Infecter par TR/Dropper.Gen et/ou autre

bonsoir
le PC est infecté

Télécharge malwarebytes' anti-malware
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Enregistre le sur le bureau
Double-clique sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation
Si la pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
Il va se mettre à jour une fois faite
Va dans l'onglet recherche
Sélectionne exécuter un examen complet
Clique sur rechercher
Le scan démarre
A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
Clique sur afficher les résultats pour afficher les objets trouvés
Clique sur OK pour pousuivre
Si des malwares ont été détectés, cliquer sur afficher les résultats
Sélectionne tout (ou laisser coché)
Clique sur supprimer la sélection
Malwarebytes va détruire les fichiers et les clés de registre et en mettre une
copie dans la quarantaine
Malewarebytes va ouvrir le bloc-note et y copier le rapport
Redémarre le PC
Une fois redémarré, double-clique sur Malewarebytes
Va dans l'onglet rapport/log
Clique dessus pour l'afficher une fois affiché, cliquer sur édition en haut du
bloc-note puis sur sélectionner tout
Revient sur édition, puis sur copier et revient sur le forum et dans ta réponse
Clic droit dans le cadre de la réponse et coller

bonjour Nathandre!

merci de ta reponse rapide!

j'ai fait le scan avec malwarebytes. voici le rapport :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3855
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/03/2010 10:02:25
mbam-log-2010-03-12 (10-02-25).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 207887
Temps écoulé: 1 hour(s), 18 minute(s), 25 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
C:\WINDOWS\wiwmbu.exe (Trojan.Downloader) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\remote system protection (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Downloader) -> Data: c:\windows\wiwmbu.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\wiwmbu.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Documents and Settings\Anne\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Documents and Settings\Anne\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Documents and Settings\Anne\Mes documents\Téléchargements\teracopy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Documents and Settings\Anne\Mes documents\Téléchargements\GIRL147852369.JPG.exe (Trojan.Email.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\A6W4PP65\ybxliiv[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\A6W4PP65\yekhhiijfg[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\GM8EBENY\your_exe[1].exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\GM8EBENY\iolylzjjg[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\wiwmbu.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temp\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temp\ctv4016.exe (Trojan.Dropper) -> Delete on reboot.
C:\Program Files\Adobe\acrotray .exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\o1o9cv1zwu.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Utilisateur\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

que doit-je faire maintenant?

Re!

alors, depuis mon dernier message, j'ai eu des nouvelles alertes de la part d'antivir..... du coup, j'ai refait un passe de malwarebyte, dont le rapport suit :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3855
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/03/2010 11:49:43
mbam-log-2010-03-12 (11-49-43).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 207806
Temps écoulé: 1 hour(s), 3 minute(s), 48 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
C:\Documents and Settings\Utilisateur\Application Data\Microsoft\winlog.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temp\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Application Data\Microsoft\winlog.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Je pense que je vais relancer une analyse pour voir et être sur qu'il n'y a plus rien....

J'ai effectué le scan avec rsit. il m'a sembler rapide (moins d'une minute je dirais...), mais peut etre est-ce normal?

sinon,

le fichier info : http://www.cijoint.fr/cjlink.php?file=cj201003/cijrbmXykW.txt

le fichier log : http://www.cijoint.fr/cjlink.php?file=cj201003/cijCciFXNu.txt

voila!

merci encore de ton aide!

a+

goyel

j'ai executé combofix, et voici le rapport :

ComboFix 10-03-11.05 - Utilisateur 12/03/2010  15:06:09.1.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.894.476 [GMT 1:00]
Lancé depuis: c:\documents and settings\Utilisateur\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Utilisateur\Application Data\Microsoft\download.exe
c:\documents and settings\Utilisateur\rundll32 .exe
c:\program files\Internet Explorer\js.mui
c:\program files\Internet Explorer\wmpscfgs.exe
c:\windows\system32\ctfmon .exe
c:\windows\system32\o1o9cv1zwu.dll
D:\Autorun.inf

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-02-12 au 2010-03-12  ))))))))))))))))))))))))))))))))))))
.

2010-03-12 12:31 . 2010-03-12 12:33	--------	d-----w-	C:\rsit
2010-03-11 22:02 . 2010-03-11 22:02	--------	d-sh--w-	c:\documents and settings\NetworkService\PrivacIE
2010-03-11 22:01 . 2010-03-11 22:01	--------	d-----r-	c:\documents and settings\NetworkService\Favoris
2010-03-11 21:44 . 2010-03-11 21:44	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Malwarebytes
2010-03-11 21:44 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-11 21:44 . 2010-03-11 21:44	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-11 21:44 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-11 21:44 . 2010-03-11 21:44	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-11 21:18 . 2010-03-11 21:18	--------	d-----w-	c:\program files\Trend Micro
2010-03-11 20:53 . 2010-03-11 20:53	--------	d-----w-	C:\VundoFix Backups
2010-03-11 20:43 . 2010-03-11 20:47	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\QuickScan
2010-03-11 20:43 . 2010-03-05 17:33	791456	----a-w-	c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-03-11 20:43 . 2010-03-05 17:03	629152	----a-w-	c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-03-11 08:12 . 2010-03-12 12:20	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-03-11 08:12 . 2010-03-11 08:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-10 23:21 . 2010-03-10 23:21	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Windows Search
2010-03-10 23:16 . 2010-03-10 23:16	--------	d-sh--w-	c:\documents and settings\Administrateur\IETldCache
2010-03-10 22:59 . 2010-03-10 22:59	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2010-03-10 22:55 . 2010-03-10 22:56	--------	d-----w-	c:\documents and settings\Utilisateur\Local Settings\Application Data\Windows Server
2010-03-10 08:42 . 2009-10-23 15:28	3558912	------w-	c:\windows\system32\dllcache\moviemk.exe
2010-03-04 22:19 . 2010-02-12 10:03	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-27 08:39 . 2010-02-27 08:39	--------	d-----w-	c:\program files\Symantec
2010-02-25 21:47 . 2010-02-25 21:47	--------	d-----w-	c:\documents and settings\Utilisateur\Local Settings\Application Data\WBFSManager
2010-02-25 21:45 . 2010-02-25 21:45	--------	d-----w-	c:\program files\WBFS
2010-02-24 11:20 . 2010-02-24 12:30	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\TeraCopy
2010-02-16 19:36 . 2010-02-16 19:36	6868368	----a-w-	c:\documents and settings\Utilisateur\Application Data\ESTsoft\ALUpdate\ALZIP\newfile\TEMP\ALZip7_52.exe
2010-02-16 14:39 . 2010-02-16 14:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Estsoft
2010-02-16 14:38 . 2010-02-16 19:30	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\ESTsoft
2010-02-16 14:38 . 2010-02-16 14:38	--------	d-----w-	c:\program files\ESTsoft
2010-02-15 11:46 . 2010-02-15 11:46	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\ImgBurn
2010-02-15 09:32 . 2010-02-15 09:33	--------	d-----w-	c:\program files\ImgBurn
2010-02-13 17:53 . 2010-02-13 17:53	--------	d-----w-	c:\program files\RealVNC

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-12 12:21 . 2010-01-29 10:58	--------	d-----w-	c:\program files\QuickTime
2010-03-12 07:39 . 2004-08-17 09:31	536240	----a-w-	c:\windows\system32\perfh00C.dat
2010-03-12 07:39 . 2004-08-17 09:31	94724	----a-w-	c:\windows\system32\perfc00C.dat
2010-03-11 02:05 . 2009-08-01 21:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-10 22:56 . 2009-08-01 15:18	--------	d-----w-	c:\program files\SuperCopier2
2010-03-08 20:15 . 2010-01-11 21:33	479680	----a-w-	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-03-02 20:21 . 2009-08-08 19:25	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2010-02-27 08:40 . 2006-04-13 06:30	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-02-18 10:27 . 2009-12-18 15:41	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\uTorrent
2010-02-13 17:46 . 2009-08-01 21:44	--------	d-----w-	c:\program files\OpenOffice.org 3
2010-01-31 21:18 . 2010-01-31 21:18	--------	d-----w-	c:\documents and settings\All Users\Application Data\DVD Shrink
2010-01-31 21:18 . 2010-01-31 21:18	--------	d-----w-	c:\program files\DVD Shrink
2010-01-30 16:46 . 2010-01-30 16:46	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Apple Computer
2010-01-30 10:53 . 2010-01-30 09:02	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Winamp
2010-01-30 09:07 . 2010-01-30 09:02	--------	d-----w-	c:\program files\Winamp
2010-01-30 09:03 . 2010-01-30 09:03	--------	d-----w-	c:\program files\Winamp Detect
2010-01-29 10:58 . 2010-01-29 10:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-29 10:58 . 2010-01-29 10:58	--------	d-----w-	c:\program files\Fichiers communs\Apple
2010-01-29 10:57 . 2010-01-29 10:57	--------	d-----w-	c:\program files\Apple Software Update
2010-01-29 10:57 . 2010-01-29 10:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2010-01-27 10:34 . 2010-01-27 10:33	--------	d-----w-	c:\program files\PDFCreator
2010-01-25 11:29 . 2010-01-25 11:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\SlySoft
2010-01-25 11:27 . 2009-08-01 12:30	74576	----a-w-	c:\documents and settings\Utilisateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-25 11:25 . 2010-01-25 11:25	0	--sh--w-	c:\windows\S7A4FE689.tmp
2010-01-25 11:22 . 2010-01-25 11:22	--------	d-----w-	c:\program files\SlySoft
2010-01-24 08:52 . 2010-01-24 08:48	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Teleca
2010-01-24 08:51 . 2010-01-24 08:51	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
2010-01-24 08:51 . 2010-01-24 08:51	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-24 08:48 . 2010-01-24 08:47	--------	d-----w-	c:\program files\Fichiers communs\Teleca Shared
2010-01-24 08:48 . 2010-01-24 08:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\HTC
2010-01-24 08:48 . 2010-01-24 08:47	--------	d-----w-	c:\documents and settings\All Users\Application Data\Teleca
2010-01-24 08:47 . 2010-01-24 08:46	--------	d-----w-	c:\program files\HTC
2010-01-24 08:46 . 2010-01-24 08:46	--------	d-----w-	c:\program files\Spirent Communications
2010-01-23 10:23 . 2010-01-23 10:03	--------	d-----w-	c:\program files\LG Electronics
2010-01-23 10:15 . 2010-01-23 10:15	24576	----a-w-	c:\documents and settings\Utilisateur\Application Data\LG Electronics\LG PC Suite III\UpdateHelper.exe
2010-01-23 10:03 . 2010-01-23 10:03	--------	d--h--w-	c:\documents and settings\Utilisateur\Application Data\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2010-01-23 10:03 . 2010-01-23 10:03	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\LG Electronics
2010-01-22 09:44 . 2010-01-03 10:18	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\gtk-2.0
2009-12-31 16:50 . 2004-08-05 08:00	353792	----a-w-	c:\windows\system32\drivers\srv.sys
2009-12-29 09:20 . 2009-08-01 21:47	1	----a-w-	c:\documents and settings\Utilisateur\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-21 19:07 . 2004-08-05 08:00	916480	----a-w-	c:\windows\system32\wininet.dll
2009-12-19 15:31 . 2009-12-19 15:31	3584	----a-r-	c:\documents and settings\Utilisateur\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-12-18 14:50 . 2009-12-18 14:50	0	-c--a-w-	c:\windows\nsreg.dat
2009-12-18 14:04 . 2009-12-18 14:04	152576	----a-w-	c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-18 14:04 . 2009-11-10 18:24	79488	----a-w-	c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-18 14:02 . 2009-08-01 21:28	56816	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-12-17 07:41 . 2004-08-05 08:00	347648	----a-w-	c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2004-08-05 08:00	33280	----a-w-	c:\windows\system32\csrsrv.dll
2006-08-22 03:29 . 2009-08-01 21:22	22	--sha-w-	c:\windows\SMINST\HPCD.SYS
.
[code]<pre>
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\Fichiers communs\Adobe\ARM\1.0\adobearm .exe
c:\program files\Fichiers communs\Nero\Lib\nerocheck .exe
c:\program files\Fichiers communs\Nero\Lib\nmindexstoresvr .exe
c:\program files\HP\HP Software Update\hpwuschd2 .exe
c:\program files\HP\QuickPlay\qpservice .exe
c:\program files\HPQ\Default Settings\cpqset .exe
c:\program files\HPQ\HP Wireless Assistant\hp wireless assistant .exe
c:\program files\HPQ\Quick Launch Buttons\eabservr .exe
c:\program files\HTC\HTC Sync\Application Launcher\application launcher .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Nero\Nero8\Nero BackItUp\nbkeyscan .exe
c:\program files\QuickTime\qttask       .exe
c:\program files\QuickTime\qttask      .exe
c:\program files\QuickTime\qttask     .exe
c:\program files\QuickTime\qttask    .exe
c:\program files\QuickTime\qttask   .exe
c:\program files\QuickTime\qttask  .exe
c:\program files\QuickTime\qttask .exe
c:\program files\SlySoft\CloneCD\clonecdtray .exe
c:\program files\Spybot - Search & Destroy\teatimer .exe
c:\program files\SuperCopier2\supercopier2 .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Synaptics\SynTP\syntpstart .exe
c:\windows\SMINST\recguard .exe
</pre>/code

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2010-03-12 40448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\quicktime\qttask      .exe -atboottime" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2010-03-11 40448]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 40448]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-03-12 40448]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2010-03-12 40448]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2010-03-12 40448]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2010-03-12 40448]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2010-03-12 40448]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2010-03-12 40448]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2010-03-12 40448]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-12 40448]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2010-03-12 40448]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2010-03-12 40448]
"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2010-03-12 40448]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2010-03-12 40448]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-03-12 40448]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-12 40448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Orange\\IEWInternet\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\eMule\\emule.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/08/2009 22:28 108289]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [22/08/2005 10:06 231424]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [29/09/2009 08:11 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [29/09/2009 08:11 10496]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [29/09/2009 08:11 12928]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\androidusb.sys [24/01/2010 09:46 24576]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [05/08/2009 20:41 99840]
.
Contenu du dossier 'Tâches planifiées'

2010-03-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
TCP: {9C73AB8A-3348-4FCE-885F-06278B7543B0} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - component: c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{A3BA40A2-74F1-52BD-F434-00B15A2C8953} - c:\windows\system32\o1o9cv1zwu.dll
SharedTaskScheduler-{A3BA40A2-74F1-52BD-F434-00B15A2C8953} - c:\windows\system32\o1o9cv1zwu.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-12 15:11
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????h????P???? ???B?????????????hLC? ?????? 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(844)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-03-12  15:14:32
ComboFix-quarantined-files.txt  2010-03-12 14:14

Avant-CF: 45 958 107 136 octets libres
Après-CF: 46 184 136 704 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 75AAB97C10ACA60993B98B844C7EA07D

il suffit de demander :

http://www.cijoint.fr/cjlink.php?file=cj201003/cij1LBSu0k.txt

Bonsoir,

J'ai du m'absenter toute l'apres midi. Mais j'avais laisser mon ordinateur allumer, et a mon retour, je n'avais aucune alerte de la part d'antivir ou de spybot.

Y-a-t-il d'autre chose a faire?

mon ordinateur est maintenant clean?

Et voila le travail :

List'em by g3n-h@ckm@n 1.3.2.1

User : Utilisateur (Administrateurs) 
Update on 10/03/2010 by g3n-h@ckm@n ::::: 17.30
Start at: 21:43:35 | 12/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Turion(tm) 64 Mobile Technology ML-34
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 85,66 Go (43,02 Go free) | NTFS
D:\ -> Disque fixe local | 6,48 Go (1,17 Go free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque fixe local | 7,13 Go (6,45 Go free) [FAT] | FAT32
G:\ -> Disque fixe local
H:\ -> Disque amovible | 978,72 Mo (218,12 Mo free) | FAT
 
Boot: Normal 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
c:\program files\ati technologies\ati control panel\atiptaxx .exe
c:\program files\hp\hp software update\hpwuschd2 .exe
c:\program files\synaptics\syntp\syntpenh .exe
c:\program files\hp\quickplay\qpservice .exe
c:\program files\hpq\hp wireless assistant\hp wireless assistant .exe
c:\program files\hpq\quick launch buttons\eabservr .exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
c:\program files\java\jre6\bin\jusched .exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Teleca Shared\logger.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\DbgOut.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
C:\Program Files\Spybot - Search & Destroy\teatimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run" 
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SpybotSD TeaTimer	REG_SZ         	C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
ATIPTA	REG_SZ         	"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" 
HP Software Update	REG_SZ         	C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe 
SynTPEnh	REG_SZ         	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
QPService	REG_SZ         	"C:\Program Files\HP\QuickPlay\QPService.exe" 
eabconfg.cpl	REG_SZ         	C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start 
Cpqset	REG_SZ         	C:\Program Files\HPQ\Default Settings\cpqset.exe 
RecGuard	REG_SZ         	C:\Windows\SMINST\RecGuard.exe 
hpWirelessAssistant	REG_SZ         	C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe 
SynTPStart	REG_SZ         	C:\Program Files\Synaptics\SynTP\SynTPStart.exe 
avgnt	REG_SZ         	"C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 
SunJavaUpdateSched	REG_SZ         	"C:\Program Files\Java\jre6\bin\jusched.exe" 
NeroFilterCheck	REG_SZ         	C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe 
NBKeyScan	REG_SZ         	"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" 
Mobile Connectivity Suite	REG_SZ         	"C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" /startoptions 
CloneCDTray	REG_SZ         	"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s 
QuickTime Task	REG_SZ         	"c:\program files\quicktime\qttask      .exe" -atboottime 
Adobe Reader Speed Launcher	REG_SZ         	"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
Adobe ARM	REG_SZ         	"C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDrives	REG_DWORD      	0 (0x0) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
HonorAutoRunSetting	REG_DWORD      	1 (0x1) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDrives	REG_DWORD      	0 (0x0) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 DefaultDomainName	REG_SZ         	PORTABLE 
 DefaultUserName	REG_SZ         	Utilisateur 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	Explorer.exe 
 ShutdownWithoutLogon	REG_SZ         	0 
 System	REG_SZ         	 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 SfcQuota	REG_DWORD      	-1 (0xffffffff) 
 allocatecdroms	REG_SZ         	0 
 allocatedasd	REG_SZ         	0 
 allocatefloppies	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 scremoveoption	REG_SZ         	0 
 AllowMultipleTSSessions	REG_DWORD      	1 (0x1) 
 UIHost	REG_EXPAND_SZ  	logonui.exe 
 LogonType	REG_DWORD      	1 (0x1) 
 Background	REG_SZ         	0 0 0 
 DebugServerCommand	REG_SZ         	no 
 SFCDisable	REG_DWORD      	0 (0x0) 
 WinStationsDisabled	REG_SZ         	0 
 DefaultPassword	REG_SZ         	 
 HibernationPreviouslyEnabled	REG_DWORD      	1 (0x1) 
 ShowLogonOptions	REG_DWORD      	0 (0x0) 
 AltDefaultUserName	REG_SZ         	Utilisateur 
 AltDefaultDomainName	REG_SZ         	PORTABLE 
 ChangePasswordUseKerberos	REG_DWORD      	1 (0x1) 
 Userinit	REG_SZ         	C:\WINDOWS\system32\userinit.exe, 

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{56F9679E-7826-4C84-81F3-532071A8BCC5}	REG_SZ         	 

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe	REG_SZ         	C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe:*:enabled:CSS
C:\Program Files\Messenger\msmsgs.exe	REG_SZ         	C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\uTorrent\uTorrent.exe	REG_SZ         	C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Program Files\eMule\emule.exe	REG_SZ         	C:\Program Files\eMule\emule.exe:*:Enabled:eMule

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Lexmark 3500-4500 Series\app4r.exe	REG_SZ         	C:\Program Files\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A3BA40A2-74F1-52BD-F434-00B15A2C8953}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer=192.168.1.1 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer=192.168.1.1 

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
## 
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
 
=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse                 	 
    85,66 Go total,  43,02 Go libre (50%),  12% fragmenté (fragmentation du fichier 24%)

Vous devriez défragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\WINDOWS\002487_.tmp  
Present !! : C:\WINDOWS\System32\SET*.tmp 
Present !! : C:\WINDOWS\Tasks\At1.job  
Present !! : C:\WINDOWS\Tasks\At2.job  
Present !! : C:\WINDOWS\Tasks\At3.job  
Present !! : C:\WINDOWS\Tasks\At4.job  
Present !! : C:\WINDOWS\Tasks\At5.job  
Present !! : C:\WINDOWS\Tasks\At6.job  
Present !! : C:\WINDOWS\Tasks\At7.job  
Present !! : C:\WINDOWS\Tasks\At8.job  
Present !! : C:\WINDOWS\Tasks\At9.job  
Present !! : C:\WINDOWS\Tasks\At1.job  
Present !! : C:\WINDOWS\Tasks\At10.job  
Present !! : C:\WINDOWS\Tasks\At11.job  
Present !! : C:\WINDOWS\Tasks\At12.job  
Present !! : C:\WINDOWS\Tasks\At13.job  
Present !! : C:\WINDOWS\Tasks\At14.job  
Present !! : C:\WINDOWS\Tasks\At15.job  
Present !! : C:\WINDOWS\Tasks\At16.job  
Present !! : C:\WINDOWS\Tasks\At17.job  
Present !! : C:\WINDOWS\Tasks\At18.job  
Present !! : C:\WINDOWS\Tasks\At19.job  
Present !! : C:\WINDOWS\Tasks\At2.job  
Present !! : C:\WINDOWS\Tasks\At20.job  
Present !! : C:\WINDOWS\Tasks\At21.job  
Present !! : C:\WINDOWS\Tasks\At22.job  
Present !! : C:\WINDOWS\Tasks\At23.job  
Present !! : C:\WINDOWS\Tasks\At24.job  
Present !! : C:\WINDOWS\Tasks\At3.job  
Present !! : C:\WINDOWS\Tasks\At4.job  
Present !! : C:\WINDOWS\Tasks\At5.job  
Present !! : C:\WINDOWS\Tasks\At6.job  
Present !! : C:\WINDOWS\Tasks\At7.job  
Present !! : C:\WINDOWS\Tasks\At8.job  
Present !! : C:\WINDOWS\Tasks\At9.job  
Present !! : C:\Documents and Settings\Utilisateur\Application Data\usb.inf  
Present !! : C:\Documents and Settings\Utilisateur\LOCAL Settings\Temp\wmpscfgs.exe  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : HKEY_USERS\S-1-5-21-2959120336-474453583-3100428193-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-12 21:50:46
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????????h????P???? ???B?????????????hLC? ?????? 

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
kernel: MBR read successfully
user & kernel MBR OK 

 
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials 
 
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:51:02,25 

et voila :

Kill'em by g3n-h@ckm@n 1.3.2.1 
 
User : Utilisateur (Administrateurs) 
Update on 10/03/2010 by g3n-h@ckm@n ::::: 17.30
Start at: 22:02:39 | 12/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Turion(tm) 64 Mobile Technology ML-34
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 85,66 Go (43,02 Go free) | NTFS
D:\ -> Disque fixe local | 6,48 Go (1,17 Go free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\WINDOWS\002487_.tmp 
 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET145.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET146.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET148.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET149.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET174.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET175.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At1.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At2.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At3.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At4.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At5.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At6.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At7.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At8.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At9.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At10.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At11.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At12.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At13.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At14.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At15.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At16.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At17.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At18.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At19.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At20.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At21.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At22.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At23.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At24.job 
Quarantined & Deleted !! : C:\Documents and Settings\Utilisateur\Application Data\usb.inf 
Quarantined & Deleted !! : C:\Documents and Settings\Utilisateur\LOCAL Settings\Temp\wmpscfgs.exe 
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 

plutot une bonne nouvelle alors!

voici le fichier log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Utilisateur at 2010-03-12 22:27:57
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 44 GB (50%) free of 88 GB
Total RAM: 894 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:28:14, on 12/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
c:\program files\ati technologies\ati control panel\atiptaxx .exe
c:\program files\hp\hp software update\hpwuschd2 .exe
c:\program files\synaptics\syntp\syntpenh .exe
c:\program files\hpq\quick launch buttons\eabservr .exe
c:\program files\hp\quickplay\qpservice .exe
c:\program files\java\jre6\bin\jusched .exe
c:\program files\slysoft\clonecd\clonecdtray .exe
c:\program files\htc\htc sync\application launcher\application launcher .exe
c:\program files\spybot - search & destroy\teatimer .exe
c:\program files\hpq\hp wireless assistant\hp wireless assistant .exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Fichiers communs\Teleca Shared\logger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ctv992.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\DbgOut.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Utilisateur\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Utilisateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {A3BA40A2-74F1-52BD-F434-00B15A2C8953} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Mobile Connectivity Suite] "C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "c:\program files\quicktime\qttask       .exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer = 192.168.1.1
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 9714 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BA40A2-74F1-52BD-F434-00B15A2C8953}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2006-04-13 1179136]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2010-03-12 40448]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2010-03-12 40448]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-03-12 40448]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2010-03-12 40448]
"eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [2010-03-12 40448]
"Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2010-03-12 40448]
"RecGuard"=C:\Windows\SMINST\RecGuard.exe [2010-03-12 40448]
"hpWirelessAssistant"=C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2010-03-12 40448]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2010-03-12 40448]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-03-12 40448]
"NeroFilterCheck"=C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe [2010-03-12 40448]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2010-03-12 40448]
"Mobile Connectivity Suite"=C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe [2010-03-12 40448]
"CloneCDTray"=C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [2010-03-12 40448]
"QuickTime Task"=c:\program files\quicktime\qttask       .exe [2010-03-12 40448]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-03-12 40448]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2010-03-12 40448]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2010-03-12 40448]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Démarrage rapide de HP Photosmart Premier.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-01 47104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe"="C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Lexmark 3500-4500 Series\app4r.exe"="C:\Program Files\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 2 months======

2010-03-12 22:14:02 ----SHD---- C:\RECYCLER
2010-03-12 22:00:28 ----D---- C:\Kill'em
2010-03-12 21:43:32 ----A---- C:\List'em.txt
2010-03-12 21:43:05 ----D---- C:\Program Files\List_Kill'em
2010-03-12 15:14:33 ----A---- C:\ComboFix.txt
2010-03-12 15:04:18 ----A---- C:\Boot.bak
2010-03-12 15:04:11 ----RASHD---- C:\cmdcons
2010-03-12 15:01:29 ----A---- C:\WINDOWS\zip.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\SWSC.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\SWREG.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\sed.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\PEV.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\MBR.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\grep.exe
2010-03-12 15:01:21 ----D---- C:\WINDOWS\ERDNT
2010-03-12 15:00:49 ----AD---- C:\Qoobox
2010-03-12 13:31:08 ----D---- C:\rsit
2010-03-11 22:44:38 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Malwarebytes
2010-03-11 22:44:30 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-03-11 22:44:28 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-11 22:18:12 ----D---- C:\Program Files\Trend Micro
2010-03-11 21:53:55 ----D---- C:\VundoFix Backups
2010-03-11 21:53:55 ----A---- C:\VundoFix.txt
2010-03-11 21:43:13 ----D---- C:\Documents and Settings\Utilisateur\Application Data\QuickScan
2010-03-11 09:12:52 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-11 09:12:52 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-11 03:06:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-11 03:04:50 ----A---- C:\WINDOWS\system32\MRT.INI
2010-03-11 00:14:06 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-09 22:21:27 ----AH---- C:\a.txt
2010-03-05 01:11:44 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-03-04 23:19:29 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-02-27 09:39:05 ----D---- C:\Program Files\Symantec
2010-02-25 22:45:24 ----D---- C:\Program Files\WBFS
2010-02-24 12:20:49 ----D---- C:\Documents and Settings\Utilisateur\Application Data\TeraCopy
2010-02-24 10:26:46 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-16 15:39:16 ----D---- C:\Documents and Settings\All Users\Application Data\Estsoft
2010-02-16 15:38:30 ----D---- C:\Program Files\ESTsoft
2010-02-16 15:38:30 ----D---- C:\Documents and Settings\Utilisateur\Application Data\ESTsoft
2010-02-15 12:46:02 ----D---- C:\Documents and Settings\Utilisateur\Application Data\ImgBurn
2010-02-15 10:32:58 ----D---- C:\Program Files\ImgBurn
2010-02-13 18:53:55 ----D---- C:\Program Files\RealVNC
2010-02-11 11:32:48 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-11 11:32:42 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-11 11:30:03 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-11 11:29:57 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-11 11:29:51 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-11 11:29:43 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-11 11:28:29 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-11 11:28:14 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-01-31 22:18:37 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2010-01-31 22:18:35 ----D---- C:\Program Files\DVD Shrink
2010-01-30 17:46:14 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Apple Computer
2010-01-30 10:04:16 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-01-30 10:04:08 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-01-30 10:03:52 ----D---- C:\WINDOWS\Logs
2010-01-30 10:03:32 ----D---- C:\Program Files\Winamp Detect
2010-01-30 10:02:59 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2010-01-30 10:02:59 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2010-01-30 10:02:59 ----N---- C:\WINDOWS\system32\pxafs.dll
2010-01-30 10:02:53 ----D---- C:\Program Files\Winamp
2010-01-30 10:02:53 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Winamp
2010-01-29 11:58:46 ----D---- C:\Program Files\QuickTime
2010-01-29 11:58:38 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2010-01-29 11:58:00 ----D---- C:\Program Files\Fichiers communs\Apple
2010-01-29 11:57:37 ----D---- C:\Program Files\Apple Software Update
2010-01-29 11:57:37 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2010-01-27 11:33:13 ----A---- C:\WINDOWS\system32\pdfcmnnt.dll
2010-01-27 11:33:10 ----D---- C:\Program Files\PDFCreator
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\VB6FR.DLL
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\MSMPIDE.DLL
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\MSCC2FR.DLL
2010-01-25 12:29:54 ----D---- C:\Documents and Settings\All Users\Application Data\SlySoft
2010-01-25 12:25:16 ----SH---- C:\WINDOWS\S7A4FE689.tmp
2010-01-25 12:22:03 ----D---- C:\Program Files\SlySoft
2010-01-24 09:51:45 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2010-01-24 09:51:36 ----HDC---- C:\WINDOWS\$NtUninstallWdf01007$
2010-01-24 09:48:40 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Teleca
2010-01-24 09:48:06 ----D---- C:\Documents and Settings\All Users\Application Data\HTC
2010-01-24 09:47:59 ----D---- C:\Program Files\Fichiers communs\Teleca Shared
2010-01-24 09:47:59 ----D---- C:\Documents and Settings\All Users\Application Data\Teleca
2010-01-24 09:46:51 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-24 09:46:51 ----A---- C:\WINDOWS\system32\WdfCoInstaller01007.dll
2010-01-24 09:46:46 ----D---- C:\Program Files\Spirent Communications
2010-01-24 09:46:38 ----D---- C:\Program Files\HTC
2010-01-24 09:45:35 ----D---- C:\WINDOWS\Downloaded Installations
2010-01-23 11:26:08 ----D---- C:\Sounds
2010-01-23 11:25:39 ----A---- C:\WINDOWS\Sublock.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\LGMobileDL.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\Imei_dll.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\esn.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\AuthDll.dll
2010-01-23 11:03:40 ----A---- C:\WINDOWS\system32\NMSDVDXU.dll
2010-01-23 11:03:21 ----HD---- C:\Documents and Settings\Utilisateur\Application Data\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2010-01-23 11:03:21 ----D---- C:\Program Files\LG Electronics
2010-01-23 11:03:21 ----D---- C:\Documents and Settings\Utilisateur\Application Data\LG Electronics
2010-01-13 08:49:22 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 08:49:16 ----A---- C:\WINDOWS\imsins.BAK
2010-01-13 08:49:09 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 2 months======

2010-03-12 22:18:33 ----RD---- C:\Program Files
2010-03-12 22:18:31 ----SD---- C:\WINDOWS\Tasks
2010-03-12 22:18:29 ----D---- C:\Program Files\Adobe
2010-03-12 22:16:48 ----D---- C:\WINDOWS
2010-03-12 22:16:44 ----ASH---- C:\hpqp.ini
2010-03-12 22:16:41 ----D---- C:\WINDOWS\SMINST
2010-03-12 22:15:56 ----A---- C:\XP_TV.ini
2010-03-12 22:14:19 ----D---- C:\WINDOWS\Temp
2010-03-12 22:14:11 ----D---- C:\WINDOWS\Prefetch
2010-03-12 22:14:09 ----D---- C:\WINDOWS\Debug
2010-03-12 22:03:32 ----D---- C:\WINDOWS\system32
2010-03-12 22:02:41 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-12 22:01:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-12 15:16:13 ----D---- C:\Program Files\Internet Explorer
2010-03-12 15:11:34 ----A---- C:\WINDOWS\system.ini
2010-03-12 15:10:25 ----SD---- C:\Documents and Settings\Utilisateur\Application Data\Microsoft
2010-03-12 15:09:06 ----D---- C:\WINDOWS\system32\drivers
2010-03-12 15:09:06 ----D---- C:\WINDOWS\AppPatch
2010-03-12 15:09:04 ----D---- C:\Program Files\Fichiers communs
2010-03-12 15:04:19 ----RASH---- C:\boot.ini
2010-03-12 15:01:29 ----SHD---- C:\System Volume Information
2010-03-12 15:01:29 ----D---- C:\WINDOWS\system32\Restore
2010-03-12 13:17:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-03-12 10:42:22 ----D---- C:\Program Files\Mozilla Firefox
2010-03-12 10:04:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-03-12 08:39:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-11 15:04:59 ----RSHD---- C:\WINDOWS\system32\dllcache
2010-03-11 13:44:24 ----A---- C:\WINDOWS\NeroDigital.ini
2010-03-11 03:06:18 ----D---- C:\Program Files\Movie Maker
2010-03-11 03:06:13 ----HD---- C:\WINDOWS\inf
2010-03-11 03:06:08 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-11 03:06:08 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-11 03:05:29 ----SHD---- C:\WINDOWS\Installer
2010-03-11 03:05:29 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-03-11 03:05:29 ----D---- C:\Config.Msi
2010-03-11 00:15:02 ----D---- C:\Documents and Settings
2010-03-10 23:56:17 ----D---- C:\Program Files\SuperCopier2
2010-03-02 21:45:47 ----D---- C:\WINDOWS\system32\LogFiles
2010-03-02 21:21:06 ----D---- C:\Program Files\Fichiers communs\Adobe
2010-03-02 21:21:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-03-02 06:30:12 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-27 09:40:12 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-25 22:45:26 ----D---- C:\WINDOWS\WinSxS
2010-02-24 10:27:30 ----D---- C:\WINDOWS\ie8updates
2010-02-18 11:27:38 ----D---- C:\Documents and Settings\Utilisateur\Application Data\uTorrent
2010-02-13 18:46:28 ----D---- C:\Program Files\OpenOffice.org 3
2010-01-30 10:04:20 ----D---- C:\WINDOWS\system32\DirectX
2010-01-24 18:34:10 ----RSD---- C:\WINDOWS\Fonts
2010-01-23 09:11:44 ----N---- C:\WINDOWS\system32\tzchange.exe
2010-01-22 10:44:05 ----D---- C:\Documents and Settings\Utilisateur\Application Data\gtk-2.0

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 43008]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys []
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2004-05-05 4228]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-08-01 28520]
R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-18 56816]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-01 1412608]
R3 BCM43XX;Pilote pour carte réseau Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 CAMCAUD;Conexant AMC Audio; C:\WINDOWS\system32\drivers\camc6aud.sys [2005-08-01 38016]
R3 CAMCHALA;CAMCHALA; C:\WINDOWS\system32\drivers\camc6hal.sys [2005-08-01 349312]
R3 CmBatt;Pilote d'adaptateur secteur Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-08-22 1035008]
R3 HSFHWATI;HSFHWATI; C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-08-22 231424]
R3 LgBttPort;LGE Bluetooth TransPort; C:\WINDOWS\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
R3 LGVMODEM;LGE Virtual Modem; C:\WINDOWS\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2005-09-30 78720]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-09-15 213696]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-08-22 718464]
S3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-08-18 56648]
S3 catchme;catchme; \??\C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\catchme.sys []
S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys []
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2005-08-22 1035008]
S3 HTCAND32;HTC Device Driver; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-11-12 101120]
S3 hwusbfake;Huawei DataCard USB Fake; C:\WINDOWS\system32\DRIVERS\ewusbfake.sys [2008-11-12 99840]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 SMCIRDA;Pilote de périphérique SMC IrCC Miniport; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-08-23 36937]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20050901.036\symidsco.sys []
S3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-09-20 162432]
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2009-08-21 13056]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2009-08-21 20864]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2009-08-21 24960]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-01-19 503144]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-08-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-23 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-01 393216]
R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2008-12-03 69632]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2005-12-21 98304]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2005-11-15 73728]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

ok

encore merci de ton aide!

j'attends ton retour.

bonjour,

je ne trouve pas ce fichier......

bonjour,

J'ai remarqué, depuis ce matin, que des fenêtres publicitaires s'ouvre intempestivement.... et ce quel que soit le site que je visite.....

je suis encore infecté?

d'avance merci

goyel

depuis, je n'ai pas d'ouverture de fenetre. Mais je n'en avais pas eu tant que ca avant..... alors, pour l'instant je ne sait dire si c'est finis ou pas.....

une nouvelle fenetre publicitaire vient de s'ouvrir.....

de plus, j'ai remarqué qu'elle s'ouvrait avec internet explorer, alors que j'utilise firefox (naviqteur par defaut)

merci d'avance de ton aide

j'ai passer navilog1.exe :

Fix Navipromo version 4.0.8 commencé le 13/03/2010 22:04:35,37

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\navilog1

Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Turion(tm) 64 Mobile Technology ML-34 )
BIOS : Ver 1.00PARTTBL
USER : Utilisateur ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)


C:\ (Local Disk) - NTFS - Total:85 Go (Free:37 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:1 Go)
E:\ (CD or DVD)


Recherche executée en mode normal 


[b]Aucune Infection Navipromo/Egdaccess trouvée[/b]



*** Scan terminé 13/03/2010 22:05:06,85 ***

bah, en meme temps, depuis celle que j'ai indiquer plus haut, il n'y en a eu qu'une seule......

si ce n'est que ca, je peux faire avec en attendant de trouver d'ou cela vient..... ou un prochain formatage....

Il ne veux pas se supprimer!

Ca me dit que le fichier est utiliser par un autre programme ou une autre personne!

par ailleur, j'ai eu une alerte de avira concernant un cheval de troie TR/DROPPER.GEN sur un fichier ctv9436.exe dans le dossier temp.

bonjour,

J'ai reussit a suppimer le fameux fichier en mode sans echec. mais qd j'ai redemaré windows en mode normal, le fichier est réaparus....

J'ai refait une passe de spybot , et il m'a trouver un element browser "right media"!

voici le rapport : http://www.cijoint.fr/cjlink.php?file=cj201003/cijtQJZwMp.txt

j'ai fait corriger le probleme, mais je n'arrive tjs pas supprimer le fichier C:\WINDOWS\S7A4FE689.tmp

que dois-je faire???

le scan vient de se terminer!

voici le rapport :

wmpscfgs.exe;C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp;Trojan.DownLoad1.44361;Supprimé.;
reader_sl.exe;c:\program files\adobe\reader 9.0\reader;Trojan.DownLoad1.44361;Supprimé.;
atiptaxx.exe;c:\program files\ati technologies\ati control panel;Trojan.DownLoad1.44361;Supprimé.;
adobearm.exe;c:\program files\fichiers communs\adobe\arm\1.0;Trojan.DownLoad1.44361;Supprimé.;
nerocheck.exe;c:\program files\fichiers communs\nero\lib;Trojan.DownLoad1.44361;Supprimé.;
hpwuschd2.exe;c:\program files\hp\hp software update;Trojan.DownLoad1.44361;Supprimé.;
qpservice.exe;c:\program files\hp\quickplay;Trojan.DownLoad1.44361;Supprimé.;
cpqset.exe;c:\program files\hpq\default settings;Trojan.DownLoad1.44361;Supprimé.;
hp wireless assistant.exe;c:\program files\hpq\hp wireless assistant;Trojan.DownLoad1.44361;Supprimé.;
eabservr.exe;c:\program files\hpq\quick launch buttons;Trojan.DownLoad1.44361;Supprimé.;
application launcher.exe;c:\program files\htc\htc sync\application launcher;Trojan.DownLoad1.44361;Supprimé.;
wmpscfgs.exe;c:\program files\internet explorer;Trojan.DownLoad1.44361;Supprimé.;
jusched.exe;c:\program files\java\jre6\bin;Trojan.DownLoad1.44361;Supprimé.;
nbkeyscan.exe;c:\program files\nero\nero8\nero backitup;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;c:\program files\quicktime;Trojan.DownLoad1.44361;Supprimé.;
clonecdtray.exe;c:\program files\slysoft\clonecd;Trojan.DownLoad1.44361;Supprimé.;
teatimer.exe;c:\program files\spybot - search & destroy;Trojan.DownLoad1.44361;Supprimé.;
syntpenh.exe;c:\program files\synaptics\syntp;Trojan.DownLoad1.44361;Supprimé.;
syntpstart.exe;c:\program files\synaptics\syntp;Trojan.DownLoad1.44361;Supprimé.;
recguard.exe;c:\windows\sminst;Trojan.DownLoad1.44361;Supprimé.;
RegUBP2b-Utilisateur.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Supprimé.;
List_Killem_Install.exe/data002\{app}\Proc_end.exe;C:\Documents and Settings\Utilisateur\Bureau\List_Killem_Install.exe/data002;Tool.Prockill;;
data002;C:\Documents and Settings\Utilisateur\Bureau;L'archive contient des éléments infectés;;
List_Killem_Install.exe;C:\Documents and Settings\Utilisateur\Bureau;Conteneur comporte des objets infectés;Quarantaine.;
wmpscfgs.exe.Kill'em;C:\Kill'em\Quarantine;Trojan.DownLoad1.44361;Supprimé.;
reader_sl.exe.delme232;C:\Program Files\Adobe\Reader 9.0\Reader;Trojan.DownLoad1.44361;Supprimé.;
adobearm.exe.delme234;C:\Program Files\Fichiers communs\Adobe\ARM\1.0;Trojan.DownLoad1.44361;Supprimé.;
nmindexstoresvr.exe;C:\Program Files\Fichiers communs\Nero\Lib;Trojan.DownLoad1.44361;Supprimé.;
js.mui;C:\Program Files\Internet Explorer;Trojan.DownLoad1.44361;Supprimé.;
Proc_end.exe;C:\Program Files\List_Kill'em;Tool.Prockill;Quarantaine.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask .exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
qttask.exe;C:\Program Files\QuickTime;Trojan.DownLoad1.44361;Supprimé.;
supercopier2.exe;C:\Program Files\SuperCopier2;Trojan.DownLoad1.44361;Supprimé.;
rundll32 .exe.vir;C:\Qoobox\Quarantine\C\Documents and Settings\Utilisateur;Trojan.DownLoad1.44361;Supprimé.;
js.mui.vir;C:\Qoobox\Quarantine\C\Program Files\Internet Explorer;Trojan.DownLoad1.44361;Supprimé.;
wmpscfgs.exe.vir;C:\Qoobox\Quarantine\C\Program Files\Internet Explorer;Trojan.DownLoad1.44361;Supprimé.;