Rapport log.txt

Bonjour,
Logfile of random's system information tool 1.06 (written by random/random)
Run by a at 2009-11-12 15:38:30
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 15 GB (40%) free of 38 GB
Total RAM: 503 MB (36% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:59, on 12/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\a\LOCALS~1\Temp\ihcr.exe
C:\DOCUME~1\a\LOCALS~1\Temp\kweagm.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\a\Bureau\RSIT.exe
C:\Program Files\trend micro\a.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: SBCONVERT - {A1056498-D09A-41E4-864B-505EDD640D9E} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
O3 - Toolbar: SpeedBit Video Downloader - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Jackpot City Online Casino - 6FDDCD10-23E4-4475-B96F-CB058E17A2CB - C:\Microgaming\Casino\JackpotCity\Casinogame.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {54CFC975-F9FB-45EB-8D18-D2D04FBC4299} (RemoteWeb2 Control) - http://www.j2kdvr.com/CAB/RemoteWeb2.cab
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)

--
End of file - 5150 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-12-31 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 440056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1056498-D09A-41E4-864B-505EDD640D9E}]
SBCONVERT Class - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-11-11 256112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll [2009-11-11 761840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll [2009-11-11 458736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
SearchSettings Class - C:\Program Files\Search Settings\kb128\SearchSettings.dll [2009-04-09 1091584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0329E7D6-6F54-462D-93F6-F5C3118BADF2} - SpeedBit Video Downloader - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll []
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-11-11 256112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2004-08-05 160768]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-05 15360]
"NBJ"=C:\Program Files\Ahead\Nero BackItUp\NBJ.exe [2005-10-11 2039808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
C:\Program Files\Ares\Ares.exe -h []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-02-06 2021400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2004-09-13 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]
C:\Program Files\HP\HP UT\bin\hppusg.exe [2005-09-07 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe [2003-07-10 184320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe [2005-09-20 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe [2003-07-10 237568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe [2006-03-14 1397760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-08-04 1737216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe [2007-01-19 5858672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 233472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pdfFactory Pro Dispatcher v2]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe [2003-11-10 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe [2008-10-13 120104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar]
C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe [2004-04-21 163840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9]
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe [2009-02-16 161064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
C:\Program Files\Search Settings\SearchSettings.exe [2009-04-09 1048064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-01-06 244984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-08-12 263696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX]
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe [2005-11-21 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XP-BBA63143]
C:\WINDOWS\system32\XP-BBA63143.EXE [2009-07-08 1582779]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur^Menu Démarrer^Programmes^Démarrage^¡¡¡¡¡¡.lnk]
C:\WINDOWS\system32\XP-BBA~1.EXE [2009-07-08 1582779]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 157088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^a^Menu Démarrer^Programmes^Démarrage^Metacafe Downloader.lnk]
C:\DOCUME~1\a\LOCALS~1\Temp\MetacafeDllDownloader.dll,InstallMetacafe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^a^Menu Démarrer^Programmes^Démarrage^¡¡¡¡¡¡.lnk]
C:\WINDOWS\system32\XP-BBA~1.EXE [2009-07-08 1582779]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-07-10 319488]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:ipsec"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD Cinema\PowerDVDCinema.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD Cinema\PowerDVDCinema.exe:*:Enabled:CyberLink PowerDVD 9.0"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"
"E:\asma.exe"="E:\asma.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winvurhkf.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winvurhkf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w2960e5.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w2960e5.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winngkdlo.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winngkdlo.exe:*:Enabled:ipsec"
"C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"="C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winlwru.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winlwru.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w43c1b.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w43c1b.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\afkoyl.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\afkoyl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\wincwbu.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\wincwbu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winyipqpp.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winyipqpp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winnuhv.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winnuhv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\qdles.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\qdles.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\fauf.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\fauf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\hjlpus.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\hjlpus.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winloid.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winloid.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\hqhxx.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\hqhxx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winhvktv.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winhvktv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\qckvl.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\qckvl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winrtsnty.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winrtsnty.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winairg.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winairg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winwgxaop.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winwgxaop.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winutincn.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winutincn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\dywgq.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\dywgq.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\XP-BBA63143.EXE"="C:\WINDOWS\system32\XP-BBA63143.EXE:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\ukrvr.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\ukrvr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\cnnvcj.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\cnnvcj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winasqvo.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winasqvo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winlpkxk.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winlpkxk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w3e8fa.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w3e8fa.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\wintjnvl.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\wintjnvl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winpcvocf.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winpcvocf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winaigkh.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winaigkh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\ycop.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\ycop.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winpnmg.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winpnmg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winrjqyhx.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winrjqyhx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\ydml.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\ydml.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winktcm.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winktcm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w3aa2b.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w3aa2b.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\iownp.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\iownp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winkbguqg.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winkbguqg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winnfcm.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winnfcm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\ocmfj.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\ocmfj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\ywllat.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\ywllat.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winrthhh.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winrthhh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\tbrmk.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\tbrmk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\windwqce.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\windwqce.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winhuiio.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winhuiio.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\paca.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\paca.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winlhwe.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winlhwe.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\avorbd.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\avorbd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winavmfmo.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winavmfmo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\nnps.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\nnps.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w36d90.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w36d90.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\skeno.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\skeno.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\wingrhl.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\wingrhl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\cxgv.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\cxgv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winhdmw.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winhdmw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\gkitor.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\gkitor.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winsrhx.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winsrhx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w2480ba.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w2480ba.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winnxhu.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winnxhu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\pnhxdh.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\pnhxdh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\fxmtrq.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\fxmtrq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\opnj.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\opnj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w3f89a.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w3f89a.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winkjsoys.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winkjsoys.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\ilhf.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\ilhf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winajxcif.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winajxcif.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\bciaju.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\bciaju.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\hitv.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\hitv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\njgaax.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\njgaax.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\avkj.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\avkj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winbqbf.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winbqbf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winhujd.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winhujd.exe:*:Enabled:ipsec"
"C:\Program Files\Search Settings\SearchSettings.exe"="C:\Program Files\Search Settings\SearchSettings.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\oglh.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\oglh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winmhcj.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winmhcj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winahqlj.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winahqlj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w3ece2.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w3ece2.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\igfxtray.exe"="C:\WINDOWS\system32\igfxtray.exe:*:Enabled:ipsec"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:ipsec"
"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\windfcyx.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\windfcyx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\lrdyb.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\lrdyb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\w3955b.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\w3955b.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winlrfi.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winlrfi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winkdem.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winkdem.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winbfaw.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winbfaw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winwrdlhd.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winwrdlhd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\cauvyo.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\cauvyo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winfnfjlf.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winfnfjlf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\a\LOCALS~1\Temp\winaeum.exe"="C:\DOCUME~1\a\LOCALS~1\Temp\winaeum.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe"="C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe:*:Enabled:CyberLink PowerDVD 9.0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0811c9ca-a126-11de-9c04-0002e34c29fb}]
shell\1\command - E:\Recycled.exe
shell\2\command - E:\Recycled.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8026ee01-6bd3-11de-9b6c-0002e34c29fb}]
shell\AuTOPLay\command - E:\uuqwjk.cmd
shell\AutoRun\command - E:\Recycled.exe
shell\eXpLoRE\command - E:\uuqwjk.cmd
shell\OpeN\command - E:\uuqwjk.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fbe0e863-b0c9-11dd-99e1-0002e34c29fb}]
shell\AutoRun\command - E:\jfvkcsy.bat
shell\explore\command - E:\jfvkcsy.bat
shell\open\command - E:\jfvkcsy.bat

======List of files/folders created in the last 1 months======

2009-11-12 15:38:33 ----D---- C:\Program Files\trend micro
2009-11-12 15:38:30 ----D---- C:\rsit
2009-11-12 10:56:48 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-11-11 16:01:35 ----D---- C:\Program Files\InCode Solutions
2009-10-26 17:32:21 ----SH---- C:\WINDOWS\system32\ZOON-56A.EXE
2009-10-26 17:32:21 ----A---- C:\WINDOWS\system32\Q5-7699A.EXE
2009-10-22 18:08:15 ----A---- C:\WINDOWS\system32\N2-78229.EXE
2009-10-16 17:40:53 ----A---- C:\WINDOWS\system32\W8-AAF7D.EXE
2009-10-15 09:18:57 ----D---- C:\Documents and Settings\a\Application Data\Convisav
2009-10-15 09:18:41 ----D---- C:\ConviSAV

======List of files/folders modified in the last 1 months======

2009-11-12 15:38:36 ----D---- C:\WINDOWS\Prefetch
2009-11-12 15:38:33 ----RD---- C:\Program Files
2009-11-12 15:34:25 ----D---- C:\Program Files\Mozilla Firefox
2009-11-12 15:31:01 ----D---- C:\WINDOWS\Temp
2009-11-12 15:02:13 ----D---- C:\WINDOWS
2009-11-12 14:57:51 ----SH---- C:\boot.ini
2009-11-12 14:57:51 ----A---- C:\WINDOWS\win.ini
2009-11-12 14:57:51 ----A---- C:\WINDOWS\system.ini
2009-11-12 14:56:46 ----D---- C:\Program Files\Windows Media Player
2009-11-12 14:56:45 ----D---- C:\WINDOWS\system32
2009-11-12 12:08:02 ----ASH---- C:\WINDOWS\system32\og.dll
2009-11-12 11:53:36 ----ASH---- C:\WINDOWS\system32\ul.dll
2009-11-12 11:19:36 ----D---- C:\WINDOWS\system32\drivers
2009-11-12 11:18:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-11-12 11:15:03 ----SD---- C:\WINDOWS\Tasks
2009-11-12 10:34:51 ----SHD---- C:\WINDOWS\Installer
2009-11-12 10:34:36 ----HD---- C:\Config.Msi
2009-11-12 10:33:46 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-11 09:31:09 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-11-10 15:39:29 ----D---- C:\Documents and Settings\a\Application Data\AdobeUM
2009-11-05 10:37:53 ----D---- C:\WINDOWS\Minidump
2009-10-16 14:53:29 ----A---- C:\WINDOWS\system32\Z6-65C17.EXE
2009-10-15 09:18:43 ----RSD---- C:\WINDOWS\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2005-07-08 29696]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2006-03-14 28672]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-05 40320]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-08-03 120094]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-08-03 96858]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 asc3360pr;asc3360pr; \??\C:\WINDOWS\system32\drivers\jtnjsh.sys []
R3 Dot4Scan;Scan Class Driver for IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2006-01-12 163328]
R3 HPFXBULK;HPFXBULK; C:\WINDOWS\system32\drivers\hpfxbulk.sys [2005-09-20 9344]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-10-28 49920]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-10-28 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-28 21568]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2003-08-03 91419]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-08-29 578304]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-05 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-05 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-05 20480]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2005-07-08 99584]
S3 dot4;Pilote MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2004-08-03 207360]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;Filtre Dot4USB Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-23 24064]
S3 NAL;Nal Service ; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys []
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2005-07-08 871424]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2005-10-22 69632]
S2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe []
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-05 260592]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 166768]

-----------------EOF-----------------

Configuration: Windows XP
Firefox 3.0.13