, HeapAlloc, GetProcessHeap, HeapDestroy, HeapFree, TerminateThread, GetCurrentThread, SetUnhandledExceptionFilter, GetModuleFileNameA, LoadLibraryW, ExpandEnvironmentStringsW, HeapCreate, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, RtlUnwind, RaiseException, GetCurrentThreadId, GetCommandLineA, TlsAlloc, SetLastError, GetLastError, TlsFree, TlsSetValue, TlsGetValue, GetModuleHandleA, VirtualFree, VirtualAlloc, HeapReAlloc, IsBadWritePtr, ExitProcess, TerminateProcess, GetCurrentProcess, HeapSize, LCMapStringA, LCMapStringW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, GetOEMCP, GetCPInfo, VirtualQuery, VirtualProtect, GetSystemInfo, GetStringTypeA, GetStringTypeW
> USER32.dll: wsprintfA
> WS2_32.dll: WSCInstallProvider, WSCEnumProtocols, -, -, WSCGetProviderPath
> RPCRT4.dll: UuidCreate

( 4 exports )
DllMain, DllRegisterServer, DllUnregisterServer, WSPStartup

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=52A963A80098D57450C0015F04F690008770672D' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=52A963A80098D57450C0015F04F690008770672D</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

adresse ci-joint:
http://www.cijoint.fr/cjlink.php?file=cj200911/cij5qz41db.txt

log Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:23:18, on 03/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = ?
O4 - Global Startup: 3D!Turbo Experience.lnk = C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mcqkg.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mcqkg.dll
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: F-Secure Management Agent (FSMA) - Conexant Systems - (no file)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Bonjour
J'ai pris l'initiative d'envoyer une analyse Hijackthis fraiche de ce matin.
Pour info, aucune promenade sur internet depuis l'intervention. sauf sur ce forum.
Merci encore
mjlb



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:19:32, on 04/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = ?
O4 - Global Startup: 3D!Turbo Experience.lnk = C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mcqkg.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mcqkg.dll
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: F-Secure Management Agent (FSMA) - Conexant Systems - (no file)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

merci beaucoup

Juste un question avant de démarrer cette manip.
Ce matin en regardant le log hijackthis, j'ai fait analyser la ligne par virus total
C:\WINDOWS\System32\MsPMSPSv.exe

Virus total m'informe de ceci:

McAfee-GW-Edition 6.8.5 2009.11.04 Heuristic.BehavesLike.Win32.Obfuscated.L

Est-ce un virus?

merci
Joël

Je viens de finir l'opération Ccleaner

J'ai téléchargé combofix
Avant de démarrer cette manip pouvez vous m'expliquer
"Reconnecte toi avant de cliquer sur "yes", et uniquement le temps de cette manipulation".
Je me reconnecte ou? uniquement ouvrir internet explorer?

merci
mjlb (grand-père) ;-)

Ici le rapport Combofix
Tout s'est bien passé, aucun souci

ComboFix 09-11-03.03 - Propriétaire 04/11/2009 13:21.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.511.211 [GMT 1:00]
Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Propri‚taire\Mes documents\cc_20091104_113816.reg
c:\program files\QUAD Utilities
c:\windows\Readme.txt
c:\windows\system32\Sp3.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASC3550P


((((((((((((((((((((((((((((( Fichiers créés du 2009-10-04 au 2009-11-04 ))))))))))))))))))))))))))))))))))))
.

2009-11-04 10:33 . 2009-11-04 10:33 -------- d-----w- c:\program files\CCleaner
2009-11-03 15:18 . 2009-11-03 17:33 -------- d-----w- C:\ToolBar SD
2009-11-03 09:39 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-03 09:39 . 2009-11-03 09:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-03 09:39 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-03 09:39 . 2009-11-03 09:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-02 17:44 . 2009-11-02 17:48 -------- d-----w- c:\program files\ZHPDiag
2009-11-02 11:06 . 2009-11-02 11:06 -------- d-----w- C:\Photos sur AOL
2009-10-30 14:58 . 2009-11-04 12:20 -------- d-----w- c:\windows\system32\CatRoot2
2009-10-29 18:24 . 2009-10-29 18:24 -------- d-----w- C:\AULOGS
2009-10-25 15:01 . 2009-10-25 15:01 -------- d-----r- C:\MSOCache
2009-10-25 14:32 . 2009-08-29 07:28 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-25 14:32 . 2009-08-29 07:28 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-25 14:32 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2009-10-25 14:32 . 2009-08-29 07:28 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2009-10-25 14:32 . 2009-08-28 10:28 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2009-10-25 14:32 . 2009-08-29 07:28 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-25 14:32 . 2009-08-29 07:28 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2009-10-25 14:32 . 2009-08-29 07:28 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-25 13:43 . 2009-10-25 13:43 -------- d-----w- c:\program files\Microsoft
2009-10-25 13:42 . 2009-10-25 13:42 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-10-25 10:37 . 2009-10-25 11:32 -------- d-----w- C:\15574e37d2f3c399c1b24bd7745b
2009-10-20 20:50 . 2009-10-20 20:50 -------- d---a-r- c:\program files\Norton Support
2009-10-19 09:58 . 2009-10-19 09:58 -------- d-----w- c:\program files\MarkAny
2009-10-19 09:58 . 2009-10-19 09:58 -------- d-----w- c:\program files\PC Connectivity Solution
2009-10-19 09:54 . 2009-10-19 09:52 99516416 ----a-w- C:\Samsung New PC Studio.msi

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-04 09:10 . 2003-04-24 12:00 52688 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-04 09:10 . 2003-04-24 12:00 376044 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-25 15:13 . 2009-04-26 08:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-25 13:44 . 2007-12-05 14:09 -------- d-----w- c:\program files\Windows Live
2009-10-25 13:43 . 2007-12-05 14:09 -------- dcsh--w- c:\program files\Fichiers communs\WindowsLiveInstaller
2009-10-25 13:20 . 2007-12-05 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-10-19 11:18 . 2004-02-01 00:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-11 11:44 . 2009-09-08 12:25 -------- d-----w- c:\program files\Symantec
2009-09-11 11:44 . 2009-09-08 12:25 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-09-11 11:44 . 2009-09-08 12:25 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-09-11 11:44 . 2009-09-08 12:25 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-09-11 11:44 . 2009-09-08 12:25 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-09-08 16:34 . 2009-09-08 16:34 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-09-08 12:50 . 2004-02-21 13:04 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-09-08 12:25 . 2009-09-08 12:24 -------- d-----w- c:\program files\Norton Internet Security
2009-09-08 12:24 . 2009-09-08 12:24 -------- d-----w- c:\program files\Windows Sidebar
2009-09-08 12:24 . 2009-09-02 10:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-09-08 12:24 . 2009-09-08 12:24 -------- d-----w- c:\program files\NortonInstaller
2009-08-29 07:28 . 2004-08-23 18:35 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2004-08-19 23:09 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2003-04-24 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-22 07:21 . 2009-09-08 12:25 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-06 18:24 . 2004-08-14 12:41 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 18:24 . 2005-05-26 02:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 18:24 . 2004-08-14 12:41 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 18:24 . 2004-01-31 23:52 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 18:24 . 2003-04-24 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 18:23 . 2004-08-14 12:41 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 18:23 . 2004-01-31 23:52 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-06 18:23 . 2007-12-06 03:26 215904 ----a-w- c:\windows\system32\muweb.dll
2005-12-17 09:17 . 2005-12-17 09:17 278528 ----a-w- c:\program files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-03-24 98304]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
3D!Turbo Experience.lnk - c:\program files\MSI\3D!Turbo Experience\3D!Turbo.exe [2004-1-31 94208]
AOL 9.0 Ic“ne AOL.lnk - c:\program files\AOL 9.0\aoltray.exe [2004-5-27 156784]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM95\\aim.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"e:\\eMule\\emule.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Fichiers communs\\AOL\\1135543833\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [10/09/2009 09:33 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [10/09/2009 09:33 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [10/09/2009 09:32 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091102.002\IDSXpx86.sys [28/10/2009 23:37 329592]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [10/09/2009 09:33 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [07/09/2009 09:00 102448]
S3 CtlCam;Video Blaster WebCam Go Plus (WDM);c:\windows\system32\drivers\Wcgopvid.sys [02/02/2004 15:51 90211]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*Deregistered* - mbr
.
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\PCHealth\HelpCtr\System\panels\blank.htm
mWindow Title =
uInternet Settings,ProxyOverride = localhost
LSP: c:\windows\system32\mcqkg.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
Notify-dimsntfy - (no file)
AddRemove-Notification de cadeaux MSN - c:\documents and settings\Propriétaire\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-04 13:33
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\System32\\FM20ENU.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="AADA404FBED3078E6BBFE976EB44BFF4F77F18602EE2F2700FD046B0D51FBBEBAD81C06E938BDDADD03466356AA2F05102AABC7ADEA25BD33CAB56DF05ECA0AA196B86945401FB73D40EE54757804F289B33A52A1DCA5FEDA996B785869B5E70403D3ED7D8C747C8E036D28CAF81907960E19CB9ACAEA1F8C95DB07402CFA3CE0964493650769CB86F56CCCA474C5CE883431AD5A3A737D1238BB6E3F6B3957C6FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667C038D530D6EB34528EDD5E5BE2F6E66708A31DDA42167AF104E7AFEE5B16A1D4D676823515E560BFB92BFC8F848D35CFFAA504F3D4E5887EA4F00FB2EE230293A2F749132CAE7464884743B72254D867D8A4B7D7744456906AEFDBC93ED5600553D9C25A072D609A676CD0734BA1EC28C5D43C18107D1A257B93A2AA0B0B4C9B2EEAA584D8E92A6A5CA125E1C449934FA99D7C979D562DCEC043D59B1B0FF6DFBD2B8E5F58E1FDEEB32826F4561491AEB01B458D15818DB36695CC3BB727B8EB5151FA0C3F04ABDAFB729A754ABF4EAACB1DC707732BDD0E5D5842792F0B8BEEF8C6D0014D35A7708825307BF1FC573EAD251963387063AC5D8B531BD3E210AD0C28D409C34C0909EF9C75F61FF0DEF450EC33D46A630871DBE203B9F8CF077D2448343FEA958D108E67E0ABABB3B7F0ED5E73E4110BD9531AC7B741FA65D8CA9FACFC180C5192060346492FF1D3DC6708991BEF39E00C5C16D6BBF235280F14A18CA45876341D80AF316CEB5152E8A0E2734F2473D2F1A995603EE38A15DAED0F5800197CE4D5263D536AA12E221F7C85719A05D3C186ED226950FBE01C0D7E12AFCC49768007B31588C5E26F2E63693DD0686CF38569700A2968F7201D1C0199E929A93C17A27967E5E91702D23EED19FE8B04EF68DA8B5C0DE26A387125C5D70F19512E2C3A5C28B021F7D3E15CA36EA1B94C6826BFABEF36FBB59963E5AF42DC83292FB708538CE41D15D99F8F37D38F0B1A037224555C7757143A33C1B592C5B3EDA4A6E6EC90AFF0CF8AC4CC6927537E1467F2351D005B7A1213123EE2C8ECD9337A5856C6737316DFE2FE2C1288AD73364242432E7B9DD08F232808D6A42E08DD1F20F99639C669D0E26FEB175A92B1CF446DC6C634AD27426A8F6CC42F97382884461BA3A7F4A9800C2A6BF7C5A76185A1F65839D3B1B1B3EFD8607430E8C29F2188A4CBCA7CFB22683AAF4438C98FCF155536EAC601863FBD8578C0B518E7A57015A6FD710F68BB819962A3DE082D7759F0C1D63D291F955F0D7018934E4DEF7111553FAE14DCA8E83CD0CC3127919FAEAA828B2FE9DABCE75BA800DF6AF689A51409A75AA528183006E910651D74BA5BD19F2BD2B77B8D6C4EA1"
"OODEFRAG10.00.00.01WORKSTATION"="BA35D7998A3BDFC20D6CFC434D98B6D6D589270EAAF52EFB2B1E28E91E7AFC7B5D941904C579AE2E6EE43E96580852778416F519ABEDB29782963FB64BE01E4E9FDD4B96A28F47481CE39C712B8227E0F963BD813B428131CEEC023357DBE6F2A1CD57309C24D332D846ABBAB35B59C7B9885AD2D89558AF7494342F72FB4CA6C8D30D083852249D2A96632BE55AAFF30A510DEA8A7B17911D357FCFD142FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6171C11EC38DE3D9DB7CE019D40AA5CFA1F276D08FBEABE2B9BAB0876D7D15C9CA90B374B6391899D9D0BD855F64CDA83C654B8E673DAD225FE3CA9167D9F60638CA5E21200712B4B506FBA010A903134497327F7F7AA2F86E313167AE473E0FE97578C8CF9CF0E88DCA02156840162AD6861BB56DFF5A00B4070ACA4AA1D185F17E2114552C976A203038586EAADE2B2F6432C7DD5DD688D9B57817ABEE9B39AE74D00A95E012207943A15AB16289AACDE7F634D5A06BA101612DB456531566CFBDE1F0DC61B3E487A33313F3589E4259A410089BD15C1375EACB7B135C815B0DAA4662607C1EF9EAE9AEEA14968134E3B78545C28B71BCB3A7543511B107A6B9EF0810EF0A34C6441629915A866E77A64D7E6D1131C55BA0402631B566605C0F458D1C32B705E18D5412E42FC261C23CFD5F159CFF67793A8AAAFE57AAF267A9F336CAA2BDFA65DA1B1DBB3C2CCDBE2482DE448FE00798D2889F1F16F56C308F52098883EA9167AF2F00BD84D064679AEDE61569772C98119812B5D7046B8F9E1005386870D965A2781D3854280704C772D3F20658E476AA5358FB08F6F51076177CCB4F94A808C31AA04F01B6EE0E12B1F08A707974AE9090D8454AD475209086EEA845E2824431AF39D36A50616E66500794EEE5518459435A79404C5EEFC7914C54C52EF4455FAAED5560303FD2B56DF07DDE292EFE4AF1EC6249EE853067359A84746EE973F05EA9632A924FDA1C20FD784FEA0825751FA6797DCB01CE841721593FEF74A9D7A7F7B9363AAEC638228454FB151F34B08C43F68F121DC10C6593FB3945FF935B20658A34EDE972D03045EB53E7DDE97F5B73A74E5421989F84A908D75003AEA995D31F3DB893DDB4343E58DBA01CE334D53F7FC95A2CC88E3C723EC60B5924C2E2741F5D17B1375D7C7529591BAC5BCDA5DCC27AF5266DF24164A7D6BE37D85034AF4034986BFA2E8B94DEC030EB8F379DB3F7CB865468B6D3E0AD3FD6FE96BC06F6D55B080602D3383B59820E410BD1C9C0B6B087543A9050D1A65D742BB742186810C4A44058607541FFED0272924C62EA043C89EA87B4694E60E864A493B74C0392B2B323141C89F4F6FCF4854539366A2BA7B01B1E59E"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(4008)
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\oodag.exe
c:\program files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\SAgent4.exe
c:\windows\wanmpsvc.exe
c:\windows\System32\MsPMSPSv.exe
c:\windows\system32\fxssvc.exe
c:\program files\MSI\3D!Turbo Experience\zoo.exe
c:\windows\system32\dwwin.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\locator.exe
.
**************************************************************************
.
Heure de fin: 2009-11-04 13:37 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-04 12:37

Avant-CF: 62 210 166 784 octets libres
Après-CF: 62 091 395 072 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn

encore merci pour votre aide
mjlb

dernier hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:15:20, on 04/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = ?
O4 - Global Startup: 3D!Turbo Experience.lnk = C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: F-Secure Management Agent (FSMA) - Conexant Systems - (no file)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Bonne nouvelle

Des mises à jour windows sont en train de s'installer.
Après un redémarrage 15 sont déjà passées et d'autres en cours
mjlb.

41 mises à jour effectuées ordi redémarré

A priori c'est terminé

mjlb

rapport zhpdiag
http://www.cijoint.fr/cjlink.php?file=cj200911/cijNRTZ3rt.txt

cop/col OTM

All processes killed
========== REGISTRY ==========
Registry key HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603 not found.
Registry value HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\\i not found.
Registry key HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll not found.
Registry value HKEY_USERS\S-1-5-21-1547161642-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\txt\\j not found.
========== FILES ==========
LoadLibrary failed for c:\Documents and Settings\Propriétaire\Mes documents\mcqkg.dll
c:\Documents and Settings\Propriétaire\Mes documents\mcqkg.dll NOT unregistered.
c:\Documents and Settings\Propriétaire\Mes documents\mcqkg.dll moved successfully.
File/Folder c:\Documents and Settings\Propriétaire\Recent\MCQKG.txt.lnk not found.
c:\WINDOWS\system32\mcqkg.dll unregistered successfully.
c:\WINDOWS\system32\mcqkg.dll moved successfully.
C:\WINDOWS\system32\bkdkfrg.dll unregistered successfully.
C:\WINDOWS\system32\bkdkfrg.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrateur.3RYAWS5G5O8YV54
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 49286 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: Propriétaire
->Temp folder emptied: 10493008 bytes
File delete failed. C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 268368 bytes
->Java cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\038A524F58DB438A83918F7F0CA14B9E.TMP folder deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
%systemroot% .tmp files removed: 1577703 bytes
%systemroot%\System32 .tmp files removed: 3614208 bytes
File delete failed. C:\WINDOWS\temp\JET3F27.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_270.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 1395780 bytes
RecycleBin emptied: 197472 bytes

Total Files Cleaned = 16,89 mb


OTM by OldTimer - Version 3.0.0.6 log created on 11042009_163031

Files moved on Reboot...
File C:\WINDOWS\temp\JET3F27.tmp not found!
File C:\WINDOWS\temp\Perflib_Perfdata_270.dat not found!

Registry entries deleted on Reboot...

Bonjour

Le PC fonctione mieux.
J'ai récupéré les mises à jour automatiques de windows live update (47). Ce processus ne fonctionnait plus depuis prés d'un an. Malgré les nterventions de techniciens microsoft rien n'avait résolu le problème.
Ce qui me chagrine tout de même c'est que mon antivirus (Norton) est à jour. Je paie pour ça et lorsque que e me retourne contre Norton, ils se dégagent de toutes responsabilités.
En cop/col les documents demandés concernant les dernières analyses:

SystemLook


SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 11:49 on 05/11/2009 by Propriétaire (Administrator - Elevation successful)

========== dir ==========

C:\Program Files\Fichiers Communs\hncflntj - Parameters: "(none)"

---Files---
None found.

---Folders---
htnbtlplnt d----- [10:31 14/11/2004]
jhjbrdph d----- [10:29 14/11/2004]

-=End Of File=-


log GenProc

Rapport GenProc 2.646 [1] - 05/11/2009 à 11:55:18
@ Windows XP Service Pack 2 - Mode normal
@ Internet Explorer (7.0.5730.11) [Navigateur par défaut]

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :


Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt




~~~~ INFORMATION COMPLEMENTAIRE ~~~~


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:41, on 05/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\GenProc\Outil\Propriétaire_GenProc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = ?
O4 - Global Startup: 3D!Turbo Experience.lnk = C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: F-Secure Management Agent (FSMA) - Conexant Systems - (no file)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Ici le cop/col de SystemLook

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 13:45 on 05/11/2009 by Propriétaire (Administrator - Elevation successful)

========== dir ==========

C:\Program Files\Fichiers Communs\hncflntj\htnbtlplnt d - Unable to find folder.

C:\Program Files\Fichiers Communs\hncflntj\jhjbrdph d - Unable to find folder.

C:\Program Files\Fichiers Communs\hncflntj\htnbtlplnt - Parameters: "(none)"

---Files---
nppcpntrcj.fll --a--c 993432 bytes [10:31 14/11/2004] [10:31 14/11/2004]

---Folders---
None found.

C:\Program Files\Fichiers Communs\hncflntj\jhjbrdph - Parameters: "(none)"

---Files---
pppepndbr.nhl --a--c 1661688 bytes [10:29 14/11/2004] [10:29 14/11/2004]

---Folders---
None found.

-=End Of File=-

Cop/col rapport virus total
C:\Program Files\Fichiers Communs\hncflntj\jhjbrdph\pppepndbr.nhl

Fichier pppepndbr.nhl reçu le 2009.11.05 13:12:36 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 0/40 (0%)


Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.05 -
AhnLab-V3 5.0.0.2 2009.11.05 -
AntiVir 7.9.1.53 2009.11.05 -
Antiy-AVL 2.0.3.7 2009.11.05 -
Authentium 5.2.0.5 2009.11.05 -
Avast 4.8.1351.0 2009.11.05 -
AVG 8.5.0.423 2009.11.05 -
BitDefender 7.2 2009.11.05 -
CAT-QuickHeal 10.00 2009.11.05 -
ClamAV 0.94.1 2009.11.05 -
Comodo 2848 2009.11.05 -
DrWeb 5.0.0.12182 2009.11.05 -
eTrust-Vet 35.1.7103 2009.11.04 -
F-Prot 4.5.1.85 2009.11.04 -
F-Secure 9.0.15370.0 2009.11.04 -
Fortinet 3.120.0.0 2009.11.05 -
GData 19 2009.11.05 -
Ikarus T3.1.1.74.0 2009.11.05 -
Jiangmin 11.0.800 2009.11.05 -
K7AntiVirus 7.10.888 2009.11.04 -
Kaspersky 7.0.0.125 2009.11.05 -
McAfee 5792 2009.11.04 -
McAfee+Artemis 5792 2009.11.04 -
McAfee-GW-Edition 6.8.5 2009.11.05 -
Microsoft 1.5202 2009.11.05 -
NOD32 4575 2009.11.05 -
Norman 6.03.02 2009.11.05 -
nProtect 2009.1.8.0 2009.11.05 -
Panda 10.0.2.2 2009.11.04 -
PCTools 7.0.3.5 2009.11.05 -
Prevx 3.0 2009.11.05 -
Rising 21.54.34.00 2009.11.05 -
Sophos 4.47.0 2009.11.05 -
Sunbelt 3.2.1858.2 2009.11.05 -
Symantec 1.4.4.12 2009.11.05 -
TheHacker 6.5.0.2.061 2009.11.05 -
TrendMicro 9.0.0.1003 2009.11.05 -
VBA32 3.12.10.11 2009.11.04 -
ViRobot 2009.11.5.2023 2009.11.05 -
VirusBuster 4.6.5.0 2009.11.04 -
Information additionnelle
File size: 1661688 bytes
MD5...: a76bcb86d9f68158a94ac04fb6661993
SHA1..: e0ceec70eb00bf389e600e5e6c6841b56a78b28d
SHA256: cc7be0668b65202942545dc0175227fac156372adeb0f62c5e0332977646fc47
ssdeep: 24576:xZp4zXgnZx7SQDV/o7Te6JHs+erx0B/K6ZEYdP1rTLiTHxy83N2TuwYlth
:xDZHA7T3MD+fZTJ+5FX

PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Unknown!
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned


Cop/col rapport virus total 2
C:\Program Files\Fichiers Communs\hncflntj\htnbtlplnt\nppcpntrcj.fll
Fichier nppcpntrcj.fll reçu le 2009.11.05 13:19:02 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 0/41 (0%)



Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.05 -
AhnLab-V3 5.0.0.2 2009.11.05 -
AntiVir 7.9.1.53 2009.11.05 -
Antiy-AVL 2.0.3.7 2009.11.05 -
Authentium 5.2.0.5 2009.11.05 -
Avast 4.8.1351.0 2009.11.05 -
AVG 8.5.0.423 2009.11.05 -
BitDefender 7.2 2009.11.05 -
CAT-QuickHeal 10.00 2009.11.05 -
ClamAV 0.94.1 2009.11.05 -
Comodo 2848 2009.11.05 -
DrWeb 5.0.0.12182 2009.11.05 -
eSafe 7.0.17.0 2009.11.04 -
eTrust-Vet 35.1.7103 2009.11.04 -
F-Prot 4.5.1.85 2009.11.04 -
F-Secure 9.0.15370.0 2009.11.04 -
Fortinet 3.120.0.0 2009.11.05 -
GData 19 2009.11.05 -
Ikarus T3.1.1.74.0 2009.11.05 -
Jiangmin 11.0.800 2009.11.05 -
K7AntiVirus 7.10.888 2009.11.04 -
Kaspersky 7.0.0.125 2009.11.05 -
McAfee 5792 2009.11.04 -
McAfee+Artemis 5792 2009.11.04 -
McAfee-GW-Edition 6.8.5 2009.11.05 -
Microsoft 1.5202 2009.11.05 -
NOD32 4575 2009.11.05 -
Norman 6.03.02 2009.11.05 -
nProtect 2009.1.8.0 2009.11.05 -
Panda 10.0.2.2 2009.11.04 -
PCTools 7.0.3.5 2009.11.05 -
Prevx 3.0 2009.11.05 -
Rising 21.54.34.00 2009.11.05 -
Sophos 4.47.0 2009.11.05 -
Sunbelt 3.2.1858.2 2009.11.05 -
Symantec 1.4.4.12 2009.11.05 -
TheHacker 6.5.0.2.061 2009.11.05 -
TrendMicro 9.0.0.1003 2009.11.05 -
VBA32 3.12.10.11 2009.11.04 -
ViRobot 2009.11.5.2023 2009.11.05 -
VirusBuster 4.6.5.0 2009.11.04 -
Information additionnelle
File size: 993432 bytes
MD5...: ce68e7d9bb013181eb520ca351fd5401
SHA1..: a188b2559b6316c97171576b055e0fceb0a2f801
SHA256: 0de43b332430d4bab71b0b841637fd84dd6c7cf320a26261bbf77e8dfee83ea9
ssdeep: 12288:4jpTcMA70d9Fg5eOXzXVuE18/gRKcrjNGEUFBwDPSgvWqnSLEo6T5dztIA
jdP81n:Bvi9S5H1y8KcrJwFBtguq1X5EyVuei

PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Unknown!
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Bonsoir
Ce soir c'est soirée PC:-)

Pour info avant de poster les rapports, j'ai passé la majeure partie de l'aprés midi à recevoir et installer les mises à jour de windows update à savoir service pack3 et les mises à jour de sécurité et au final Explorer8. Aucun plantage.

J'ai réinstallé Hijackthis comme demandé

Restauration système purgée
Réactivation de la restauration aprés redémarrage effectuée

Opérations faites dans l'ordre comme décrit dans le dernier courrier.

En cop/col les rapports demandés.

ZHPFix

Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
(Néant)

Valeur du Registre :
(Néant)

Elément de données du Registre :
(Néant)

Dossier :
C:\ComboFix => Supprimé et mis en quarantaine
C:\Qoobox => Supprimé et mis en quarantaine
C:\Genproc => Supprimé et mis en quarantaine
C:\_OTM => Supprimé et mis en quarantaine
C:\ToolBar SD => Supprimé et mis en quarantaine

Fichier :
c:\documents and settings\propriétaire\bureau\ad-r.exe => Supprimé et mis en quarantaine
c:\combofix.txt => Supprimé et mis en quarantaine
c:\documents and settings\propriétaire\bureau\oad.exe => Supprimé et mis en quarantaine
c:\resultat.txt => Supprimé et mis en quarantaine
c:\documents and settings\propriétaire\bureau\otm.exe => Supprimé et mis en quarantaine
c:\documents and settings\propriétaire\bureau\toolbarsd.exe => Supprimé et mis en quarantaine
c:\tb.txt => Supprimé et mis en quarantaine

Logiciel :
O63 - Logiciel: HijackThis 2.0.2 => Logiciel supprimé avec succès
O63 - Logiciel: AD-Remover => Logiciel supprimé avec succès
O63 - Logiciel: ComboFix => Logiciel supprimé avec succès
O63 - Logiciel: GenProc => Logiciel supprimé avec succès
O63 - Logiciel: OAD => Logiciel supprimé avec succès
O63 - Logiciel: OTM => Logiciel supprimé avec succès
O63 - Logiciel: Toolbar SD => Logiciel supprimé avec succès

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 0
Valeur du Registre : 0
Elément de données du Registre : 0
Dossier : 5
Fichier : 7
Logiciel : 7
Autre : 0


End of the scan

Cop/Col du rapport BitDefender
BitDefender Online Scanner



Rapport d'analyse gnr : Thu, Nov 05, 2009 - 22:18:55

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;
Statistiques
Temps
01:00:59
Fichiers
60327
Directoires
6186
Secteurs de boot
0
Archives
1281
Paquets programmes
5185

Rsultats

Virus identifis
0

Fichiers infects
0

Fichiers suspects
0

Avertissements
0

Dsinfects
0

Fichiers effacs
0




Info sur les moteurs

Dfinition virus
4481378

Version des moteurs
AVCORE v2.1 Windows/i386 11.0.0.26 (Oct 20 2009)

Analyse des plugins
17

Archive des plugins
44

Unpack des plugins
8

E-mail plugins
6

Systme plugins
4


Paramtres d'analyse

Premire action
Désinfecté

Seconde Action
Supprimés

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analyses
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions


Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui




Fichier analys
Statut

Aucun virus trouvé.

Encore merci pour votre aide
Joël

Voici le rapport Hijacthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:58:33, on 05/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = ?
O4 - Global Startup: 3D!Turbo Experience.lnk = C:\Program Files\MSI\3D!Turbo Experience\3D!Turbo.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1256931192500
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - AOL LLC - (no file)
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: F-Secure Management Agent (FSMA) - Conexant Systems - (no file)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe