Win 32 Malware/Rootkit et compagnie!

OKay je te poste le rapport apres mon coups de Malwarebyte :D

Aller merci et TchussS!

:D

C'était pas à ton intention mais plutot au premier posteur le "What Else".
^^

OKI =) Bah le rapport arrive =)

Une Grosse Daube ouais....

Bref, le scan est à 15%.

Voilà ça arrive =)

Voilà:



############################## | UsbFix V6.095 |

User : utilisateur (Administrateurs) # NOM-3D47899AC5C
Update on 15/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 14:05:30 | 17/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1368 [VPS 100217-0] 4.8.1368 [ Enabled | Updated ]

C:\ -> Disque fixe local # 133,84 Go (49,6 Go free) # FAT32
D:\ -> Disque fixe local # 89,22 Go (89,17 Go free) [DATA] # FAT32
E:\ -> Disque CD-ROM
G:\ -> Disque amovible # 7,49 Go (7,39 Go free) # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

C:\WINDOWS\logfile32.txt
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\091.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\105.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\476.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\744.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\137.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\726.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\830.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\512.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\665.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\646.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\533.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\045.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\682.exe
C:\Recycler\S-1-5-21-8549988793-8136134255-067605186-6243\nissan.exe
C:\Recycler\S-1-5-21-8549988793-8136134255-067605186-6243\Desktop.ini
C:\Recycler\S-1-5-21-8549988793-8136134255-067605186-6243
D:\autorun.inf
G:\autorun.inf
G:\CRNOVINO\casa.exe
G:\CRNOVINO\Desktop.ini
G:\CRNOVINO
G:\KLIZAVI\desktop.ini
G:\KLIZAVI
G:\pozuda\malena.exe
G:\pozuda
G:\SVETEJEBLO\Desktop.ini
G:\SVETEJEBLO\zeljko.exe
G:\SVETEJEBLO
G:\HJTInstall.exe

################## | Registre |

[HKLM\software\microsoft\windows nt\currentversion\winlogon] "Taskman"

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{2594dd1c-e9c8-11de-aa38-0022433096fe}
Shell\AutoRun\command =F:\pozuda/malena.exe
Shell\explore\command =F:\pozuda/malena.exe
Shell\open\command =F:\pozuda/malena.exe

HKCU\..\..\Explorer\MountPoints2\{3350b194-ac18-11de-a9da-0022433096fe}
Shell\AutoRun\command =F:\setupSNK.exe

HKCU\..\..\Explorer\MountPoints2\{83de7642-cf8b-11dd-a876-b25596fc4b99}
Shell\AutoRun\command =F:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{c31bf401-c6cc-11dd-af89-806d6172696f}
Shell\AutoRun\command =D:\setupSNK.exe

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné !

################## | ! Fin du rapport # UsbFix V6.095 ! |

############################## | UsbFix V6.095 |

User : utilisateur (Administrateurs) # NOM-3D47899AC5C
Update on 15/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 14:15:29 | 17/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1368 [VPS 100217-0] 4.8.1368 [ Enabled | Updated ]

C:\ -> Disque fixe local # 133,84 Go (49,56 Go free) # FAT32
D:\ -> Disque fixe local # 89,22 Go (89,17 Go free) [DATA] # FAT32
E:\ -> Disque CD-ROM
G:\ -> Disque amovible # 7,49 Go (7,39 Go free) # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

Supprimé ! C:\WINDOWS\logfile32.txt
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\091.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\105.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\476.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\744.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\137.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\726.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\830.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\512.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\665.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\646.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\533.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\045.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\682.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\826.exe
Supprimé ! C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\8BD54F3E-DD19-4a69-93D8-5C6A5BBBE20E.exe
Supprimé ! C:\Recycler\S-1-5-21-8549988793-8136134255-067605186-6243\nissan.exe
Supprimé ! C:\Recycler\S-1-5-21-8549988793-8136134255-067605186-6243\Desktop.ini
Supprimé ! C:\Recycler\S-1-5-21-8549988793-8136134255-067605186-6243
Supprimé ! C:\Recycler\S-1-5-21-6944082522-2515595374-752933108-0008
Supprimé ! C:\Recycler\S-1-5-21-4450836918-6889817459-854826339-9612
Supprimé ! C:\Recycler\S-1-5-21-3481505795-4231297401-221504334-1390
Supprimé ! C:\Recycler\S-1-5-21-8941564475-2692199877-660189606-6289
Supprimé ! C:\Recycler\S-1-5-21-9571420538-1673283255-907137289-2528
Supprimé ! C:\Recycler\S-1-5-21-0493730430-4659640019-119280611-2235
Supprimé ! C:\Recycler\S-1-5-21-6479407741-0452833693-520460864-9336
Supprimé ! C:\Recycler\S-1-5-21-9330635041-7954066212-051320980-4141
Supprimé ! C:\Recycler\S-1-5-21-9596119566-9260826942-575400096-8961
Supprimé ! C:\Recycler\S-1-5-21-2180410621-2742532748-218695933-3553
Supprimé ! C:\Recycler\S-1-5-21-4205822898-2775348192-348169781-6515
Supprimé ! C:\Recycler\S-1-5-21-5747063552-9609082782-088159944-8183
Supprimé ! C:\Recycler\S-1-5-21-1364164811-9954437684-450247857-0971
Supprimé ! C:\Recycler\S-1-5-21-6192295248-0999902028-931325971-9342
Supprimé ! C:\Recycler\S-1-5-21-6861239944-3232759702-231043662-2795
Supprimé ! C:\Recycler\S-1-5-21-5770726075-6056571339-867891587-1212
Supprimé ! C:\Recycler\S-1-5-21-8683937416-1843534716-783908974-8535
Supprimé ! C:\Recycler\S-1-5-21-3489360908-7795806974-164368327-6983
Supprimé ! C:\Recycler\S-1-5-21-8166766953-6306742912-920574426-6046
Supprimé ! C:\Recycler\S-1-5-21-7704667667-9936495797-358793222-8987
Supprimé ! C:\Recycler\S-1-5-21-4044647199-3237632383-177710142-4926
Supprimé ! C:\Recycler\S-1-5-21-7834266452-0915595936-895615853-2768
Supprimé ! C:\Recycler\S-1-5-21-8041267493-8935076315-567194299-4346
Supprimé ! C:\Recycler\S-1-5-21-1459098585-0287412076-945025755-0641
Supprimé ! C:\Recycler\S-1-5-21-1985374529-2555691434-393273944-8195
Supprimé ! C:\Recycler\S-1-5-21-5075038066-9724041379-386797227-1097
Supprimé ! C:\Recycler\S-1-5-21-4597195111-3960860248-522450076-6903
Supprimé ! C:\Recycler\S-1-5-21-3222028964-3363365882-226672237-5768
Supprimé ! C:\Recycler\S-1-5-21-0401340910-4229757221-204345588-3972
Supprimé ! C:\Recycler\S-1-5-21-1646159720-8549812532-928924595-3655
Supprimé ! C:\Recycler\S-1-5-21-4939991314-9295833914-605534683-7687
Supprimé ! C:\Recycler\S-1-5-21-0388395238-0291269459-121641931-8204
Supprimé ! C:\Recycler\S-1-5-21-4638321134-0923330348-869997671-3173
Supprimé ! C:\Recycler\S-1-5-21-7285989011-7591127507-532835049-6991
Supprimé ! D:\autorun.inf
G:\autorun.inf -> fichier appelé : "G:\SUMICA///hrast.exe" ( Présent ! )
(!) Non supprimé ! G:\SUMICA///hrast.exe
G:\autorun.inf -> fichier appelé : "G:\SUMICA///hrast.exe" ( Présent ! )
(!) Non supprimé ! G:\SUMICA///hrast.exe
Supprimé ! G:\autorun.inf
Supprimé ! G:\CRNOVINO\casa.exe
Supprimé ! G:\CRNOVINO\Desktop.ini
Supprimé ! G:\CRNOVINO
Supprimé ! G:\KLIZAVI\desktop.ini
Supprimé ! G:\KLIZAVI
Supprimé ! G:\pozuda\malena.exe
Supprimé ! G:\pozuda
Supprimé ! G:\SVETEJEBLO\Desktop.ini
Supprimé ! G:\SVETEJEBLO\zeljko.exe
Supprimé ! G:\SVETEJEBLO
Supprimé ! G:\HJTInstall.exe

################## | Registre |


################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{2594dd1c-e9c8-11de-aa38-0022433096fe}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{3350b194-ac18-11de-a9da-0022433096fe}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{83de7642-cf8b-11dd-a876-b25596fc4b99}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[25/09/2008 00:22|--a------|12] C:\RECOVERY.DAT
[03/09/2008 00:12|--a------|1048576] C:\X71A.BIN
[25/09/2008 00:22|--a------|17] C:\X71A_X71Q.10
[15/08/2008 00:15|--a------|1048576] C:\X71Q.BIN
[02/03/2006 14:00|-rahs----|4952] C:\Bootfont.bin
[22/11/2009 13:50|-rahs----|252240] C:\ntldr
[02/03/2006 14:00|-rahs----|47564] C:\NTDETECT.COM
[14/08/2006 03:05|--a------|3] C:\SP2B.TXT
[19/09/2004 19:13|--a------|14] C:\XPPF_SP2.FRN
[10/12/2008 16:27|-rahs----|212] C:\boot.ini
[10/12/2008 15:34|--a------|0] C:\CONFIG.SYS
[10/12/2008 15:34|--a------|0] C:\AUTOEXEC.BAT
[10/12/2008 15:34|-rahs----|0] C:\IO.SYS
[10/12/2008 15:34|-rahs----|0] C:\MSDOS.SYS
[16/02/2010 19:41|--a------|38] C:\{ef7e9ed6-f05c-4a0b-95fe-f953ad276af6}
[17/02/2010 12:01|--a------|563] C:\Ad-Report-CLEAN[1].log
[17/02/2010 12:04|--a------|515] C:\Ad-Report-CLEAN[2].log
[17/02/2010 12:28|--a------|515] C:\Ad-Report-CLEAN[3].log
[17/02/2010 12:28|--a------|515] C:\Ad-Report-CLEAN[4].log
[17/02/2010 14:18|--a------|7580] C:\UsbFix.txt
[10/12/2008 16:05|--a------|726] C:\RHDSetup.log
[18/12/2009 23:43|--a------|0] C:\conmgr.log
[17/01/2009 10:23|--a------|194] C:\setup.log
[29/02/2004 16:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[04/04/2009 13:54|--a------|2056960000] C:\Track 01.iso
[19/08/2004 16:10|--a------|28672] D:\setupSNK.exe
[14/12/2009 20:06|--a------|15489] G:\Planning tests TC1-S1.ods
[14/01/2010 10:50|--ah-----|4096] G:\._.Trashes
[14/01/2010 11:18|--ah-----|6148] G:\.DS_Store
[07/02/2010 22:49|--a------|16808] G:\CV michael.odt
[29/12/2009 13:36|--a------|2175] G:\droit td theme 2.txt
[29/12/2009 15:30|--a------|3744] G:\td organisation judiciaire.txt
[31/01/2010 17:57|--a------|13174] G:\lettre de motivation.odt
[01/02/2010 17:20|--a------|20616] G:\Mise en pratique SATAS.odt
[05/02/2010 10:47|--a------|677271] G:\COCA COLA.pptx
[05/02/2010 20:22|--ah-----|165] G:\~$COCA COLA.pptx
[07/02/2010 22:46|--ah-----|135] G:\.~lock.CV michael.odt#
[19/01/2010 16:52|--a------|208203] G:\CV et lettre de motivation CHRISTELLE.odt
[11/02/2010 10:17|--a------|18644] G:\Songade Ushuaia.odt
[17/02/2010 10:42|--a------|5115824] G:\mbam-setup.exe
[17/02/2010 11:23|--a------|1263511] G:\AD-R.exe
[17/02/2010 10:53|--a------|9598] G:\hijackthis.log
[17/02/2010 12:01|--a------|563] G:\Ad-Report-CLEAN[1].log
[17/02/2010 12:04|--a------|515] G:\Ad-Report-CLEAN[2].log
[17/02/2010 12:24|--a------|549376] G:\OTL.exe
[17/02/2010 13:04|--a------|98320] G:\OTL.Txt
[17/02/2010 13:04|--a------|54710] G:\Extras.Txt
[17/02/2010 14:01|--a------|1771828] G:\UsbFix.exe
[09/02/2010 19:58|--a------|300741] G:\Go.exe
[15/02/2010 17:57|--a------|65491] G:\UsbFix.cmd
[17/02/2010 14:06|--a------|5096] G:\UsbFix.txt
[02/12/2009 08:25|--a------|27648] G:\ODE.doc

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# G:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).

################## | Upload |

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_NOM-3D47899AC5C.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.095 ! |


POur la prochaine manip à effectuer donne moi tes instructions, je vais aller faire un tour (dépot de CV) donc reste pas planté devant le PC à attendre ma réponse :p

Je pense que vers 17 je serai re =)

Merci !

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 14:43:28
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Voilà!

List'em by g3n-h@ckm@n 1.2.5.1

User : utilisateur (Administrateurs)
Update on 15/02/2010 by g3n-h@ckm@n ::::: 20.00
Start at: 14:35:29 | 17/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1368 [VPS 100217-0] 4.8.1368 [ Enabled | Updated ]

C:\ -> Disque fixe local | 133,84 Go (49,66 Go free) | FAT32
D:\ -> Disque fixe local | 89,22 Go (89,17 Go free) [DATA] | FAT32
E:\ -> Disque CD-ROM
G:\ -> Disque amovible | 7,49 Go (7,39 Go free) | FAT32

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\utilisateur\Local Settings\Temp\1.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\WINDOWS\system32\hkcmd.exe
Persistence REG_SZ C:\WINDOWS\system32\igfxpers.exe
MsgTranAgt REG_SZ C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
HControlUser REG_SZ C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
ATKHOTKEY REG_SZ C:\Program Files\ASUS\ATK Hotkey\HControl.exe
ATKOSD2 REG_SZ C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
RTHDCPL REG_SZ RTHDCPL.EXE
Alcmtr REG_SZ ALCMTR.EXE
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
ATKMEDIA REG_SZ C:\Program Files\ASUS\ATK Media\DMedia.exe
ACU REG_SZ "C:\Program Files\Atheros\ACU.exe" -nogui
Wireless Console 2 REG_SZ "C:\Program Files\Wireless Console 2\wcourier.exe"
ACMON REG_SZ "C:\Program Files\ASUS\Splendid\ACMON.exe"
EoEngine REG_SZ
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
HControl REG_SZ C:\WINDOWS\ATK0100\HControl.exe
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
HP Software Update REG_SZ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
<NO NAME> REG_SZ

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
NoDriveAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 255 (0xff)
NoDriveTypeAutoRun REG_DWORD 255 (0xff)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultUserName REG_SZ utilisateur
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DefaultPassword REG_SZ
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ utilisateur
AltDefaultDomainName REG_SZ NOM-3D47899AC5C
DefaultDomainName REG_SZ NOM-3D47899AC5C
GpNetworkStartTimeoutPolicyValue REG_DWORD 0 (0x0)
ChangePasswordUseKerberos REG_DWORD 1 (0x1)
Taskman REG_SZ C:\RECYCLER\S-1-5-21-8549988793-8136134255-067605186-6243\nissan.exe

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Steam\steamapps\mimipaul\counter-strike\hl.exe REG_SZ C:\Program Files\Steam\steamapps\mimipaul\counter-strike\hl.exe:*:Enabled:Half-Life Launcher
C:\Program Files\World of Warcraft\Repair.exe REG_SZ C:\Program Files\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility
C:\Program Files\Vuze\Azureus.exe REG_SZ C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus
C:\Program Files\Ubisoft\YouUp\YouUp.exe REG_SZ C:\Program Files\Ubisoft\YouUp\YouUp.exe:*:Enabled:YouUp
C:\Program Files\VALVe\Counter-Strike Source\hl2.exe REG_SZ C:\Program Files\VALVe\Counter-Strike Source\hl2.exe:*:Enabled:hl2
C:\Program Files\Microsoft Games\Halo\halo.exe REG_SZ C:\Program Files\Microsoft Games\Halo\halo.exe:*:Enabled:Halo
C:\Program Files\World of Warcraft\Launcher.exe REG_SZ C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher
C:\Program Files\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.1.0.9767-to-3.1.1.9806-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.1.0.9767-to-3.1.1.9806-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.1.1.9806-to-3.1.1.9835-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.1.1.9806-to-3.1.1.9835-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-frFR-downloader.exe:*:Enabled:Blizzard Downloader
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
C:\Program Files\HP\Digital Imaging\bin\hposid01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe
C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe
C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe
C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe
C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe
C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-frFR-downloader.exe:*:Enabled:Blizzard Downloader

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\utilisateur\Local Settings\Temp\1.tmp
## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys


Sources
=======

C:\WINDOWS\system32\drivers\atapi.sys
C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
C:\WINDOWS\ServicePackFiles\i386\atapi.sys
C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

Référence :
==========

Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
134 Go total, 49,66 Go libre (37%), 32% fragment‚ (fragmentation du fichier 64%)

Vous devriez d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\Program Files\AskBarDis
Present !! : C:\WINDOWS\002931_.tmp
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\SET*.tmp
Present !! : C:\Documents and Settings\utilisateur\Application Data\Desktopicon
Present !! : C:\Documents and Settings\utilisateur\Local Settings\Temp\dw.log
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\wlsetup-cvr.exe
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\hpzscr01.exe
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\hpzmsi01.exe
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\fkdvfge.exe
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\hpomdl11.dat
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\hposcr11.dat
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\Perflib_Perfdata_114.dat
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\swt-win32-3448.dll
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\swt-gdip-win32-3448.dll
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\mpengine.dll
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\tmp3C.tmp
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\tmp3F.tmp
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\tmp94.tmp
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\tmp57.tmp
Present !! : C:\Documents and Settings\utilisateur\LOCAL Settings\Temp\tmp58.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
Present !! : HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
Present !! : HKCU\Software\AppDataLow\AskBarDis
Present !! : HKCU\SOFTWARE\EoRezo
Present !! : HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
Present !! : HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
Present !! : HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
Present !! : HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
Present !! : HKLM\SOFTWARE\EoRezo
Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 14:43:28
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

Fichiers communs
Windows NT
MSN
MSN Gaming Zone
Messenger
Windows Media Player
Online Services
ComPlus Applications
Internet Explorer
Outlook Express
NetMeeting
Movie Maker
Services en ligne
WindowsUpdate
microsoft frontpage
xerox
Uninstall Information
Intel
InstallShield Installation Information
ATKGFNEX
ASUS
Realtek
Neuf
Samsung
OFFICE One 7.0
Java
OFFICE One v7
Reference Assemblies
MSBuild
OFFICE One Games
QuickTime
VideoLAN
Synaptics
Cisco
Atheros
Wireless Console 2
MSXML 4.0
MSXML 6.0
Windows Live
Windows Live SkyDrive
Microsoft
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Mozilla Firefox
Microsoft Games
Messenger Plus! Live
World of Warcraft
Vuze
AskBarDis
Microsoft Silverlight
Deus Ex - Invisible War
Smart Projects
Windows Media Connect 2
Ubisoft
Nero
GameSpy Arcade
WinRAR
SubDownloader2
Gabest
Project64 1.6
Maxis
TUGZip
calibre
InstallJammer Registry
Alwil Software
MSECache
Microsoft Office
HP
Hewlett-Packard
WowCartographe
Paladin Antivirus
Trend Micro
Malwarebytes' Anti-Malware
List_Kill'em

============
Drive C:
============

FOUND.000
Super Mario All-Stars
Super Smash Bros
Super Castlevania IV
FOUND.001
RECOVERY.DAT
X71A.BIN
X71A_X71Q.10
X71Q.BIN
FOUND.002
WINDOWS
RECYCLER
Bootfont.bin
ntldr
NTDETECT.COM
SP2B.TXT
XPPF_SP2.FRN
FOUND.003
VALUEADD
autorun.inf
boot.ini
Documents and Settings
Program Files
CONFIG.SYS
AUTOEXEC.BAT
IO.SYS
MSDOS.SYS
Street Fighter II - The World Warrior
Config.Msi
Ad-Remover
System Volume Information
{ef7e9ed6-f05c-4a0b-95fe-f953ad276af6}
Ad-Report-CLEAN[1].log
Ad-Report-CLEAN[2].log
Ad-Report-CLEAN[3].log
Ad-Report-CLEAN[4].log
Kill'em
List'em.txt
UsbFix_Upload_Me_NOM-3D47899AC5C.zip
Intel
RHDSetup.log
Recycled
conmgr.log
setup.log
orange.bmp
pagefile.sys
Track 01.iso
BFMC
directx
Redist
Nouveau dossier

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials





¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 14:43:51,37



C'est mieu ça non?
^^