Virus,impossible de naviguer sur firefox

voici le rapport


SmitFraudFix v2.424

Rapport fait à 20:36:11,03, 24/11/2009
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\bcd2kcpan.exe
C:\Program Files\OLITEC\ACU.exe
C:\WINDOWS\system32\bcd3kcpan.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\DrvMon.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jean-charles


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jean-charles\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JEAN-C~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\WINDOWS\\System32\\DLLDRV3232.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: OLITEC USB 2.0 Super G - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9687F347-ED0F-4909-BF71-C053FBF34EF7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9687F347-ED0F-4909-BF71-C053FBF34EF7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9687F347-ED0F-4909-BF71-C053FBF34EF7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

je viens de passer combofix, voici le rapport:

ComboFix 09-11-25.05 - jean-charles 26/11/2009 9:25.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.593 [GMT 1:00]
Lancé depuis: c:\documents and settings\jean-charles\Mes documents\Téléchargements\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\JEAN-C~1\LOCALS~1\Temp\9.tmp
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700C.manifest
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700O.manifest
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700P.manifest
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700S.manifest
c:\documents and settings\jean-charles\Local Settings\Temp\9.tmp
c:\windows\Downloaded Program Files\poPCaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\kb913800.exe
c:\windows\system32\2689823159.dat
c:\windows\system32\404Fix.exe
c:\windows\system32\4Xmep.vbs
c:\windows\system32\aFVmP.vbs
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\djupYOp.vbs
c:\windows\system32\DMSCRIPT32.DLL
c:\windows\system32\DSSENH32.DLL
c:\windows\system32\dumphive.exe
c:\windows\system32\f90ek.vbs
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\jenBadn.vbs
c:\windows\system32\kjcCa5M.vbs
c:\windows\system32\LpsKnsK.vbs
c:\windows\system32\MnwOkxA.vbs
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\szuAU.vbs
c:\windows\system32\tmp.reg
c:\windows\system32\uiQG5jx.vbs
c:\windows\system32\unrar.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\Ws8en.vbs
c:\windows\system32\YrLygST.vbs
c:\windows\system32\YT9jyUkmJwTxcZW.vbs
c:\windows\system32\zkLuYsqET1joF.vbs
c:\windows\system32\ZT8O2.vbs
D:\AUTORUN.INF

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_APPMGMTAPPMGMT
-------\Service_AppMgmtAppMgmt


((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.

2009-11-26 07:59 . 2009-11-26 07:59 187904 ----a-w- c:\windows\system32\DLLPRF3232.dll
2009-11-24 19:01 . 2009-11-24 19:01 187904 ----a-w- c:\windows\system32\comcat32.dll
2009-11-24 09:43 . 2009-11-24 09:43 -------- d-----w- c:\documents and settings\jean-charles\Application Data\Malwarebytes
2009-11-24 09:42 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-24 09:42 . 2009-11-24 09:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-24 09:42 . 2009-11-24 09:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-24 09:42 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-22 18:03 . 2009-11-22 18:03 187904 ----a-w- c:\windows\system32\ctl3d3232.dll
2009-11-21 12:22 . 2009-11-21 12:22 -------- d-----w- c:\program files\CCleaner
2009-11-21 12:19 . 2009-11-21 16:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-21 12:19 . 2009-11-21 12:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-20 17:54 . 2006-05-24 12:36 110592 ----a-w- c:\documents and settings\jean-charles\Application Data\U3\temp\cleanup.exe
2009-11-20 17:40 . 2009-11-20 17:54 -------- d-----w- c:\documents and settings\jean-charles\Application Data\U3
2009-11-20 11:19 . 2009-11-20 11:20 -------- d-sh--w- c:\windows\system32\SysWoW32
2009-11-20 11:18 . 2009-11-20 11:20 -------- d-----w- c:\windows\system32\1047652468
2009-11-20 11:17 . 2009-11-20 11:17 121856 ----a-w- c:\windows\system32\DLLDRV3232.dll
2009-11-19 16:06 . 2009-11-19 16:06 -------- d-----w- c:\documents and settings\LocalService\Menu Démarrer
2009-11-19 16:06 . 2009-03-30 09:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-11-19 16:06 . 2009-03-24 15:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-19 16:06 . 2009-02-13 11:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-11-19 16:06 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-11-19 16:05 . 2009-11-19 16:05 -------- d-----w- c:\program files\Avira
2009-11-19 16:05 . 2009-11-19 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-11-09 15:02 . 2009-11-17 15:48 79488 ----a-w- c:\documents and settings\jean-charles\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-06 10:31 . 2009-11-25 21:59 -------- d-----w- c:\documents and settings\jean-charles\Tracing
2009-11-06 10:29 . 2009-11-09 08:33 -------- d-----w- c:\program files\Microsoft Silverlight
2009-11-06 10:28 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-11-06 10:27 . 2009-11-06 10:27 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-11-06 10:26 . 2009-11-06 10:26 -------- d-----w- c:\program files\Microsoft
2009-11-06 10:26 . 2009-11-06 10:26 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-06 10:16 . 2009-11-06 10:16 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-10-30 18:18 . 2009-10-30 18:19 1925024 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-26 08:32 . 2009-11-26 08:32 738816 --sha-w- c:\windows\system32\4.tmp
2009-11-22 10:40 . 2006-05-24 19:01 -------- d-----w- c:\documents and settings\jean-charles\Application Data\LimeWire
2009-11-21 12:24 . 2009-02-18 10:51 -------- d-----w- c:\documents and settings\jean-charles\Application Data\Azureus
2009-11-21 12:03 . 2006-08-11 17:43 85396 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-21 12:03 . 2006-08-11 17:43 511874 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-21 12:01 . 2006-08-11 17:45 -------- d-----w- c:\program files\GemMasterFrench
2009-11-21 11:55 . 2009-06-03 14:25 -------- d-----w- c:\program files\Full Tilt Poker
2009-11-21 11:55 . 2006-08-11 17:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-06 10:29 . 2007-05-21 18:48 56224 ----a-w- c:\documents and settings\jean-charles\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-06 10:28 . 2006-08-15 22:23 -------- d-----w- c:\program files\Windows Live
2009-11-05 20:53 . 2008-05-31 17:02 1 ----a-w- c:\documents and settings\jean-charles\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-11-05 20:53 . 2008-05-31 17:01 -------- d-----w- c:\documents and settings\jean-charles\Application Data\OpenOffice.org2
2009-10-31 08:47 . 2009-10-17 13:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-10-17 13:09 . 2009-10-17 13:09 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-10-13 16:54 . 2009-10-13 16:54 20299296 ----a-w- c:\documents and settings\jean-charles\Application Data\TomTom\HOME\Profiles\nn591z4f.default\Updates\v2_7_2_1825_win.exe
2009-09-11 14:18 . 2004-08-10 20:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-10 20:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2006-03-04 04:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2004-08-10 20:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2004-08-10 20:00 17408 ------w- c:\windows\system32\corpol.dll
2007-11-04 14:19 . 2007-11-04 14:19 251 ----a-w- c:\program files\wt3d.ini
.

------- Sigcheck -------

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-06-20 . 1CC09561E21A48A7F649A40F18235860 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-01-13 . 583E063FDC888CA30D05C2724B0D7EF4 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2004-08-10 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB913446$\tcpip.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0" [X]
"Gadwin PrintScreen 3.5"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2006-07-08 1101824]
"DrvMon.exe"="c:\windows\system32\DrvMon.exe" [2004-09-22 53248]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-04-08 251240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-11 7626752]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-11 86016]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"BCD2000"="c:\windows\system32\bcd2kcpan.exe" [2008-07-05 536576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"ACU"="c:\program files\OLITEC\ACU.exe" [2006-09-07 299008]
"BCD3000"="c:\windows\system32\bcd3kcpan.exe" [2008-10-11 552960]
"SSBkgdUpdate"="c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-11 1519616]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-01 16208384]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-5-21 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-10 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
MA111 Configuration Utility.lnk - c:\program files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe [2004-5-28 421888]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\8c438f13700]
2009-11-20 11:17 121856 ----a-w- c:\windows\system32\DLLDRV3232.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Documents and Settings\\jean-charles\\Bureau\\Raccourcis Bureau non utilisés\\freezer v1.4 fr\\freezer v1.4 fr\\freezer.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 netbex;netbex;c:\windows\system32\drivers\netbex.sys [15/08/2006 23:22 20480]
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [10/07/2007 13:53 15172]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [19/11/2009 17:06 108289]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [08/04/2009 11:38 92008]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [07/05/2007 15:15 670592]
S3 ATHFMWDL;Atheros USB Wireless Adapter Bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [20/06/2007 22:00 43392]
S3 BCD2000;Behringer BCD2000 V1.0.0.6;c:\windows\system32\Drivers\BCD2000.SYS --> c:\windows\system32\Drivers\BCD2000.SYS [?]
S3 BCD2000WDM;Behringer BCD2000WDM V1.0.0.6;c:\windows\system32\Drivers\BCD2000WDM.SYS --> c:\windows\system32\Drivers\BCD2000WDM.SYS [?]
S3 BCD3000;Behringer BCD3000 V1.1.2.0;c:\windows\system32\drivers\BCD3000.SYS [11/07/2008 09:38 42496]
S3 BCD3000WDM;Behringer BCD3000WDM V1.1.2.0;c:\windows\system32\drivers\BCD3000WDM.SYS [11/07/2008 09:38 21600]
S3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [16/05/2006 11:04 892032]
S3 Pspc8xfp;Pspc8xfp; [x]
.
Contenu du dossier 'Tâches planifiées'
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = hxxp://fr.fr.acer.yahoo.com/
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
FF - ProfilePath - c:\documents and settings\jean-charles\Application Data\Mozilla\Firefox\Profiles\6ter9pc4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-Easy-PhotoPrint - c:\program files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
AddRemove-HijackThis - c:\documents and settings\jean-charles\Mes documents\Téléchargements\HijackThis.exe
AddRemove-MediaNavigation.CDLabelPrint - c:\program files\Canon\CD-LabelPrint\Uninstal.exe Canon.CDLabelPrint.Application
AddRemove-NVIDIA Drivers - c:\windows\system32\nvudisp.exe UninstallGUI
AddRemove-{4AD13F68-CADA-4C6B-9759-C33753F89908} - c:\acer\Empowering Technology\eDataSecurity\eDStbmngr.exe UNINSTALL 1



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-26 09:32
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\System32\DLLDRV3232.dll

- - - - - - - > 'explorer.exe'(776)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MFC71U.DLL
c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
c:\windows\System32\DLLDRV3232.dll
c:\windows\system32\4.tmp
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
.
**************************************************************************
.
Heure de fin: 2009-11-26 09:37 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-26 08:37

Avant-CF: 45 565 652 992 octets libres
Après-CF: 45 814 657 024 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 552CB433185704E1A3B8E4915BF15076

voici voilou le rapport...

ComboFix 09-11-25.05 - jean-charles 26/11/2009 20:59.2.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.653 [GMT 1:00]
Lancé depuis: c:\documents and settings\jean-charles\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\jean-charles\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\4.tmp"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700C.manifest
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700O.manifest
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700P.manifest
c:\documents and settings\jean-charles\Application Data\020000001cdc5d8d700S.manifest
c:\windows\system32\4.tmp
c:\windows\system32\unrar.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-26 au 2009-11-26 ))))))))))))))))))))))))))))))))))))
.

2009-11-26 07:59 . 2009-11-26 07:59 187904 ----a-w- c:\windows\system32\DLLPRF3232.dll
2009-11-24 19:01 . 2009-11-24 19:01 187904 ----a-w- c:\windows\system32\comcat32.dll
2009-11-24 09:43 . 2009-11-24 09:43 -------- d-----w- c:\documents and settings\jean-charles\Application Data\Malwarebytes
2009-11-24 09:42 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-24 09:42 . 2009-11-24 09:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-24 09:42 . 2009-11-24 09:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-24 09:42 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-22 18:03 . 2009-11-22 18:03 187904 ----a-w- c:\windows\system32\ctl3d3232.dll
2009-11-21 12:22 . 2009-11-21 12:22 -------- d-----w- c:\program files\CCleaner
2009-11-21 12:19 . 2009-11-21 16:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-21 12:19 . 2009-11-21 12:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-20 17:54 . 2006-05-24 12:36 110592 ----a-w- c:\documents and settings\jean-charles\Application Data\U3\temp\cleanup.exe
2009-11-20 17:40 . 2009-11-20 17:54 -------- d-----w- c:\documents and settings\jean-charles\Application Data\U3
2009-11-20 11:19 . 2009-11-20 11:20 -------- d-sh--w- c:\windows\system32\SysWoW32
2009-11-20 11:18 . 2009-11-20 11:20 -------- d-----w- c:\windows\system32\1047652468
2009-11-20 11:17 . 2009-11-20 11:17 121856 ----a-w- c:\windows\system32\DLLDRV3232.dll
2009-11-19 16:06 . 2009-11-19 16:06 -------- d-----w- c:\documents and settings\LocalService\Menu Démarrer
2009-11-19 16:06 . 2009-03-30 09:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-11-19 16:06 . 2009-03-24 15:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-19 16:06 . 2009-02-13 11:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-11-19 16:06 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-11-19 16:05 . 2009-11-19 16:05 -------- d-----w- c:\program files\Avira
2009-11-19 16:05 . 2009-11-19 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-11-09 15:02 . 2009-11-17 15:48 79488 ----a-w- c:\documents and settings\jean-charles\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-06 10:31 . 2009-11-25 21:59 -------- d-----w- c:\documents and settings\jean-charles\Tracing
2009-11-06 10:29 . 2009-11-09 08:33 -------- d-----w- c:\program files\Microsoft Silverlight
2009-11-06 10:28 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-11-06 10:27 . 2009-11-06 10:27 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-11-06 10:26 . 2009-11-06 10:26 -------- d-----w- c:\program files\Microsoft
2009-11-06 10:26 . 2009-11-06 10:26 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-06 10:16 . 2009-11-06 10:16 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-10-30 18:18 . 2009-10-30 18:19 1925024 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-22 10:40 . 2006-05-24 19:01 -------- d-----w- c:\documents and settings\jean-charles\Application Data\LimeWire
2009-11-21 12:24 . 2009-02-18 10:51 -------- d-----w- c:\documents and settings\jean-charles\Application Data\Azureus
2009-11-21 12:03 . 2006-08-11 17:43 85396 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-21 12:03 . 2006-08-11 17:43 511874 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-21 12:01 . 2006-08-11 17:45 -------- d-----w- c:\program files\GemMasterFrench
2009-11-21 11:55 . 2009-06-03 14:25 -------- d-----w- c:\program files\Full Tilt Poker
2009-11-21 11:55 . 2006-08-11 17:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-06 10:29 . 2007-05-21 18:48 56224 ----a-w- c:\documents and settings\jean-charles\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-06 10:28 . 2006-08-15 22:23 -------- d-----w- c:\program files\Windows Live
2009-11-05 20:53 . 2008-05-31 17:02 1 ----a-w- c:\documents and settings\jean-charles\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-11-05 20:53 . 2008-05-31 17:01 -------- d-----w- c:\documents and settings\jean-charles\Application Data\OpenOffice.org2
2009-10-31 08:47 . 2009-10-17 13:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-10-17 13:09 . 2009-10-17 13:09 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-10-13 16:54 . 2009-10-13 16:54 20299296 ----a-w- c:\documents and settings\jean-charles\Application Data\TomTom\HOME\Profiles\nn591z4f.default\Updates\v2_7_2_1825_win.exe
2009-09-11 14:18 . 2004-08-10 20:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-10 20:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2006-03-04 04:00 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2004-08-10 20:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2004-08-10 20:00 17408 ------w- c:\windows\system32\corpol.dll
2007-11-04 14:19 . 2007-11-04 14:19 251 ----a-w- c:\program files\wt3d.ini
.

------- Sigcheck -------

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-06-20 . 1CC09561E21A48A7F649A40F18235860 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-01-13 . 583E063FDC888CA30D05C2724B0D7EF4 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2004-08-10 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB913446$\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-11-26_08.32.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-26 19:08 . 2009-11-26 19:08 16384 c:\windows\temp\Perflib_Perfdata_134.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0" [X]
"Gadwin PrintScreen 3.5"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2006-07-08 1101824]
"DrvMon.exe"="c:\windows\system32\DrvMon.exe" [2004-09-22 53248]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-04-08 251240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-11 7626752]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-11 86016]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"BCD2000"="c:\windows\system32\bcd2kcpan.exe" [2008-07-05 536576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"ACU"="c:\program files\OLITEC\ACU.exe" [2006-09-07 299008]
"BCD3000"="c:\windows\system32\bcd3kcpan.exe" [2008-10-11 552960]
"SSBkgdUpdate"="c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-11 1519616]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-01 16208384]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-5-21 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-10 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
MA111 Configuration Utility.lnk - c:\program files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe [2004-5-28 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\8c438f13700]
2009-11-20 11:17 121856 ----a-w- c:\windows\system32\DLLDRV3232.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Documents and Settings\\jean-charles\\Bureau\\Raccourcis Bureau non utilisés\\freezer v1.4 fr\\freezer v1.4 fr\\freezer.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 netbex;netbex;c:\windows\system32\drivers\netbex.sys [15/08/2006 23:22 20480]
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [10/07/2007 13:53 15172]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [19/11/2009 17:06 108289]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [08/04/2009 11:38 92008]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [07/05/2007 15:15 670592]
S3 ATHFMWDL;Atheros USB Wireless Adapter Bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [20/06/2007 22:00 43392]
S3 BCD2000;Behringer BCD2000 V1.0.0.6;c:\windows\system32\Drivers\BCD2000.SYS --> c:\windows\system32\Drivers\BCD2000.SYS [?]
S3 BCD2000WDM;Behringer BCD2000WDM V1.0.0.6;c:\windows\system32\Drivers\BCD2000WDM.SYS --> c:\windows\system32\Drivers\BCD2000WDM.SYS [?]
S3 BCD3000;Behringer BCD3000 V1.1.2.0;c:\windows\system32\drivers\BCD3000.SYS [11/07/2008 09:38 42496]
S3 BCD3000WDM;Behringer BCD3000WDM V1.1.2.0;c:\windows\system32\drivers\BCD3000WDM.SYS [11/07/2008 09:38 21600]
S3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [16/05/2006 11:04 892032]
S3 Pspc8xfp;Pspc8xfp; [x]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = hxxp://fr.fr.acer.yahoo.com/
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
FF - ProfilePath - c:\documents and settings\jean-charles\Application Data\Mozilla\Firefox\Profiles\6ter9pc4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmidas.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-26 21:06
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(916)
c:\windows\System32\DLLDRV3232.dll
.
Heure de fin: 2009-11-26 21:08
ComboFix-quarantined-files.txt 2009-11-26 20:08
ComboFix2.txt 2009-11-26 08:37

Avant-CF: 45 856 931 840 octets libres
Après-CF: 45 819 760 640 octets libres

- - End Of File - - F65B21856A10D5FEA855F0D7DE362590

re....

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3222
Windows 5.1.2600 Service Pack 3

27/11/2009 09:56:08
mbam-log-2009-11-27 (09-55-38).txt

Type de recherche: Examen rapide
Eléments examinés: 110771
Temps écoulé: 5 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{03f629ea-c9b2-451f-a6b3-db9019f480c1} (Trojan.Agent) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\comcat32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\DLLPRF3232.dll (Trojan.Agent) -> No action taken.

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\jean-charles\Bureau\cv vaness\hijackthis.log: trouvé !
C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\ComboFix.exe: trouvé !
C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\hijackthis.log: trouvé !
C:\Program Files\Mozilla Firefox\SmitFraudfix: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\SmitFraudFix.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\jean-charles\Bureau\cv vaness\hijackthis.log: supprimé !
C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !
C:\Program Files\Mozilla Firefox\SmitFraudfix: supprimé !

depuis ce matin tout se passai jusqu'a tout a l'heure....la page de scan en ligne bidon est réapparue!!!
je ne suis pas sur mais j'ai une idéé sur la cause, tout a l'heure windows m'a demandé de faire des mises a jour,ce que j'ai fait et depuis que l'ordi a redémarré ca recommence !!! grrrr

Logfile of random's system information tool 1.06 (written by random/random)
Run by jean-charles at 2009-11-30 10:02:46
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 44 GB (38%) free of 116 GB
Total RAM: 1023 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:03:05, on 30/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\bcd2kcpan.exe
C:\Program Files\OLITEC\ACU.exe
C:\WINDOWS\system32\bcd3kcpan.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\WINDOWS\system32\DrvMon.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\jean-charles\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\jean-charles.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [BCD2000] %SystemRoot%\system32\bcd2kcpan.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ACU] "C:\Program Files\OLITEC\ACU.exe" -nogui
O4 - HKLM\..\Run: [BCD3000] %SystemRoot%\system32\bcd3kcpan.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Gadwin PrintScreen 3.5] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: 8c438f13700 - C:\WINDOWS\System32\DLLDRV3232.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pspc8xfp - Unknown owner - (no file)
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

List'em by g3n-h@ckm@n 1.0.6.0

Thx to Chiquitine29.....

User : jean-charles (Administrateurs) # ACER-7989E0343A
Update on 30/11/2009 by g3n-h@ckm@n ::::: 07:00
Start at: 10:25:40 | 01/12/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 113,27 Go (42,46 Go free) [ACER] | NTFS
D:\ -> Disque fixe local | 113,73 Go (53,74 Go free) [ACERDATA] | FAT32
E:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe 836
C:\WINDOWS\system32\csrss.exe 900
C:\WINDOWS\system32\winlogon.exe 924
C:\WINDOWS\system32\services.exe 972
C:\WINDOWS\system32\lsass.exe 984
C:\WINDOWS\system32\svchost.exe 1188
C:\WINDOWS\system32\svchost.exe 1244
C:\WINDOWS\System32\svchost.exe 1284
C:\WINDOWS\system32\acs.exe 1332
C:\WINDOWS\system32\svchost.exe 1420
C:\WINDOWS\system32\svchost.exe 1500
C:\WINDOWS\system32\spoolsv.exe 1736
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1776
C:\WINDOWS\system32\svchost.exe 1816
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1872
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1912
C:\WINDOWS\eHome\ehRecvr.exe 1952
C:\WINDOWS\eHome\ehSched.exe 1968
C:\Program Files\Java\jre6\bin\jqs.exe 2032
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe 160
C:\WINDOWS\system32\nvsvc32.exe 260
C:\WINDOWS\system32\svchost.exe 500
C:\WINDOWS\system32\svchost.exe 568
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe 664
C:\Program Files\Winsudate\gibsvc.exe 732
C:\WINDOWS\ehome\mcrdsvc.exe 120
C:\WINDOWS\system32\wuauclt.exe 1364
C:\WINDOWS\system32\dllhost.exe 2480
C:\WINDOWS\System32\alg.exe 2564
C:\WINDOWS\Explorer.EXE 3452
C:\WINDOWS\ehome\ehtray.exe 3804
C:\WINDOWS\eHome\ehmsas.exe 3980
C:\WINDOWS\RTHDCPL.EXE 688
C:\WINDOWS\system32\SysMonitor.exe 1396
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 2140
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe 1672
C:\WINDOWS\system32\bcd2kcpan.exe 1528
C:\Program Files\OLITEC\ACU.exe 2152
C:\WINDOWS\system32\bcd3kcpan.exe 2432
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe 788
C:\Program Files\Java\jre6\bin\jusched.exe 2500
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 2692
C:\WINDOWS\system32\DrvMon.exe 3448
C:\Program Files\Winamp Remote\bin\OrbTray.exe 3716
C:\Program Files\Winsudate\gibusr.exe 580
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe 1760
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe 2788
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe 2828
C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe 2844
C:\Program Files\Mozilla Firefox\firefox.exe 3216
C:\Program Files\WinRAR\WinRAR.exe 2112
C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\Rar$EX04.359\List_Kill'em.exe 2368
C:\WINDOWS\system32\cmd.exe 2256
C:\WINDOWS\system32\wbem\wmiprvse.exe 268
C:\Documents and Settings\jean-charles\Local Settings\Temp\9.tmp\pv.exe 876

======================
Keys "Run"
======================

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Gadwin PrintScreen 3.5 REG_SZ C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
updateMgr REG_SZ C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
DrvMon.exe REG_SZ C:\WINDOWS\system32\DrvMon.exe
Orb REG_SZ "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
TomTomHOME.exe REG_SZ "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
WinUsr REG_SZ C:\Program Files\Winsudate\gibusr.exe

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
LaunchApp REG_SZ Alaunch
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
SkyTel REG_SZ SkyTel.EXE
ntiMUI REG_SZ c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
IMEKRMIG6.1 REG_SZ C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
MSPY2002 REG_SZ C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
RTHDCPL REG_SZ RTHDCPL.EXE
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Acer Empowering Technology Monitor REG_SZ C:\WINDOWS\system32\SysMonitor.exe
eDataSecurity Loader REG_SZ C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
eRecoveryService REG_SZ C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
BCD2000 REG_EXPAND_SZ %SystemRoot%\system32\bcd2kcpan.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
ACU REG_SZ "C:\Program Files\OLITEC\ACU.exe" -nogui
BCD3000 REG_EXPAND_SZ %SystemRoot%\system32\bcd3kcpan.exe
SSBkgdUpdate REG_SZ "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
OpwareSE4 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
=====================
Other Keys
=====================

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
dontdisplaylastusername REG_DWORD 0x0
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 0x1
undockwithoutlogon REG_DWORD 0x1
InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme
DisableRegistryTools REG_DWORD 0x0
===============
===============
BHO :
======

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2
=========

=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\jean-charles\Application Data
choix=1
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=ACER-7989E0343A
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\jean-charles
LOGONSERVER=\\ACER-7989E0343A
MOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Documents and Settings\jean-charles\Application Data\Mozilla\Firefox\Crash Reports
MOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exe
MOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\crashreporter-override.ini
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\WinRAR;C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Fichiers communs\GIS\Tools;;C:\PROGRA~1\FICHIE~1\MUVEET~1\030625
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp
USERDOMAIN=ACER-7989E0343A
USERNAME=jean-charles
USERPROFILE=C:\Documents and Settings\jean-charles
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI


¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Program Files\Windows Live\Messenger\msimg32.dll
C:\Program Files\Winsudate
C:\WINDOWS\System32\drivers\etc\hosts.msn
C:\WINDOWS\System32\pmsbfn32.dll

¤¤¤¤¤¤¤¤¤¤ Keys :

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "winusr"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
HKCR\.torrent
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent
HKLM\SOFTWARE\Classes\.torrent
HKLM\SYSTEM\ControlSet001\Services\winsvc
HKLM\SYSTEM\CurrentControlSet\Services\winsvc

=========
Rootkits
=========

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-01 10:27:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

128EBEBAE8684818A6154F6ED6E4B-366A1CAC.pf
ACER.EMPOWERING.FRAMEWORK.LAU-0089481F.pf
ACU.EXE-09F0B5DD.pf
ADOBE GAMMA LOADER.EXE-14139C8F.pf
ADOBEUPDATEMANAGER.EXE-0075C43E.pf
ALAUNCH.EXE-145B15F4.pf
AVGNT.EXE-24287AD0.pf
AVNOTIFY.EXE-05C5A637.pf
AVWSC.EXE-06733DFE.pf
AVWSC.EXE-21D2C1ED.pf
BCD2KCPAN.EXE-056756A3.pf
BCD3KCPAN.EXE-38434487.pf
CALC.EXE-02A5B4B1.pf
CATCHME.EXE-36D49C9F.pf
CMD.EXE-034B0549.pf
CSCRIPT.EXE-0A13A05C.pf
CTFMON.EXE-05E57A5E.pf
DEFRAG.EXE-2858C7E2.pf
DFRGNTFS.EXE-38C3807C.pf
DRVMON.EXE-35F683A3.pf
EDSLOADER.EXE-2A914953.pf
EHMSAS.EXE-1E4CE886.pf
EHREC.EXE-2365F918.pf
EHTRAY.EXE-337AC592.pf
ERAGENT.EXE-0C495853.pf
EXPLORER.EXE-02121B1A.pf
FIREFOX.EXE-06188867.pf
GIBSVC.EXE-093317BD.pf
GIBUPT.EXE-0092616B.pf
GIBUSR.EXE-0E559506.pf
HELPSVC.EXE-1C192440.pf
IE4UINIT.EXE-046D13C9.pf
IEUDINIT.EXE-1E723E51.pf
IMAPI.EXE-201490BB.pf
IMEKRMIG.EXE-227C14E9.pf
IMJPMIG.EXE-32ABEE9A.pf
IMSCINST.EXE-2B626103.pf
JEAN-CHARLES.EXE-21BBBDAF.pf
JQSNOTIFY.EXE-359F83C5.pf
JUSCHED.EXE-04A13915.pf
Layout.ini
LIST_KILL'EM.EXE-36E0E150.pf
LOGONUI.EXE-312BE1BF.pf
MA111V2.EXE-0DACDFF3.pf
MBAM.EXE-0D37CDF0.pf
MODE.COM-318FFE37.pf
MSIEXEC.EXE-330626DC.pf
MSNMSGR.EXE-0EBDBC56.pf
NOTEPAD.EXE-2F2D61E1.pf
NTIMUI.EXE-2D0A7662.pf
NTOSBOOT-B00DFAAD.pf
NWIZ.EXE-2D374245.pf
ORBTRAY.EXE-34114C13.pf
PRINTSCREEN.EXE-13DBD4FB.pf
PV.EXE-06352FD1.pf
QTTASK.EXE-1876A1A1.pf
READER_SL.EXE-2FCCA463.pf
REG.EXE-27FA25B9.pf
REGSVR32.EXE-396DEA2C.pf
RSIT.EXE-0D5E38E2.pf
RTHDCPL.EXE-005A6E31.pf
RUNDLL32.EXE-3CAE7316.pf
RUNDLL32.EXE-45094B64.pf
RUNDLL32.EXE-51D80323.pf
RUNDLL32.EXE-525A3E13.pf
RUNDLL32.EXE-535560DF.pf
RUNDLL32.EXE-5F120771.pf
RUNDLL32.EXE-6611EAAA.pf
RUNDLL32.EXE-6ACD0C83.pf
RUNDLL32.EXE-6E074905.pf
RUNDLL32.EXE-73FEE585.pf
RUNDLL32.EXE-7573DF8B.pf
SETUP50.EXE-2911CBB9.pf
SHMGRATE.EXE-2DD3E4D8.pf
SKYTEL.EXE-15B3DBDE.pf
SPYBOTSD.EXE-1702AD5F.pf
SSBKGDUPDATE.EXE-2109723C.pf
SYSMONITOR.EXE-26AC766C.pf
TASKMGR.EXE-06144C13.pf
TEATIMER.EXE-0390E8A7.pf
TINTSETP.EXE-2DD83AEF.pf
TOMTOMHOMERUNNER.EXE-338BE728.pf
UNREGMP2.EXE-0CFB0619.pf
UPDATE.EXE-2F5EF2F5.pf
USERINIT.EXE-0743FDA9.pf
VERCLSID.EXE-28F52AD2.pf
VOS-DEMARCHES.EXE-11B0CD27.pf
WIAACMGR.EXE-335C1EE8.pf
WINRAR.EXE-0AA31BB9.pf
WLCOMM.EXE-2F4516F1.pf
WMDBEXPORT.EXE-21390C70.pf
WMIPRVSE.EXE-0D449B4F.pf
WUAUCLT.EXE-1360D60A.pf
ZDWLAN.EXE-36815DED.pf




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

J'ai suivi la procédure mais après avoir fermé le 1er rapport, le 2ieme ne s'est pas affiché !!
alors je poste le 1er...

Kill'em by g3n-h@ckm@n 1.0.6.0

User : jean-charles () # ACER-7989E0343A
Update on 30/11/2009 by g3n-h@ckm@n ::::: 07:00
Start at: 20:53:37 | 01/12/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 113,27 Go (43,53 Go free) [ACER] | NTFS
D:\ -> Disque fixe local | 113,73 Go (53,74 Go free) [ACERDATA] | FAT32
E:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running


C:\WINDOWS\System32\smss.exe 168
C:\WINDOWS\system32\csrss.exe 216
C:\WINDOWS\system32\winlogon.exe 240
C:\WINDOWS\system32\services.exe 284
C:\WINDOWS\system32\lsass.exe 296
C:\WINDOWS\system32\svchost.exe 452
C:\WINDOWS\system32\svchost.exe 516
C:\WINDOWS\system32\svchost.exe 572
C:\WINDOWS\Explorer.EXE 808
C:\Program Files\WinRAR\WinRAR.exe 3828
C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\Rar$EX00.750\List_Kill'em.exe 3904
C:\WINDOWS\system32\cmd.exe 3924
C:\WINDOWS\system32\wbem\wmiprvse.exe 4048
C:\Documents and Settings\jean-charles\Local Settings\Temp\2.tmp\pv.exe 1752

Files :
=======


¤¤¤¤¤¤¤¤¤¤ Files/folders :



¤¤¤¤¤¤¤¤¤¤ Files/folders killed :

Quarantine :


==============
host file OK !
==============

=============
Registry Kill
=============
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch

128EBEBAE8684818A6154F6ED6E4B-366A1CAC.pf
Layout.ini
NTOSBOOT-B00DFAAD.pf



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤