Windows Security Alert / Antiv Software Alert

Voici le rapport :

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 20/02/2010|13:15 )

--------------------\\ Listing des dossiers dans APPLIC~1

[21/02/2008|20:59] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Adobe
[12/10/2008|15:24] C:\DOCUME~1\ALEXAN~1\APPLIC~1\AdobeUM
[15/03/2008|11:09] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Apple Computer
[14/09/2006|19:16] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Google
[01/01/2005|09:45] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Identities
[21/05/2005|20:21] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Intervideo
[06/05/2005|21:04] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Macromedia
[29/04/2009|20:16] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Microsoft
[19/10/2008|18:26] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Mostick
[24/11/2009|05:59] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Mozilla
[01/01/2005|14:41] C:\DOCUME~1\ALEXAN~1\APPLIC~1\SampleView
[07/03/2008|15:35] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Samsung
[01/01/2005|10:09] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Sun
[01/01/2005|13:07] C:\DOCUME~1\ALEXAN~1\APPLIC~1\Symantec

[01/01/2005|11:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[09/07/2007|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\allTunes
[19/02/2010|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
[07/06/2008|16:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[19/09/2006|21:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[27/12/2008|14:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[01/01/2005|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
[01/01/2005|11:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[01/01/2005|11:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo
[19/02/2010|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[04/10/2006|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[26/09/2009|17:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/01/2005|16:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[28/09/2006|15:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[01/01/2005|11:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[03/06/2005|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[07/06/2008|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
[07/04/2006|15:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
[11/11/2008|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UniversalisV11
[15/07/2006|15:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[20/02/2010|10:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[09/02/2008|12:58] C:\DOCUME~1\audrey\APPLIC~1\Adobe
[11/03/2009|19:25] C:\DOCUME~1\audrey\APPLIC~1\AdobeUM
[12/07/2007|12:09] C:\DOCUME~1\audrey\APPLIC~1\allTunes
[01/01/2005|11:20] C:\DOCUME~1\audrey\APPLIC~1\Apple Computer
[09/09/2006|21:37] C:\DOCUME~1\audrey\APPLIC~1\Google
[17/04/2006|17:09] C:\DOCUME~1\audrey\APPLIC~1\Help
[01/01/2005|09:45] C:\DOCUME~1\audrey\APPLIC~1\Identities
[04/06/2006|13:51] C:\DOCUME~1\audrey\APPLIC~1\Intervideo
[17/04/2006|17:09] C:\DOCUME~1\audrey\APPLIC~1\Jasc
[06/05/2005|21:41] C:\DOCUME~1\audrey\APPLIC~1\Macromedia
[19/08/2007|14:28] C:\DOCUME~1\audrey\APPLIC~1\Microsoft
[01/01/2005|14:41] C:\DOCUME~1\audrey\APPLIC~1\SampleView
[01/04/2007|17:22] C:\DOCUME~1\audrey\APPLIC~1\SecuROM
[01/01/2005|10:09] C:\DOCUME~1\audrey\APPLIC~1\Sun
[01/01/2005|13:07] C:\DOCUME~1\audrey\APPLIC~1\Symantec

[13/02/2008|14:20] C:\DOCUME~1\aurelie\APPLIC~1\Adobe
[05/04/2009|18:03] C:\DOCUME~1\aurelie\APPLIC~1\AdobeUM
[21/07/2007|13:14] C:\DOCUME~1\aurelie\APPLIC~1\allTunes
[01/01/2005|11:20] C:\DOCUME~1\aurelie\APPLIC~1\Apple Computer
[09/09/2006|10:30] C:\DOCUME~1\aurelie\APPLIC~1\Google
[09/04/2006|10:43] C:\DOCUME~1\aurelie\APPLIC~1\Help
[01/01/2005|09:45] C:\DOCUME~1\aurelie\APPLIC~1\Identities
[22/05/2005|10:54] C:\DOCUME~1\aurelie\APPLIC~1\Intervideo
[09/04/2006|10:43] C:\DOCUME~1\aurelie\APPLIC~1\Jasc
[02/04/2006|15:18] C:\DOCUME~1\aurelie\APPLIC~1\Leadertech
[05/05/2005|21:14] C:\DOCUME~1\aurelie\APPLIC~1\Macromedia
[07/01/2009|19:10] C:\DOCUME~1\aurelie\APPLIC~1\Microsoft
[01/01/2005|14:41] C:\DOCUME~1\aurelie\APPLIC~1\SampleView
[07/04/2007|16:36] C:\DOCUME~1\aurelie\APPLIC~1\SecuROM
[02/04/2006|15:18] C:\DOCUME~1\aurelie\APPLIC~1\Sonic
[01/01/2005|10:09] C:\DOCUME~1\aurelie\APPLIC~1\Sun
[01/01/2005|13:07] C:\DOCUME~1\aurelie\APPLIC~1\Symantec

[01/01/2005|11:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[01/01/2005|09:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/01/2005|11:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intervideo
[01/01/2005|16:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/01/2005|14:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView
[01/01/2005|10:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[01/01/2005|13:07] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

[28/02/2008|15:49] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[02/12/2007|22:55] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[01/05/2005|17:49] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec

[20/02/2008|15:54] C:\DOCUME~1\STEPHA~1\APPLIC~1\Adobe
[05/01/2006|12:13] C:\DOCUME~1\STEPHA~1\APPLIC~1\AdobeUM
[10/07/2007|12:56] C:\DOCUME~1\STEPHA~1\APPLIC~1\allTunes
[01/01/2005|11:20] C:\DOCUME~1\STEPHA~1\APPLIC~1\Apple Computer
[09/09/2006|14:02] C:\DOCUME~1\STEPHA~1\APPLIC~1\Google
[27/03/2006|20:35] C:\DOCUME~1\STEPHA~1\APPLIC~1\Help
[01/01/2005|09:45] C:\DOCUME~1\STEPHA~1\APPLIC~1\Identities
[27/12/2005|12:03] C:\DOCUME~1\STEPHA~1\APPLIC~1\Intervideo
[27/03/2006|20:28] C:\DOCUME~1\STEPHA~1\APPLIC~1\Jasc
[05/05/2005|21:00] C:\DOCUME~1\STEPHA~1\APPLIC~1\Macromedia
[28/09/2006|16:45] C:\DOCUME~1\STEPHA~1\APPLIC~1\Microsoft
[28/09/2006|15:50] C:\DOCUME~1\STEPHA~1\APPLIC~1\MSN6
[28/09/2006|15:52] C:\DOCUME~1\STEPHA~1\APPLIC~1\MSNInstaller
[01/01/2005|14:41] C:\DOCUME~1\STEPHA~1\APPLIC~1\SampleView
[01/01/2005|10:09] C:\DOCUME~1\STEPHA~1\APPLIC~1\Sun
[01/06/2005|15:46] C:\DOCUME~1\STEPHA~1\APPLIC~1\Symantec
[29/03/2006|20:49] C:\DOCUME~1\STEPHA~1\APPLIC~1\Ulead Systems

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[20/02/2010 12:17][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[20/02/2010 13:14][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[18/02/2010 09:09][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[20/02/2010 13:08][--a------] C:\WINDOWS\tasks\Symantec NetDetect.job
[05/08/2004 11:00][-rah-----] C:\WINDOWS\tasks\desktop.ini
[20/02/2010 13:13][--ah-----] C:\WINDOWS\tasks\SA.DAT

--------------------\\ Listing des dossiers dans C:\Program Files

[14/01/2010|21:11] C:\Program Files\AbiWord
[05/05/2005|11:31] C:\Program Files\Activision
[07/08/2007|08:34] C:\Program Files\Adobe
[09/07/2007|20:25] C:\Program Files\allTunes
[19/02/2010|15:57] C:\Program Files\AntiVir PersonalEdition Classic
[07/06/2008|16:18] C:\Program Files\Apple Software Update
[07/08/2007|08:34] C:\Program Files\ASCII Art Generator
[01/05/2005|13:24] C:\Program Files\ATI Technologies
[12/06/2005|14:09] C:\Program Files\Bethesda Softworks
[07/06/2008|16:21] C:\Program Files\Bonjour
[18/11/2007|12:00] C:\Program Files\Canon
[19/02/2010|23:01] C:\Program Files\CCleaner
[05/10/2006|20:52] C:\Program Files\ChessBase
[07/08/2007|08:36] C:\Program Files\Club-Internet
[01/05/2005|14:00] C:\Program Files\Common Files
[07/09/2006|13:56] C:\Program Files\CorelPaintShopProX
[07/08/2007|08:34] C:\Program Files\EA Games
[07/08/2007|09:02] C:\Program Files\Easy Internet signup
[08/05/2005|19:32] C:\Program Files\fdjeux
[16/12/2006|15:17] C:\Program Files\FFE
[26/09/2009|17:30] C:\Program Files\Fichiers communs
[31/01/2010|10:11] C:\Program Files\Google
[16/05/2008|05:32] C:\Program Files\Guitar Pro 5
[29/08/2006|19:42] C:\Program Files\HardwareDetection
[01/01/2005|16:16] C:\Program Files\Help and Support Additions
[01/01/2005|10:43] C:\Program Files\Hewlett-Packard
[01/01/2005|10:58] C:\Program Files\HP
[10/02/2007|08:53] C:\Program Files\IGN Rando
[23/02/2009|11:37] C:\Program Files\InstallShield Installation Information
[23/01/2010|11:00] C:\Program Files\Internet Explorer
[07/06/2008|16:24] C:\Program Files\iPod
[07/06/2008|16:24] C:\Program Files\iTunes
[27/03/2006|20:16] C:\Program Files\Jasc Software Inc
[13/04/2006|05:55] C:\Program Files\Java
[07/01/2007|12:04] C:\Program Files\LilyPond
[19/02/2010|20:43] C:\Program Files\Malwarebytes' Anti-Malware
[22/02/2009|11:49] C:\Program Files\Maxis
[14/08/2008|23:22] C:\Program Files\Messenger
[21/10/2007|11:28] C:\Program Files\Messenger Plus! Live
[28/09/2006|16:51] C:\Program Files\MessengerPlus! 3
[26/09/2009|17:38] C:\Program Files\Microsoft
[27/09/2009|21:57] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/01/2005|09:45] C:\Program Files\microsoft frontpage
[29/04/2006|10:08] C:\Program Files\Microsoft Games
[08/05/2005|11:03] C:\Program Files\Microsoft Office
[01/01/2005|09:43] C:\Program Files\Movie Maker
[08/05/2005|19:28] C:\Program Files\msjavwu_w
[28/09/2006|15:52] C:\Program Files\MSN
[01/05/2005|15:24] C:\Program Files\MSN Apps
[01/01/2005|09:41] C:\Program Files\MSN Gaming Zone
[26/09/2009|17:39] C:\Program Files\MSN Messenger
[15/08/2007|22:25] C:\Program Files\MSXML 4.0
[19/02/2010|22:52] C:\Program Files\Navilog1
[01/01/2005|10:07] C:\Program Files\NetMeeting
[03/06/2005|21:16] C:\Program Files\Norton AntiVirus
[01/01/2005|09:42] C:\Program Files\Online Services
[12/08/2009|21:33] C:\Program Files\Outlook Express
[01/01/2005|16:18] C:\Program Files\PC-Doctor for Windows
[01/05/2005|16:28] C:\Program Files\Philips PC VGA Camera
[30/04/2008|18:07] C:\Program Files\PhotoFiltre
[07/06/2008|16:21] C:\Program Files\QuickTime
[26/09/2006|12:39] C:\Program Files\QuickZip4
[27/06/2008|05:41] C:\Program Files\Research In Motion
[06/01/2008|19:45] C:\Program Files\Riven
[07/03/2008|15:30] C:\Program Files\Samsung
[26/09/2006|11:59] C:\Program Files\Seagrand
[01/01/2005|16:25] C:\Program Files\Services en ligne
[02/01/2005|00:27] C:\Program Files\SiS VGA Utilities V3.63
[01/01/2005|11:08] C:\Program Files\Sonic
[01/01/2005|11:08] C:\Program Files\Sonic RecordNow!
[10/05/2005|20:07] C:\Program Files\Talkway
[06/05/2005|21:30] C:\Program Files\The One Ring 3D Screensaver
[12/08/2009|21:21] C:\Program Files\TomTom HOME 2
[12/08/2009|21:21] C:\Program Files\TomTom International B.V
[07/08/2007|08:04] C:\Program Files\Ubi Soft
[15/08/2006|15:04] C:\Program Files\UbiSoft
[29/03/2006|20:48] C:\Program Files\Ulead Systems
[22/01/2006|23:06] C:\Program Files\Universalis
[01/05/2005|16:43] C:\Program Files\VideoLink
[26/08/2006|19:39] C:\Program Files\vmntoolbar
[07/08/2007|08:36] C:\Program Files\Warcraft III
[27/12/2008|19:11] C:\Program Files\Western Digital
[26/09/2009|17:39] C:\Program Files\Windows Live
[26/09/2009|17:38] C:\Program Files\Windows Live SkyDrive
[15/08/2007|22:25] C:\Program Files\Windows Media Player
[01/01/2005|10:07] C:\Program Files\Windows NT
[07/08/2007|08:21] C:\Program Files\WinRAR
[01/01/2005|09:45] C:\Program Files\xerox
[14/11/2006|07:09] C:\Program Files\Xvid
[19/02/2010|23:01] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[31/03/2006|12:56] C:\Program Files\Fichiers communs\Adobe
[07/06/2008|16:18] C:\Program Files\Fichiers communs\Apple
[08/05/2005|11:03] C:\Program Files\Fichiers communs\Designer
[01/01/2005|10:54] C:\Program Files\Fichiers communs\Hewlett-Packard
[01/01/2005|10:48] C:\Program Files\Fichiers communs\HP
[01/01/2005|11:19] C:\Program Files\Fichiers communs\InstallShield
[01/01/2005|10:09] C:\Program Files\Fichiers communs\Java
[14/01/2010|20:45] C:\Program Files\Fichiers communs\Microsoft Shared
[01/01/2005|09:43] C:\Program Files\Fichiers communs\MSSoap
[04/02/2007|13:04] C:\Program Files\Fichiers communs\Nullsoft
[13/08/2007|15:53] C:\Program Files\Fichiers communs\ODBC
[27/06/2008|05:41] C:\Program Files\Fichiers communs\Research In Motion
[01/01/2005|10:07] C:\Program Files\Fichiers communs\Services
[07/08/2007|07:59] C:\Program Files\Fichiers communs\Smith Micro Shared
[01/01/2005|10:38] C:\Program Files\Fichiers communs\SpeechEngines
[01/01/2005|11:09] C:\Program Files\Fichiers communs\SureThing Shared
[03/06/2005|21:34] C:\Program Files\Fichiers communs\Symantec Shared
[13/06/2007|21:22] C:\Program Files\Fichiers communs\System
[07/08/2007|08:34] C:\Program Files\Fichiers communs\Vbox
[26/09/2009|17:30] C:\Program Files\Fichiers communs\Windows Live

--------------------\\ Process

( 35 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\nst2F0.tmp
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\nst34.tmp
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\nsx129.tmp

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:1346][D:48]-> C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp
[F:5][D:0]-> C:\DOCUME~1\HP_PRO~1\Cookies
[F:54][D:32]-> C:\DOCUME~1\HP_PRO~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 20/02/2010|13:16 - Option : [1]

--------------------\\ Fin du rapport a 13:16:39

C'est fait. Voici le lien :

http://www.cijoint.fr/cjlink.php?file=cj201002/cij44ROVbW.txt

Voici le rapport Usbfix.
Le rapport Malwarebyte suit ...

############################## | UsbFix V6.097 |

User : HP_Propriétaire (Administrateurs) # BUREAU
Update on 20/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 23:10:29 | 20/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Athlon(tm) 64 Processor 3000+
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | Updated ]

C:\ -> Disque fixe local # 144,25 Go (74,43 Go free) [HP_PAVILION] # NTFS
D:\ -> Disque fixe local # 4,78 Go (1012,93 Mo free) [HP_RECOVERY] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque amovible # 1,91 Go (1,91 Go free) # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

Supprimé ! C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\AutoRun.exe
Supprimé ! C:\ncbc.vbs
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1007
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1008
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1009
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1010
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1011
Supprimé ! D:\autorun.inf

################## | Registre |

################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{1dd35981-34b8-11dd-98c6-001109eff965}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{511e56d0-c0fb-11dd-9977-001109eff965}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{886d5614-d441-11dd-9991-001109eff965}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[01/01/2005 09:44|--a------|0] C:\AUTOEXEC.BAT
[01/05/2005 13:23|-rahs----|218] C:\BOOT.BAK
[01/05/2005 15:58|-rahs----|298] C:\boot.ini
[05/08/2004 04:00|-rahs----|4952] C:\Bootfont.bin
[19/02/2010 22:52|--a------|956] C:\cleannavi.txt
[05/08/2004 04:00|-r-hs----|263488] C:\cmldr
[01/01/2005 09:44|--a------|0] C:\CONFIG.SYS
[07/11/2007 08:00|--a------|17734] C:\eula.1028.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1031.txt
[07/11/2007 08:00|--a------|10134] C:\eula.1033.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1036.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1040.txt
[07/11/2007 08:00|--a------|118] C:\eula.1041.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1042.txt
[07/11/2007 08:00|--a------|17734] C:\eula.2052.txt
[07/11/2007 08:00|--a------|17734] C:\eula.3082.txt
[07/11/2007 08:00|--a------|1110] C:\globdata.ini
[01/01/2005 10:00|--ah-----|2] C:\hpbi.log
[07/11/2007 08:03|--a------|562688] C:\install.exe
[07/11/2007 08:00|--a------|843] C:\install.ini
[07/11/2007 08:03|--a------|76304] C:\install.res.1028.dll
[07/11/2007 08:03|--a------|96272] C:\install.res.1031.dll
[07/11/2007 08:03|--a------|91152] C:\install.res.1033.dll
[07/11/2007 08:03|--a------|97296] C:\install.res.1036.dll
[07/11/2007 08:03|--a------|95248] C:\install.res.1040.dll
[07/11/2007 08:03|--a------|81424] C:\install.res.1041.dll
[07/11/2007 08:03|--a------|79888] C:\install.res.1042.dll
[07/11/2007 08:03|--a------|75792] C:\install.res.2052.dll
[07/11/2007 08:03|--a------|96272] C:\install.res.3082.dll
[01/01/2005 09:44|-rahs----|0] C:\IO.SYS
[20/02/2010 13:16|--a------|13967] C:\lopR.txt
[01/01/2005 09:44|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 04:00|-rahs----|47564] C:\NTDETECT.COM
[05/08/2004 04:00|-rahs----|251712] C:\ntldr
[30/03/2006 18:33|--ah-----|546] C:\os357577.bin
[?|?|?] C:\pagefile.sys
[24/09/2006 22:26|--a------|601] C:\PAT1.MYS
[07/08/2007 08:24|--a------|9152] C:\playout.txt
[18/09/2006 20:33|--a------|2405] C:\tracert.txt
[20/02/2010 23:21|--a------|5177] C:\UsbFix.txt
[07/11/2007 08:00|--a------|5686] C:\vcredist.bmp
[07/11/2007 08:09|--a------|1442522] C:\VC_RED.cab
[07/11/2007 08:12|--a------|232960] C:\VC_RED.MSI
[29/10/2006 15:56|--ah-----|3188] C:\ZbThumbnail.info
[03/09/2008 17:44|--a------|1185] C:\_Sid.txt
[27/07/2001 22:07|---hs----|0] D:\AUTOEXEC.BAT
[09/01/2002 11:52|---hs----|244] D:\BOOT.INI
[17/08/2001 01:26|---hs----|237728] D:\CMLDR
[27/07/2001 22:07|---hs----|0] D:\CONFIG.SYS
[09/09/2002 15:14|---hs----|100] D:\Desktop.ini
[24/02/2004 17:38|--a------|498] D:\BATCH.OLD
[30/04/2004 14:00|---hs----|73728] D:\Info.exe
[27/07/2001 22:07|---hs----|0] D:\IO.SYS
[27/07/2001 22:07|---hs----|0] D:\MSDOS.SYS
[25/07/2001 14:00|---hs----|45124] D:\NTDETECT.COM
[25/07/2001 14:00|---hs----|222880] D:\NTLDR
[29/04/2004 15:37|---hs----|4096] D:\Thumbs.db
[08/02/2002 16:44|---hs----|88038] D:\Warning.bmp
[01/12/2004 19:13|---hs----|26] D:\BLOCK.RIN
[25/01/2002 10:21|---hs----|0] D:\GRAPH16
[30/04/2001 12:16|---hs----|14] D:\Graph
[01/12/2004 19:16|---hs----|980] D:\MASTER.LOG
[17/08/2001 07:32|---hs----|0] D:\NTFS
[30/04/2001 12:16|---hs----|14] D:\SVGA
[01/12/2004 18:35|---hs----|36] D:\SaveFile.Dir
[18/08/2001 07:00|---hs----|10] D:\WIN51
[22/01/2001 07:00|---hs----|11] D:\WIN51.B2
[25/07/2001 07:00|---hs----|11] D:\WIN51.RC1
[25/07/2001 12:47|---hs----|11] D:\WIN51.RC2
[18/08/2001 07:00|---hs----|10] D:\WIN51IC
[20/03/2001 07:00|---hs----|11] D:\WIN51IC.B2
[25/07/2001 07:00|---hs----|11] D:\WIN51IC.RC1
[25/07/2001 07:00|---hs----|11] D:\WIN51IC.RC2
[17/08/2001 07:00|---hs----|10] D:\WIN51IP
[22/01/2001 07:00|---hs----|11] D:\WIN51IP.B2
[25/07/2001 12:47|---hs----|11] D:\WIN51IP.RC2
[17/08/2001 05:17|---hs----|184] D:\WINBOM.INI
[10/09/2002 09:21|---hs----|7850] D:\Folder.htt
[10/09/2002 06:58|---hs----|181616] D:\protect.ed
[01/12/2004 19:16|--ahs----|980] D:\USER
[01/01/2005 02:18|--ahs----|1552] D:\BATCH.LOG
[13/08/2009 18:20|--a------|1518] K:\BOOTEX.LOG
[04/06/2009 21:09|--a------|98304] K:\ebay.xls
[07/07/2009 15:33|--a------|29037] K:\00050221861 1 .xls
[17/08/2009 17:57|--a------|247296] K:\Albums vinil - CD - DVD.xls
[20/02/2010 13:16|--a------|13967] K:\lopR.txt
[02/06/2009 15:40|--a------|13824] K:\Classeur1.xls

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# K:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).

################## | Upload |

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_BUREAU.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.097 ! |

Voici le rapport Usbfix.
Le rapport Malwarebyte suit ...

############################## | UsbFix V6.097 |

User : HP_Propriétaire (Administrateurs) # BUREAU
Update on 20/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 23:10:29 | 20/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Athlon(tm) 64 Processor 3000+
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | Updated ]

C:\ -> Disque fixe local # 144,25 Go (74,43 Go free) [HP_PAVILION] # NTFS
D:\ -> Disque fixe local # 4,78 Go (1012,93 Mo free) [HP_RECOVERY] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque amovible # 1,91 Go (1,91 Go free) # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

Supprimé ! C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\AutoRun.exe
Supprimé ! C:\ncbc.vbs
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1007
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1008
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1009
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1010
Supprimé ! C:\Recycler\S-1-5-21-2913699471-2927548895-2967041176-1011
Supprimé ! D:\autorun.inf

################## | Registre |

################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{1dd35981-34b8-11dd-98c6-001109eff965}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{511e56d0-c0fb-11dd-9977-001109eff965}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{886d5614-d441-11dd-9991-001109eff965}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[01/01/2005 09:44|--a------|0] C:\AUTOEXEC.BAT
[01/05/2005 13:23|-rahs----|218] C:\BOOT.BAK
[01/05/2005 15:58|-rahs----|298] C:\boot.ini
[05/08/2004 04:00|-rahs----|4952] C:\Bootfont.bin
[19/02/2010 22:52|--a------|956] C:\cleannavi.txt
[05/08/2004 04:00|-r-hs----|263488] C:\cmldr
[01/01/2005 09:44|--a------|0] C:\CONFIG.SYS
[07/11/2007 08:00|--a------|17734] C:\eula.1028.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1031.txt
[07/11/2007 08:00|--a------|10134] C:\eula.1033.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1036.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1040.txt
[07/11/2007 08:00|--a------|118] C:\eula.1041.txt
[07/11/2007 08:00|--a------|17734] C:\eula.1042.txt
[07/11/2007 08:00|--a------|17734] C:\eula.2052.txt
[07/11/2007 08:00|--a------|17734] C:\eula.3082.txt
[07/11/2007 08:00|--a------|1110] C:\globdata.ini
[01/01/2005 10:00|--ah-----|2] C:\hpbi.log
[07/11/2007 08:03|--a------|562688] C:\install.exe
[07/11/2007 08:00|--a------|843] C:\install.ini
[07/11/2007 08:03|--a------|76304] C:\install.res.1028.dll
[07/11/2007 08:03|--a------|96272] C:\install.res.1031.dll
[07/11/2007 08:03|--a------|91152] C:\install.res.1033.dll
[07/11/2007 08:03|--a------|97296] C:\install.res.1036.dll
[07/11/2007 08:03|--a------|95248] C:\install.res.1040.dll
[07/11/2007 08:03|--a------|81424] C:\install.res.1041.dll
[07/11/2007 08:03|--a------|79888] C:\install.res.1042.dll
[07/11/2007 08:03|--a------|75792] C:\install.res.2052.dll
[07/11/2007 08:03|--a------|96272] C:\install.res.3082.dll
[01/01/2005 09:44|-rahs----|0] C:\IO.SYS
[20/02/2010 13:16|--a------|13967] C:\lopR.txt
[01/01/2005 09:44|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 04:00|-rahs----|47564] C:\NTDETECT.COM
[05/08/2004 04:00|-rahs----|251712] C:\ntldr
[30/03/2006 18:33|--ah-----|546] C:\os357577.bin
[?|?|?] C:\pagefile.sys
[24/09/2006 22:26|--a------|601] C:\PAT1.MYS
[07/08/2007 08:24|--a------|9152] C:\playout.txt
[18/09/2006 20:33|--a------|2405] C:\tracert.txt
[20/02/2010 23:21|--a------|5177] C:\UsbFix.txt
[07/11/2007 08:00|--a------|5686] C:\vcredist.bmp
[07/11/2007 08:09|--a------|1442522] C:\VC_RED.cab
[07/11/2007 08:12|--a------|232960] C:\VC_RED.MSI
[29/10/2006 15:56|--ah-----|3188] C:\ZbThumbnail.info
[03/09/2008 17:44|--a------|1185] C:\_Sid.txt
[27/07/2001 22:07|---hs----|0] D:\AUTOEXEC.BAT
[09/01/2002 11:52|---hs----|244] D:\BOOT.INI
[17/08/2001 01:26|---hs----|237728] D:\CMLDR
[27/07/2001 22:07|---hs----|0] D:\CONFIG.SYS
[09/09/2002 15:14|---hs----|100] D:\Desktop.ini
[24/02/2004 17:38|--a------|498] D:\BATCH.OLD
[30/04/2004 14:00|---hs----|73728] D:\Info.exe
[27/07/2001 22:07|---hs----|0] D:\IO.SYS
[27/07/2001 22:07|---hs----|0] D:\MSDOS.SYS
[25/07/2001 14:00|---hs----|45124] D:\NTDETECT.COM
[25/07/2001 14:00|---hs----|222880] D:\NTLDR
[29/04/2004 15:37|---hs----|4096] D:\Thumbs.db
[08/02/2002 16:44|---hs----|88038] D:\Warning.bmp
[01/12/2004 19:13|---hs----|26] D:\BLOCK.RIN
[25/01/2002 10:21|---hs----|0] D:\GRAPH16
[30/04/2001 12:16|---hs----|14] D:\Graph
[01/12/2004 19:16|---hs----|980] D:\MASTER.LOG
[17/08/2001 07:32|---hs----|0] D:\NTFS
[30/04/2001 12:16|---hs----|14] D:\SVGA
[01/12/2004 18:35|---hs----|36] D:\SaveFile.Dir
[18/08/2001 07:00|---hs----|10] D:\WIN51
[22/01/2001 07:00|---hs----|11] D:\WIN51.B2
[25/07/2001 07:00|---hs----|11] D:\WIN51.RC1
[25/07/2001 12:47|---hs----|11] D:\WIN51.RC2
[18/08/2001 07:00|---hs----|10] D:\WIN51IC
[20/03/2001 07:00|---hs----|11] D:\WIN51IC.B2
[25/07/2001 07:00|---hs----|11] D:\WIN51IC.RC1
[25/07/2001 07:00|---hs----|11] D:\WIN51IC.RC2
[17/08/2001 07:00|---hs----|10] D:\WIN51IP
[22/01/2001 07:00|---hs----|11] D:\WIN51IP.B2
[25/07/2001 12:47|---hs----|11] D:\WIN51IP.RC2
[17/08/2001 05:17|---hs----|184] D:\WINBOM.INI
[10/09/2002 09:21|---hs----|7850] D:\Folder.htt
[10/09/2002 06:58|---hs----|181616] D:\protect.ed
[01/12/2004 19:16|--ahs----|980] D:\USER
[01/01/2005 02:18|--ahs----|1552] D:\BATCH.LOG
[13/08/2009 18:20|--a------|1518] K:\BOOTEX.LOG
[04/06/2009 21:09|--a------|98304] K:\ebay.xls
[07/07/2009 15:33|--a------|29037] K:\00050221861 1 .xls
[17/08/2009 17:57|--a------|247296] K:\Albums vinil - CD - DVD.xls
[20/02/2010 13:16|--a------|13967] K:\lopR.txt
[02/06/2009 15:40|--a------|13824] K:\Classeur1.xls

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# K:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).

################## | Upload |

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_BUREAU.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.097 ! |

Bonjour,

Long ! effectivement. Je ne suis pas resté jusqu'au bout :)

Voici le rapport :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

21/02/2010 08:13:59
mbam-log-2010-02-21 (08-13-59).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 392589
Temps écoulé: 3 hour(s), 3 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Voici le lien :

http://www.cijoint.fr/cjlink.php?file=cj201002/cijrmd8m2h.txt

Voici le rapport sur le premier fichier :

Fichier fodpsftav.exe reçu le 2010.02.21 11:53:39 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Résultat: 25/41 (60.98%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 42 et 60 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.02.21 Trojan.Win32.FakeAV!IK
AhnLab-V3 5.0.0.2 2010.02.20 -
AntiVir 8.2.1.170 2010.02.19 TR/FraudPack.alqv
Antiy-AVL 2.0.3.7 2010.02.19 -
Authentium 5.2.0.5 2010.02.20 -
Avast 4.8.1351.0 2010.02.21 Win32:Spyware-gen
AVG 9.0.0.730 2010.02.21 FakeAV.MJ
BitDefender 7.2 2010.02.21 -
CAT-QuickHeal 10.00 2010.02.19 -
ClamAV 0.96.0.0-git 2010.02.21 -
Comodo 4011 2010.02.21 TrojWare.Win32.FraudPack.alqv
DrWeb 5.0.1.12222 2010.02.21 -
eSafe 7.0.17.0 2010.02.18 -
eTrust-Vet 35.2.7315 2010.02.20 Win32/AntivirusLive.H
F-Prot 4.5.1.85 2010.02.20 -
F-Secure 9.0.15370.0 2010.02.19 -
Fortinet 4.0.14.0 2010.02.20 W32/FraudPack.ALQV!tr
GData 19 2010.02.21 Win32:Spyware-gen
Ikarus T3.1.1.80.0 2010.02.21 Trojan.Win32.FakeAV
Jiangmin 13.0.900 2010.02.21 Trojan/FraudPack.ovt
K7AntiVirus 7.10.979 2010.02.20 -
Kaspersky 7.0.0.125 2010.02.17 -
McAfee 5898 2010.02.20 FakeAlert-SpyPro.gen.c
McAfee+Artemis 5898 2010.02.20 FakeAlert-SpyPro.gen.c
McAfee-GW-Edition 6.8.5 2010.02.19 Heuristic.LooksLike.Win32.Suspicious.I
Microsoft 1.5406 2010.02.21 Trojan:Win32/FakeSpypro
NOD32 4883 2010.02.20 a variant of Win32/Kryptik.CMG
Norman 6.04.08 2010.02.21 W32/FakeAV.LFQ
nProtect 2009.1.8.0 2010.02.21 -
Panda 10.0.2.2 2010.02.21 Trj/CI.A
PCTools 7.0.3.5 2010.02.21 Trojan.FakeAV
Prevx 3.0 2010.02.21 High Risk Fraudulent Security Program
Rising 22.34.01.03 2010.02.11 -
Sophos 4.50.0 2010.02.21 Troj/FakeAV-AUX
Sunbelt 5690 2010.02.20 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.02.21 Trojan.FakeAV
TheHacker 6.5.1.5.202 2010.02.21 Trojan/FraudPack.alqv
TrendMicro 9.120.0.1004 2010.02.21 TROJ_FAKEAV.EAO
VBA32 3.12.12.2 2010.02.21 -
ViRobot 2010.2.19.2194 2010.02.19 -
VirusBuster 5.0.27.0 2010.02.20 Trojan.FraudPack.XWO
Information additionnelle
File size: 278784 bytes
MD5...: 0661cc7de7c767ea3c5a802cf0d57023
SHA1..: 47aa068b0587e625b3b759210bb3b642d8dcfd7f
SHA256: 04ff2d0264f5b4715c690c180ead1cdabda618111e6810cfd178d70736eda573
ssdeep: 6144:AZHxpD7ufgTJvuyYZ99wfHxFuB8nKIDmmDF7kLvpYk2nBcbR4Dy8:ABxBuI
TJvuyYZ96PyBimmDF7svmkABcS

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x76830
timedatestamp.....: 0x4b7d7a78 (Thu Feb 18 17:35:52 2010)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x32000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x33000 0x44000 0x43a00 7.78 be5a6e4ef4bb26c4c5a0fb1bc3b71747
.rsrc 0x77000 0x1000 0x200 3.47 77d15c0f01058b7e5b2f173b741cd865

( 3 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> SHLWAPI.dll: UrlHashA
> USER32.dll: GetMessageA

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: UPX compressed Win32 Executable (42.6%)
Win32 EXE Yoda's Crypter (37.0%)
Win32 Executable Generic (11.8%)
Clipper DOS Executable (2.8%)
Generic Win/DOS Executable (2.7%)
packers (Kaspersky): PE_Patch.UPX, UPX
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=B4A8B21D00291FE341180463229F9F00720DA9C4' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=B4A8B21D00291FE341180463229F9F00720DA9C4</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

packers (F-Prot): UPX

@pherce...et le second :

Fichier WMP10.inf reçu le 2010.02.21 12:01:46 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Résultat: 0/41 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 42 et 60 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.02.21 -
AhnLab-V3 5.0.0.2 2010.02.20 -
AntiVir 8.2.1.170 2010.02.19 -
Antiy-AVL 2.0.3.7 2010.02.19 -
Authentium 5.2.0.5 2010.02.20 -
Avast 4.8.1351.0 2010.02.21 -
AVG 9.0.0.730 2010.02.21 -
BitDefender 7.2 2010.02.21 -
CAT-QuickHeal 10.00 2010.02.19 -
ClamAV 0.96.0.0-git 2010.02.21 -
Comodo 4011 2010.02.21 -
DrWeb 5.0.1.12222 2010.02.21 -
eSafe 7.0.17.0 2010.02.18 -
eTrust-Vet 35.2.7315 2010.02.20 -
F-Prot 4.5.1.85 2010.02.20 -
F-Secure 9.0.15370.0 2010.02.19 -
Fortinet 4.0.14.0 2010.02.20 -
GData 19 2010.02.21 -
Ikarus T3.1.1.80.0 2010.02.21 -
Jiangmin 13.0.900 2010.02.21 -
K7AntiVirus 7.10.979 2010.02.20 -
Kaspersky 7.0.0.125 2010.02.17 -
McAfee 5898 2010.02.20 -
McAfee+Artemis 5898 2010.02.20 -
McAfee-GW-Edition 6.8.5 2010.02.19 -
Microsoft 1.5406 2010.02.21 -
NOD32 4883 2010.02.20 -
Norman 6.04.08 2010.02.21 -
nProtect 2009.1.8.0 2010.02.21 -
Panda 10.0.2.2 2010.02.21 -
PCTools 7.0.3.5 2010.02.21 -
Prevx 3.0 2010.02.21 -
Rising 22.34.01.03 2010.02.11 -
Sophos 4.50.0 2010.02.21 -
Sunbelt 5690 2010.02.20 -
Symantec 20091.2.0.41 2010.02.21 -
TheHacker 6.5.1.5.202 2010.02.21 -
TrendMicro 9.120.0.1004 2010.02.21 -
VBA32 3.12.12.2 2010.02.21 -
ViRobot 2010.2.19.2194 2010.02.19 -
VirusBuster 5.0.27.0 2010.02.20 -
Information additionnelle
File size: 34820 bytes
MD5...: 2ae1534edf4a6e80bfdafb7fc5c73e8e
SHA1..: d954f057d588d87a4985689668dad8c1869dc0ce
SHA256: f57b589e7678f558fce9fda7bbf9efd4209e6ac65b2ffcdb67ab28a723230ba0
ssdeep: 768:8sZXi05jCBXrSff9qvfKfnDIBWOUW4zjYlk:3ZXi05jCBXrSff9qvfKfnDIB
WOUDzjYW

PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Unknown!
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

J'ai un problème.

Depuis le début, je dois redemarrer le systéme pour lancer un programme avant que le virus ne s'active.

Je peux dont lancer ZHPDiag mais le virus ne me laisse pas le temps de lancer ZHPFix. Le message est "ZHPFix.exe est infesté".

Dois-je redemarrer le système en mode sans échec ?

C'est fait :

File :

Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Application Data\wenloj

--------------------------------

Key :

Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\fyssqnki
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fyssqnki

Merci beaucoup.

Ci-joint le rapport demandé par "moment de grace" :

ZHPFix v1.12.302 by Nicolas Coolman - Rapport de suppression du 21/02/2010 14:43:20
Fichier d'export Registre :
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
(Néant)

Valeur du Registre :
(Néant)

Elément de données du Registre :
(Néant)

Dossier :
(Néant)

Fichier :
(Néant)

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)

Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 0
Valeur du Registre : 0
Elément de données du Registre : 0
Dossier : 0
Fichier : 0
Logiciel : 0
Autre : 0

End of the scan

Le pc va mieux.
Je n'ai plus de messages d'alerte et les pages web ne s'ouvrent plus intempestivement.

Ci-joint le lien pour consulter le rapport :

http://www.cijoint.fr/cjlink.php?file=cj201002/cijjdz3DbO.txt

@pherceCela m'a l'air plutot bien maintenant.

Merci pour votre disponibilité et votre compétence à tous les deux.

Dites moi s'il reste encore quelques programmes à faire tourner pour finaliser ce dépannage.

Encore merci.

Patrice HERCE

Bonjour,

J'ai fait tourner le programme. tu trouveras le rapport ci-dessous :

List'em by g3n-h@ckm@n 1.2.5.3

User : HP_Propriétaire (Administrateurs)
Update on 19/02/2010 by g3n-h@ckm@n ::::: 13.15
Start at: 06:35:03 | 22/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) 64 Processor 3000+
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 144,25 Go (78,96 Go free) [HP_PAVILION] | NTFS
D:\ -> Disque fixe local | 4,78 Go (1012,89 Mo free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\9.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
TomTomHOME.exe REG_SZ "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe
HPHUPD06 REG_SZ c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
HPHmon06 REG_SZ C:\WINDOWS\system32\hphmon06.exe
ISUSScheduler REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
VTTimer REG_SZ VTTimer.exe
SiSPower REG_SZ Rundll32.exe SiSPower.dll,ModeAgent
AGRSMMSG REG_SZ AGRSMMSG.exe
KBD REG_SZ C:\HP\KBD\KBD.EXE
ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
LSBWatcher REG_SZ c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
avgnt REG_SZ "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
ISUSPM Startup REG_SZ c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
NoDriveAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoCDBurning REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 255 (0xff)
NoDriveTypeAutoRun REG_DWORD 255 (0xff)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ BUREAU
DefaultUserName REG_SZ HP_Propriétaire
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 1 (0x1)
AltDefaultUserName REG_SZ HP_Propriétaire
AltDefaultDomainName REG_SZ BUREAU

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\WINDOWS\system32\fxsclnt.exe REG_SZ C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console
C:\Program Files\ChessBase\ChessProgram8\ChessProgram8.exe REG_SZ C:\Program Files\ChessBase\ChessProgram8\ChessProgram8.exe:*:Enabled:ChessProgram8
C:\Program Files\World of Warcraft\WoW-1.12.0-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-1.12.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\WINDOWS\system32\rtcshare.exe REG_SZ C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%ProgramFiles%\iTunes\iTunes.exe REG_SZ %ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes
C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{00B71CFB-6864-4346-A978-C0A14556272C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1239CC52-59EF-4DFA-8C61-90FFA846DF7E}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{14B87622-7E19-4EA8-93B3-97215F77A6BC}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{17492023-C23A-453E-A040-C7C580BBF700}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{20A60F0D-9AFA-4515-A0FD-83BD84642501}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{2917297F-F02B-4B9D-81DF-494B6333150B}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5C051655-FCD5-4969-9182-770EA5AA5565}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{B8BE5E93-A60C-4D26-A2DC-220313175592}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F6BF0D00-0B2A-4A75-BF7B-F385591623AF}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\9.tmp
## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\System32\Drivers\atapi.sys

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\9.tmp
## C:\> hashdeep C:\WINDOWS\System32\DllCache\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\System32\DllCache\atapi.sys

Sources
=======

C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys
C:\WINDOWS\system32\dllcache\atapi.sys
C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
144 Go total, 78,96 Go libre (54%), 0% fragment‚ (fragmentation du fichier 0%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\install.exe
Present !! : C:\Program Files\VMNToolbar
Present !! : C:\WINDOWS\System32\*.dll.tmp"
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\MSINET.oca
Present !! : C:\WINDOWS\System32\ps2.bat"
Present !! : C:\WINDOWS\unins000.dat
Present !! : C:\WINDOWS\unins000.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\HP_Propri‚taire\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\C0.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\DPE.DUS
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\dw.log
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\OM7.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\tmp.xpi
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\WAY.gif
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~15.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~1C.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~27.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~28.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~2D.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~2F.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~3.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~30.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~33.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~39.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~3C.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~C.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AutoRun.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\eauninstall.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\gtb2k1036.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\Install_MSN_Messenger.EXE
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\matcleanup.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\MCCCleanup.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\msnsearch.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\Numo.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\setup_wm.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\The Sims 2_uninst.exe
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AVRES_OPTRF_LiveUpdate.dat
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AVSTELiveUpdate.dat
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\NIS_LS_Action.dat
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\NIS_LU_Action.dat
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\SSALiveUpdate.dat
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\symcprop.dat
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AutoRunGUI.dll
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\au_res.dll
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\au_setuph.dll
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\TWSecLib.dll
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp146.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp67.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp70.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp9B.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmpB1.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmpE8.tmp
Present !! : C:\Documents and Settings\HP_Propri‚taire\Mes documents\ZbThumbnail.info
Present !! : C:\Documents and Settings\HP_Propri‚taire\RefEdit.exd

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-22 07:26:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys sfsync02.sys atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

AbiWord
Activision
Adobe
allTunes
AntiVir PersonalEdition Classic
Apple Software Update
ASCII Art Generator
ATI Technologies
Bethesda Softworks
Bonjour
Canon
ChessBase
Club-Internet
Common Files
CorelPaintShopProX
EA Games
Easy Internet signup
fdjeux
FFE
Fichiers communs
Google
Guitar Pro 5
HardwareDetection
Help and Support Additions
Hewlett-Packard
HP
IGN Rando
InstallShield Installation Information
Internet Explorer
iPod
iTunes
Jasc Software Inc
Java
LilyPond
List_Kill'em
Maxis
Messenger
Messenger Plus! Live
MessengerPlus! 3
Microsoft
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Games
Microsoft Office
Movie Maker
msjavwu_w
MSN
MSN Apps
MSN Gaming Zone
MSN Messenger
MSXML 4.0
Navilog1
NetMeeting
Norton AntiVirus
Online Services
Outlook Express
PC-Doctor for Windows
Philips PC VGA Camera
PhotoFiltre
QuickTime
QuickZip4
Research In Motion
Riven
Samsung
Seagrand
Services en ligne
SiS VGA Utilities V3.63
Sonic
Sonic RecordNow!
Talkway
The One Ring 3D Screensaver
TomTom HOME 2
TomTom International B.V
Ubi Soft
UbiSoft
Ulead Systems
Universalis
VideoLink
vmntoolbar
Warcraft III
Western Digital
Windows Live
Windows Live SkyDrive
Windows Media Player
Windows NT
WinRAR
xerox
Xvid
Yahoo!

============
Drive C:
============

AUTOEXEC.BAT
autorun.inf
BOOT.BAK
boot.ini
Bootfont.bin
cleannavi.txt
cmdcons
cmldr
CNYSELPHYCP
Config.Msi
CONFIG.SYS
C_DILLA
Documents and Settings
eula.1028.txt
eula.1031.txt
eula.1033.txt
eula.1036.txt
eula.1040.txt
eula.1041.txt
eula.1042.txt
eula.2052.txt
eula.3082.txt
globdata.ini
hp
hpbi.log
install.exe
install.ini
install.res.1028.dll
install.res.1031.dll
install.res.1033.dll
install.res.1036.dll
install.res.1040.dll
install.res.1041.dll
install.res.1042.dll
install.res.2052.dll
install.res.3082.dll
IO.SYS
Kill'em
List'em.txt
lopR.txt
MSDOS.SYS
My Music
MYST
NTDETECT.COM
ntldr
os357577.bin
pagefile.sys
PAT1.MYS
playout.txt
Program Files
Python22
RECYCLER
Remove_File
sysprep
System Volume Information
system.sav
temp
TomTom
tracert.txt
UsbFix_Upload_Me_BUREAU.zip
vcredist.bmp
VC_RED.cab
VC_RED.MSI
WINDOWS
ZbThumbnail.info
_Sid.txt

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 7:47:12,83

Ci-joint le nouveau rapport :

Kill'em by g3n-h@ckm@n 1.2.5.3

User : HP_Propriétaire (Administrateurs)
Update on 19/02/2010 by g3n-h@ckm@n ::::: 13.15
Start at: 19:36:58 | 22/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) 64 Processor 3000+
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | Updated ]

C:\ -> Disque fixe local | 144,25 Go (78,94 Go free) [HP_PAVILION] | NTFS
D:\ -> Disque fixe local | 4,78 Go (1012,89 Mo free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\1D2.tmp\ERUNT.EXE
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temp\1D2.tmp\pv.exe

Detections :
==========

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Quarantined & Deleted !! : C:\install.exe
Quarantined & Deleted !! : C:\Program Files\VMNToolbar

Quarantined & Deleted !! : C:\WINDOWS\system32\olepro32.dll.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\system32\MSINET.oca
Quarantined & Deleted !! : C:\WINDOWS\system32\ps2.bat
Quarantined & Deleted !! : C:\WINDOWS\unins000.dat
Quarantined & Deleted !! : C:\WINDOWS\unins000.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Application Data\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\C0.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\DPE.DUS
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\OM7.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\tmp.xpi
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\WAY.gif
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~15.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~1C.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~27.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~28.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~2D.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~2F.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~3.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~30.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~33.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~39.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~3C.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp\~C.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AutoRun.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\eauninstall.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\gtb2k1036.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\Install_MSN_Messenger.EXE
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\matcleanup.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\MCCCleanup.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\msnsearch.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\Numo.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\setup_wm.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\The Sims 2_uninst.exe
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AVRES_OPTRF_LiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AVSTELiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\NIS_LS_Action.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\NIS_LU_Action.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\SSALiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\symcprop.dat
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\AutoRunGUI.dll
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\au_res.dll
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\au_setuph.dll
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\TWSecLib.dll
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp146.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp67.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp70.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmp9B.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmpB1.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\LOCAL Settings\Temp\tmpE8.tmp
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\Mes documents\ZbThumbnail.info
Quarantined & Deleted !! : C:\Documents and Settings\HP_Propri‚taire\RefEdit.exd

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
========
Services
=========

Ndisuio : Start = 3
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Pardonnez moi pour l'oubli :)

Le pc fonctionne bien depuis hier après midi.

Je n'ai plus de pub et le lancement de programmes est ok.

Est-ce fini ?

Merci pour votre intervention.