Backdoor:Win32/Rbot.OE

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v1.37, January 2008
Started On Mon Feb  04 12:01:01 2008

Quick Scan Results:
----------------
Found virus: Backdoor:Win32/Rbot.OE in regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES\\SystemTray Monitor
Found virus: Backdoor:Win32/Rbot.OE in runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES\\SystemTray Monitor
Found virus: Backdoor:Win32/Rbot.OE in file://C:\WINDOWS\system32\SysTraymon.exe


Quick Scan Removal Results
----------------
Start 'remove' for regkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES\\SystemTray Monitor
Operation succeeded !

Start 'remove' for runkey://HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES\\SystemTray Monitor
Operation succeeded !

Start 'remove' for file://\\?\C:\WINDOWS\system32\SysTraymon.exe
Operation succeeded !


Results Summary:
----------------
Found Backdoor:Win32/Rbot.OE and Removed!

Return code: 6
Microsoft Windows Malicious Software Removal Tool Finished On  Mon Feb  04 12:02:30 2008


---------------------------------------------------------------------------------------

DiagHelp version v1.4 - http://www.malekal.com
excute le 05/02/2008 à 17:16:11,60 
 
 
Liste des derniers fichies modifies/crees dans windir\system32 et prefetch 
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->05/02/2008 17:16:04
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->05/02/2008 17:15:44
C:\WINDOWS\prefetch\FIREFOX.EXE-28641590.pf -->05/02/2008 17:13:15
C:\WINDOWS\prefetch\MYSQLD.EXE-2F7B9D34.pf -->05/02/2008 17:08:04
C:\WINDOWS\prefetch\APACHE.EXE-015178B7.pf -->05/02/2008 17:08:03
C:\WINDOWS\prefetch\EASYPHP.EXE-283769AC.pf -->05/02/2008 17:08:02
C:\WINDOWS\prefetch\REALPLAY.EXE-1BF219BD.pf -->05/02/2008 17:04:32
C:\WINDOWS\prefetch\REGCURE.EXE-13DE9F84.pf -->05/02/2008 17:00:00
C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->05/02/2008 16:57:29
C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->05/02/2008 16:57:04

C:\WINDOWS\System32\drivers\NSDriver.sys -->04/01/2008 17:42:47
C:\WINDOWS\System32\drivers\AWRTRD.sys -->04/01/2008 17:42:47
C:\WINDOWS\System32\drivers\aswmon.sys -->04/12/2007 15:56:02
C:\WINDOWS\System32\drivers\aswmon2.sys -->04/12/2007 15:55:46
C:\WINDOWS\System32\drivers\aswRdr.sys -->04/12/2007 15:53:39
C:\WINDOWS\System32\drivers\aswTdi.sys -->04/12/2007 15:51:52
C:\WINDOWS\System32\drivers\aavmker4.sys -->04/12/2007 15:49:02

C:\WINDOWS\System32\nvapps.xml -->05/02/2008 10:04:13
C:\WINDOWS\System32\wpa.dbl -->05/02/2008 10:03:22
C:\WINDOWS\System32\BASSMOD.dll -->05/02/2008 01:01:37
C:\WINDOWS\System32\TuneUpDefragService.exe -->04/02/2008 16:11:47
C:\WINDOWS\System32\FlashAmpPro3.inf -->28/01/2008 12:19:06
C:\WINDOWS\System32\dp48x.hlx -->18/01/2008 16:28:45
C:\WINDOWS\System32\lsdelete.exe -->17/01/2008 14:55:21
C:\WINDOWS\System32\PerfStringBackup.INI -->14/01/2008 17:07:49
C:\WINDOWS\System32\perfh00C.dat -->14/01/2008 17:07:49
C:\WINDOWS\System32\perfh009.dat -->14/01/2008 17:07:49
C:\WINDOWS\System32\perfc00C.dat -->14/01/2008 17:07:49
C:\WINDOWS\System32\perfc009.dat -->14/01/2008 17:07:49
C:\WINDOWS\System32\MRT.INI -->09/01/2008 12:02:13
C:\WINDOWS\System32\nscompat.tlb -->04/01/2008 16:44:52
C:\WINDOWS\System32\amcompat.tlb -->04/01/2008 16:44:52
C:\WINDOWS\System32\MRT.exe -->02/01/2008 10:21:38
C:\WINDOWS\System32\uxtuneup.dll -->20/12/2007 10:41:56
C:\WINDOWS\System32\Smab0.dll -->17/12/2007 14:43:00
C:\WINDOWS\System32\TZLog.log -->14/12/2007 10:27:54
C:\WINDOWS\System32\CONFIG.NT -->09/12/2007 22:44:08
C:\WINDOWS\System32\d3d8caps.dat -->08/12/2007 12:43:40
C:\WINDOWS\System32\aswBoot.exe -->04/12/2007 14:04:28
C:\WINDOWS\System32\AvastSS.scr -->04/12/2007 13:54:04
C:\WINDOWS\System32\ssldivx.dll -->29/11/2007 23:30:16
C:\WINDOWS\System32\libdivx.dll -->29/11/2007 23:30:16

C:\WINDOWS\WindowsUpdate.log -->05/02/2008 16:35:47
C:\WINDOWS\ULEAD32.INI -->05/02/2008 10:44:27
C:\WINDOWS\wmsetup.log -->05/02/2008 10:04:45
C:\WINDOWS\0.log -->05/02/2008 10:03:13
C:\WINDOWS\bootstat.dat -->05/02/2008 10:03:00
C:\WINDOWS\QTFont.qfn -->05/02/2008 09:42:12
C:\WINDOWS\SchedLgU.Txt -->05/02/2008 02:15:59
C:\WINDOWS\wiadebug.log -->05/02/2008 02:15:57
C:\WINDOWS\wiaservc.log -->04/02/2008 21:13:48
C:\WINDOWS\QTFont.for -->04/02/2008 12:55:52
C:\WINDOWS\win.ini -->18/01/2008 17:52:43
C:\WINDOWS\super.chm -->18/01/2008 10:53:56
C:\WINDOWS\bdoscandellang.ini -->09/01/2008 15:01:48
C:\WINDOWS\bdoscandel.exe -->09/01/2008 15:01:48
C:\WINDOWS\WMSysPr9.prx -->04/01/2008 16:40:46

winlogon.exe  
	Verified:	Signed
svchost.exe  
	Verified:	Signed
ws2_32.dll  
	Verified:	Signed
user32.dll  
	Verified:	Signed
tcpip.sys  
	Verified:	Signed
ndis.sys  
	Verified:	Signed
null.sys  
	Verified:	Signed
 

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1776
Command line: C:\WINDOWS\Explorer.EXE

  Base        Size      Version	        Path
  0x44080000  0xcf000   7.00.6000.16574  C:\WINDOWS\system32\WININET.dll
  0x00400000  0x9000    6.00.5441.0000  C:\WINDOWS\system32\Normaliz.dll
  0x43e00000  0x45000   7.00.6000.16574  C:\WINDOWS\system32\iertutil.dll
  0x58b50000  0x9a000   5.82.2900.2982  C:\WINDOWS\system32\comctl32.dll
  0x76f80000  0x7f000   2001.12.4414.0308  C:\WINDOWS\system32\CLBCATQ.DLL
  0x77000000  0xd4000   2001.12.4414.0258  C:\WINDOWS\system32\COMRes.dll
  0x061e0000  0x15000   5.05.0000.0005  C:\WINDOWS\system32\SSSensor.dll
  0x65780000  0x23000   4.07.1098.0000  C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll
  0x76ac0000  0x11000   3.05.2284.0000  C:\WINDOWS\system32\ATL.DLL
  0x44160000  0x127000  7.00.6000.16574  C:\WINDOWS\system32\urlmon.dll
  0x44360000  0x5cd000  7.00.6000.16574  C:\WINDOWS\system32\ieframe.dll
  0x442b0000  0x3c000   7.00.6000.16574  C:\WINDOWS\system32\webcheck.dll
  0x164a0000  0x23000   5.02.5721.5145  C:\WINDOWS\system32\WPDShServiceObj.dll
  0x109c0000  0x2c000   5.02.5721.5145  C:\WINDOWS\system32\PortableDeviceTypes.dll
  0x7d200000  0x2be000  3.01.4000.4039  C:\WINDOWS\system32\msi.dll
  0x10930000  0x49000   5.02.5721.5145  C:\WINDOWS\system32\PortableDeviceApi.dll
  0x10000000  0xb000    1.00.0008.0000  C:\WINDOWS\system32\TPwrCfg.DLL
  0x012c0000  0x14000   1.00.0004.0000  C:\WINDOWS\system32\TPwrReg.dll
  0x012e0000  0xd000    1.00.0003.0000  C:\WINDOWS\system32\TPSTrace.DLL
  0x017c0000  0x3b000   2.06.5000.5378  C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll
  0x01800000  0x13000   7.05.0001.0036  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
  0x01bf0000  0x7000    4.00.0000.0001  C:\Program Files\Internet Download Manager\idmmkb.dll
  0x01ca0000  0x6000                    C:\Program Files\Unlocker\UnlockerCOM.dll
  0x23200000  0x3d000   2007.00.0000.0000  C:\Program Files\Ipswitch\WS_FTP Professional\wsftpsi.dll
  0x23300000  0xdf000   2007.00.0000.0001  C:\Program Files\Ipswitch\WS_FTP Professional\wsftpext.dll
  0x02700000  0xfd000   0.09.0008.0000  C:\Program Files\Ipswitch\WS_FTP Professional\LIBEAY32.dll
  0x7c340000  0x56000   7.10.3052.0004  C:\Program Files\Ipswitch\WS_FTP Professional\MSVCR71.dll
  0x02800000  0x30000   0.09.0008.0000  C:\Program Files\Ipswitch\WS_FTP Professional\SSLEAY32.dll
  0x23900000  0x4e000                   C:\Program Files\Ipswitch\WS_FTP Professional\ipspgp.dll
  0x23600000  0x29000                   C:\Program Files\Ipswitch\WS_FTP Professional\wsftplib.dll
  0x23500000  0x11000   2007.00.0000.0000  C:\Program Files\Ipswitch\WS_FTP Professional\sslsvc.dll
  0x22200000  0x12000                   C:\Program Files\Ipswitch\WS_FTP Professional\wsfirscr.dll
  0x22100000  0xc000                    C:\Program Files\Ipswitch\WS_FTP Professional\wshosts.dll
  0x7c3a0000  0x7b000   7.10.3077.0000  C:\Program Files\Ipswitch\WS_FTP Professional\MSVCP71.dll
  0x23700000  0x1dd000  2006.00.0001.0000  C:\Program Files\Ipswitch\WS_FTP Professional\res0409.dll
  0x7c140000  0x103000  7.10.3077.0000  C:\WINDOWS\system32\MFC71.DLL
  0x029d0000  0x2d000                   C:\Program Files\WinRAR\rarext.dll
  0x02860000  0x9000    2.00.0000.0004  C:\PROGRA~1\TUNEUP~2\SDShelEx-win32.dll
  0x02e00000  0x20000   8.02.0003.0014  C:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll
  0x781d0000  0x10f000  8.00.50727.0762  C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL
  0x78130000  0x9b000   8.00.50727.0762  C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
  0x5d360000  0xf000    8.00.50727.0762  C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80FRA.DLL
  0x1c000000  0x6000    1.02.0001.0000  C:\Program Files\Notepad++\nppcm.dll
  0x02e70000  0x9000    1.00.0000.0001  C:\Program Files\Vim\vim71\gvimext.dll
  0x02fb0000  0x22000   1.00.0000.0001  C:\Program Files\File Renamer Deluxe\shell.dll
  0x04190000  0x1d000   2.05.0002.0000  C:\Program Files\Beyond Compare 2\BCShellEx.dll
  0x03000000  0x2a000   7.05.0001.0036  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
  0x64f00000  0x12000   4.07.1098.0000  C:\Program Files\Alwil Software\Avast4\ashShell.dll
  0x03160000  0x10000                   C:\Program Files\Advanced JPEG Compressor\ContextMenuExt.dll
  0x14070000  0x1b000   11.00.5721.5145  C:\WINDOWS\system32\wmpshell.dll
  0x034b0000  0x747000  6.14.0010.8468  C:\WINDOWS\system32\nvcpl.dll
  0x74bf0000  0x2c000   4.02.5406.0000  C:\WINDOWS\system32\OLEACC.dll
  0x76010000  0x65000   6.02.3104.0000  C:\WINDOWS\system32\MSVCP60.dll
  0x03c40000  0x45000   6.14.0010.8468  C:\WINDOWS\system32\NVRSFR.DLL
  0x03ed0000  0x91000   1.00.0001.0010  C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll
  0x03e50000  0x5b000   8.01.0000.0000  C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
  0x040b0000  0x4c000   8.00.0000.0000  C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
  0x04150000  0x16000   5.11.0000.0003  C:\Program Files\Internet Download Manager\IDMIECC.dll
  0x04a80000  0x11a000  1.05.0000.0008  C:\PROGRA~1\SPYBOT~2\SDHelper.dll
  0x15110000  0x25a000  11.00.5721.5145  C:\WINDOWS\system32\wmvcore.dll
  0x11c70000  0x3a000   11.00.5721.5238  C:\WINDOWS\system32\WMASF.DLL
  0x748f0000  0x113000  8.90.1101.0000  C:\WINDOWS\system32\msxml3.dll
  0x050c0000  0xc4000   2.06.5000.5378  C:\Program Files\Windows Desktop Search\wdsShell.dll
  0x05190000  0xe000    2.06.5000.5378  C:\Program Files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
  0x05380000  0x23000   2.06.5000.5378  C:\Program Files\Windows Desktop Search\MSNLQP.dll
  0x60000000  0x181000  2.06.5000.5378  C:\Program Files\Windows Desktop Search\tquery.dll
  0x053f0000  0x18000   2.06.5000.5378  C:\Program Files\Windows Desktop Search\msstrc.dll
  0x44a40000  0x373000  7.00.6000.16587  C:\WINDOWS\system32\mshtml.dll
  0x05750000  0x29000   3.10.0349.0000  C:\WINDOWS\system32\msls31.dll
  0x43e60000  0xa8000   7.00.6000.16574  C:\WINDOWS\system32\mstime.dll
  0x63380000  0x78000   5.07.0000.5730  C:\WINDOWS\system32\jscript.dll
  0x74730000  0x3d000   3.525.1117.0000  C:\WINDOWS\system32\ODBC32.dll
  0x051a0000  0x18000   3.525.1117.0000  C:\WINDOWS\system32\odbcint.dll
  0x60510000  0x18000   2.00.50727.0042  C:\WINDOWS\system32\dfshim.dll
  0x79000000  0x45000   2.00.50727.0832  C:\WINDOWS\system32\mscoree.dll
  0x641f0000  0x1d000   2.00.50727.0042  C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Shfusion.dll
  0x60610000  0x6000    2.00.50727.0042  C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Fusion.dll
  0x60340000  0x8000    2.00.50727.0042  C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll
  0x64220000  0x18000   2.00.50727.0042  C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
  0x01fc0000  0x10000   8.00.0000.0456  C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  0x04830000  0x43000   2.06.5000.5378  C:\Program Files\Windows Desktop Search\dsWebAllow.dll
  0x03e40000  0x3000    2.06.5000.5378  C:\Program Files\Windows Desktop Search\fr-fr\dsWebAllowRes.dll.mui
  0x03eb0000  0x5000    2.06.5000.5378  C:\Program Files\Windows Desktop Search\dsWebAllowRes.dll
  0x04880000  0x1c000   5.20.0009.0000  C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  0x04120000  0xf000    5.20.0009.0000  C:\WINDOWS\system32\DLAAPI_W.DLL
  0x048a0000  0x9c000   5.20.0009.0000  C:\WINDOWS\System32\DLA\DLACResW.dll
  0x04980000  0x2b000   2.06.0000.2057  C:\Program Files\MSN Toolbar Suite\msntb.dll
  0x7c120000  0x19000   7.10.3077.0000  C:\Program Files\MSN Toolbar Suite\ATL71.DLL
  0x049c0000  0x68000   2.06.0000.2057  C:\Program Files\MSN Toolbar Suite\isc.dll
  0x04a30000  0x39000   2.06.0000.2057  C:\Program Files\MSN Toolbar Suite\UIComponents.dll
  0x04ff0000  0x2e000   2.06.0000.2057  C:\Program Files\MSN Toolbar Suite\fr-fr\mtbres.dll.mui
  0x04fc0000  0x12000   2.06.0000.2057  C:\Program Files\MSN Toolbar Suite\mtbres.dll
  0x325c0000  0x12000   11.00.5510.0000  C:\PROGRA~1\MICROS~2\OFFICE11\msohev.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 964
Command line: winlogon.exe

  Base        Size      Version	        Path
  0x01000000  0x81000                   \??\C:\WINDOWS\system32\winlogon.exe
  0x58b50000  0x9a000   5.82.2900.2982  C:\WINDOWS\system32\COMCTL32.dll
  0x74730000  0x3d000   3.525.1117.0000  C:\WINDOWS\system32\ODBC32.dll
  0x20000000  0x18000   3.525.1117.0000  C:\WINDOWS\system32\odbcint.dll
  0x10000000  0x11000   6.14.0010.4131  C:\WINDOWS\system32\Ati2evxx.dll
  0x01f40000  0x3b000   1.07.0018.0005  C:\WINDOWS\system32\WgaLogon.dll
  0x76f80000  0x7f000   2001.12.4414.0308  C:\WINDOWS\system32\CLBCATQ.DLL
  0x77000000  0xd4000   2001.12.4414.0258  C:\WINDOWS\system32\COMRes.dll
  0x76010000  0x65000   6.02.3104.0000  C:\WINDOWS\system32\MSVCP60.dll
  0x748f0000  0x113000  8.90.1101.0000  C:\WINDOWS\system32\msxml3.dll
 
 
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est 38D4-907A

 Répertoire de C:\WINDOWS\system32

10/08/2004  13:00             6 144 csrss.exe
               1 fichier(s)            6 144 octets
               0 Rép(s)  44 597 129 216 octets libres
 
Contenu de Downloaded Program Files 
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est 38D4-907A

 Répertoire de C:\WINDOWS\Downloaded Program Files

02/02/2008  14:14    <REP>          .
02/02/2008  14:14    <REP>          ..
15/09/2006  13:39                65 desktop.ini
08/08/2006  11:45               576 kavwebscan.inf
09/01/2008  15:01             6 742 lang.ini
13/04/2007  14:27               367 LegitCheckControl.inf
21/01/2008  17:43               130 live.ini
09/01/2008  15:01             1 244 oscan8.inf
09/01/2008  15:01             6 828 scanoptions.tsi
               7 fichier(s)           15 952 octets

     Total des fichiers listés :
               7 fichier(s)           15 952 octets
               2 Rép(s)  44 597 129 216 octets libres
 
Recherche de rootkit! (Merci S!Ri) 
 
Recherche d'infections connues 

Export des clefs sensibles.. 
 
  
Liste des fichiers en exception sur le pare-feu XP SP2 

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Enabled:Shareaza"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
 
Export de la clef SharedTaskScheduler 

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

 
 
exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
  63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
  6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
  73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00



Export des clefs sensibles.. 
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 17:17:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

IPC error: 2 Le fichier spécifié est introuvable.
scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0

 
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4     -           System  
172   -      svchost.exe  
312   -      nvsvc32.exe  
460   -   aawservice.exe  
532   -      RTHDCPL.exe  
612   -      ashServ.exe  
820   -          Smc.exe  
940   -        csrss.exe  
964   -     winlogon.exe  
1116  -        guard.exe  
1160  -     services.exe  
1172  -        lsass.exe  
1372  -      svchost.exe  
1412  -  mDNSResponder.e  
1428  -      ashDisp.exe  
1452  -       ehtray.exe  
1460  -      svchost.exe  
1512  -      svchost.exe  
1552  -       EvtEng.exe  
1580  -      svchost.exe  
1600  -     iFrmewrk.exe  
1616  -       CFSvcs.exe  
1776  -     explorer.exe  
1836  -          cmd.exe  
1856  -     S24EvMon.exe  
1996  -      TAPPSRV.exe  
2068  -        IDMan.exe  
2132  -      X10nets.exe  
2228  -      mcrdsvc.exe  
2240  -      TPSMain.exe  
2468  -       ctfmon.exe  
2548  -     ashMaiSv.exe  
2660  -     SynTPEnh.exe  
2700  -     ashWebSv.exe  
2728  -      dllhost.exe  
2912  -    IEMonitor.exe  
2928  -          alg.exe  
2956  -      ZCfgSvc.exe  
3076  -       dslmon.exe  
3092  -      TvsTray.exe  
3204  -      THotkey.exe  
3376  -     Dot1XCfg.exe  
3512  -     wmiprvse.exe  
3544  -     agrsmmsg.exe  
3552  -     DLACTRLW.EXE  
3620  -    realsched.exe  
3976  -      firefox.exe  
3984  -      SFAgent.exe  
4028  -      Toshiba.exe  
4064  -     rundll32.exe  

Total number of processes = 50
NOTE: Under WinXP, this will not show all processes.
 
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\TUKERNEL.EXE
80720000 - \WINDOWS\system32\hal.dll
F7996000 - \WINDOWS\system32\KDCOM.DLL
F78A6000 - \WINDOWS\system32\BOOTVID.dll
F7446000 - ACPI.sys
F7998000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F7435000 - pci.sys
F7496000 - isapnp.sys
F74A6000 - ohci1394.sys
F74B6000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F78AA000 - compbatt.sys
F78AE000 - \WINDOWS\system32\DRIVERS\BATTC.SYS
F7A5E000 - pciide.sys
F7716000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F7417000 - pcmcia.sys
F74C6000 - MountMgr.sys
F73F8000 - ftdisk.sys
F799A000 - dmload.sys
F73D2000 - dmio.sys
F78B2000 - ACPIEC.sys
F7A5F000 - \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
F771E000 - PartMgr.sys
F74D6000 - VolSnap.sys
F73BA000 - atapi.sys
F74E6000 - disk.sys
F74F6000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F739A000 - fltMgr.sys
F7388000 - sr.sys
F7372000 - DRVMCDB.SYS
F7726000 - PxHelp20.sys
F735B000 - KSecDD.sys
F72CE000 - Ntfs.sys
F72A1000 - NDIS.sys
F7284000 - Teefer.sys
F7269000 - Mup.sys
F7526000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F75D6000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F722D000 - \SystemRoot\system32\DRIVERS\CmBatt.sys
F6323000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
F630F000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F62EA000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
F6149000 - \SystemRoot\system32\DRIVERS\NETw3x32.sys
F77EE000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F6126000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F77F6000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F60FE000 - \SystemRoot\system32\drivers\tifm21.sys
F60EB000 - \SystemRoot\system32\DRIVERS\sdbus.sys
F60C3000 - \SystemRoot\system32\DRIVERS\e100b325.sys
F75E6000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F77FE000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F6094000 - \SystemRoot\system32\DRIVERS\SynTP.sys
F79D6000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F7806000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F75F6000 - \SystemRoot\system32\DRIVERS\imapi.sys
F780E000 - \SystemRoot\system32\drivers\iviaspi.sys
F6D5D000 - \SystemRoot\system32\drivers\pfc.sys
F79D8000 - \SystemRoot\System32\Drivers\DLACDBHM.SYS
F7606000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F7696000 - \SystemRoot\system32\DRIVERS\redbook.sys
F6071000 - \SystemRoot\system32\DRIVERS\ks.sys
F79DA000 - \SystemRoot\System32\Drivers\x10hid.sys
F7626000 - \SystemRoot\System32\Drivers\HIDCLASS.SYS
F7816000 - \SystemRoot\System32\Drivers\HIDPARSE.SYS
F7BCE000 - \SystemRoot\system32\DRIVERS\audstub.sys
F6BF3000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F6D3D000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F605A000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F76D6000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F76E6000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F788E000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F6049000 - \SystemRoot\system32\DRIVERS\psched.sys
F7706000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F7896000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F789E000 - \SystemRoot\system32\DRIVERS\raspti.sys
F6018000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
F7516000 - \SystemRoot\system32\DRIVERS\termdd.sys
F79E0000 - \SystemRoot\system32\DRIVERS\swenum.sys
F5FBF000 - \SystemRoot\system32\DRIVERS\update.sys
F795A000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F79E2000 - \SystemRoot\system32\DRIVERS\NBSMI.sys
F795E000 - \SystemRoot\system32\DRIVERS\kbdhid.sys
F7576000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F3A20000 - \SystemRoot\system32\drivers\RtkHDAud.sys
F39FE000 - \SystemRoot\system32\drivers\portcls.sys
F6C83000 - \SystemRoot\system32\drivers\drmk.sys
F7566000 - \SystemRoot\system32\DRIVERS\Tvs.sys
F7736000 - \SystemRoot\system32\DRIVERS\tsxt_kern_i386.sys
F775E000 - \SystemRoot\system32\DRIVERS\wowhd_kern_i386.sys
F7586000 - \SystemRoot\system32\DRIVERS\csiidecoder_kern_i386.sys
F38C3000 - \SystemRoot\system32\DRIVERS\AGRSM.sys
F7766000 - \SystemRoot\System32\Drivers\Modem.SYS
F75C6000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F79F2000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7BD3000 - \SystemRoot\System32\Drivers\Null.SYS
F79F4000 - \SystemRoot\System32\Drivers\Beep.SYS
F7796000 - \SystemRoot\System32\Drivers\DLARTL_N.SYS
F7BD5000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys
F779E000 - \SystemRoot\System32\drivers\vga.sys
F79FE000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7A00000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F77A6000 - \SystemRoot\System32\Drivers\Msfs.SYS
F77AE000 - \SystemRoot\System32\Drivers\Npfs.SYS
F797A000 - \SystemRoot\system32\DRIVERS\rasacd.sys
F3868000 - \SystemRoot\system32\DRIVERS\ipsec.sys
F3810000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F7536000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F6C73000 - \SystemRoot\System32\Drivers\aswTdi.SYS
F37EF000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F6C63000 - \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys
F3727000 - \SystemRoot\system32\DRIVERS\netbt.sys
F6C53000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F7245000 - \SystemRoot\System32\drivers\ws2ifsl.sys
F3705000 - \SystemRoot\System32\drivers\afd.sys
F6C43000 - \SystemRoot\system32\DRIVERS\netbios.sys
F36DA000 - \SystemRoot\system32\DRIVERS\rdbss.sys
F366B000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F6C33000 - \SystemRoot\System32\Drivers\Fips.SYS
F7A64000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
F77BE000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
F6C03000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F77C6000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
F6D55000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F39EA000 - \SystemRoot\system32\DRIVERS\mouhid.sys
F362B000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7A3E000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F66B9000 - \SystemRoot\System32\drivers\Dxapi.sys
F77E6000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F7B72000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\nv4_disp.dll
BADE4000 - \SystemRoot\system32\DRIVERS\adiusbae.sys
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
F76C6000 - \SystemRoot\System32\Drivers\DRVNDDM.SYS
F7B4C000 - \SystemRoot\System32\DLA\DLADResN.SYS
BAC8E000 - \SystemRoot\System32\DLA\DLAIFS_M.SYS
BAD28000 - \SystemRoot\System32\DLA\DLAOPIOM.SYS
F79A4000 - \SystemRoot\System32\DLA\DLAPoolM.SYS
F7846000 - \SystemRoot\System32\DLA\DLABOIOM.SYS
BAC76000 - \SystemRoot\System32\DLA\DLAUDFAM.SYS
BAC60000 - \SystemRoot\System32\DLA\DLAUDF_M.SYS
F7856000 - \SystemRoot\system32\DRIVERS\AegisP.sys
BAC5C000 - \SystemRoot\system32\DRIVERS\s24trans.sys
BA350000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
BA34C000 - \SystemRoot\system32\DRIVERS\netdevio.sys
BA324000 - \SystemRoot\SYSTEM32\Drivers\wg3n.sys
BAD00000 - \SystemRoot\SYSTEM32\Drivers\wg4n.sys
B9A7C000 *  --[Hidden]--
B9A74000 - \SystemRoot\SYSTEM32\Drivers\wg6n.sys
B992A000 - \SystemRoot\System32\Drivers\aswMon2.SYS
B96F5000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
B96B8000 - \SystemRoot\system32\drivers\wdmaud.sys
BABC8000 - \SystemRoot\system32\drivers\sysaudio.sys
B937F000 - \SystemRoot\System32\Drivers\HTTP.sys
B9265000 - \SystemRoot\system32\DRIVERS\srv.sys
B8E2D000 *  --[Hidden]--
B5C0C000 - \SystemRoot\system32\drivers\kmixer.sys
F7B9D000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 158

Liste des programmes installes

1st JavaScript Editor 3.8 
A1 Sitemap Generator 
Ad-Aware 2007 
Adobe Anchor Service CS3 
Adobe Asset Services CS3 
Adobe Bridge CS3 
Adobe Bridge Start Meeting 
Adobe Camera Raw 4.0 
Adobe Captivate 3 
Adobe CMaps 
Adobe Color - Photoshop Specific 
Adobe Color Common Settings 
Adobe Color Common Settings 
Adobe Color EU Extra Settings 
Adobe Color JA Extra Settings 
Adobe Color NA Recommended Settings 
Adobe Default Language CS3 
Adobe Device Central CS3 
Adobe Dreamweaver CS3 
Adobe Dreamweaver CS3 
Adobe ExtendScript Toolkit 2 
Adobe ExtendScript Toolkit 2 
Adobe Extension Manager CS3 
Adobe Fireworks CS3 
Adobe Fireworks CS3 
Adobe Flash CS3 
Adobe Flash CS3 Professional 
Adobe Flash Player ActiveX 
Adobe Flash Player Plugin 
Adobe Flash Video Encoder 
Adobe Fonts All 
Adobe Help Viewer CS3 
Adobe Linguistics CS3 
Adobe PDF Library Files 
Adobe Photoshop CS3 
Adobe Photoshop CS3 
Adobe Reader 8.1.1 - Français 
Adobe Setup 
Adobe Setup 
Adobe Setup 
Adobe Setup 
Adobe Setup 
Adobe Setup 
Adobe Shockwave Player 
Adobe Stock Photos CS3 
Adobe Type Support 
Adobe Update Manager CS3 
Adobe Version Cue CS3 Client 
Adobe WinSoft Linguistics Plugin 
Adobe XMP Panels CS3 
Adobe® Photoshop® Album Edition Découverte 3.2 
Adobe® Photoshop® Album Edition Découverte 3.2 
Advanced JPEG Compressor 5.1 
Amaya 
AnFX 5.3.4.7 
Antechinus JavaScript Editor v9.0 
Apple Software Update 
Aptana Studio 
Arles Image Web Page Creator 7.2.1 
Assist TOSHIBA 
Avanquest update 
avast! Antivirus 
AVG Anti-Spyware 7.5 
Barre d'outils MSN Search 
Beyond Compare Version 2.5 
Bluetooth Stack for Windows by Toshiba 
Call of Duty(R) 4 - Modern Warfare(TM) 
Call of Duty(R) 4 - Modern Warfare(TM) 
CCleaner (remove only) 
CHM To PDF Converter PRO 
Commandes TOSHIBA 
Correctif n° 2 pour Windows XP Édition Media Center 2005 
Correctif pour Lecteur Windows Media 10 (KB910393) 
Correctif pour Lecteur Windows Media 11 (KB939683) 
Correctif pour Windows XP (KB888795) 
Correctif pour Windows XP (KB891593) 
Correctif pour Windows XP (KB893357) 
Correctif pour Windows XP (KB894871) 
Correctif pour Windows XP (KB896243) 
Correctif pour Windows XP (KB896256) 
Correctif pour Windows XP (KB899337) 
Correctif pour Windows XP (KB899510) 
Correctif pour Windows XP (KB902841) 
Correctif pour Windows XP (KB910728) 
Correctif pour Windows XP (KB914440) 
Correctif pour Windows XP (KB917332) 
Correctif pour Windows XP (KB935448) 
Correctif Windows XP - KB873339 
Correctif Windows XP - KB885250 
Correctif Windows XP - KB885835 
Correctif Windows XP - KB885836 
Correctif Windows XP - KB885855 
Correctif Windows XP - KB886185 
Correctif Windows XP - KB887472 
Correctif Windows XP - KB888113 
Correctif Windows XP - KB888302 
Correctif Windows XP - KB888622 
Correctif Windows XP - KB889673 
Correctif Windows XP - KB890546 
Correctif Windows XP - KB890859 
Correctif Windows XP - KB891781 
Correctif Windows XP - KB893056 
Correctif Windows XP - KB895200 
Correctif Windows XP - KB895961 
DivX Content Uploader 
DivX Web Player 
EasyPHP 1.8 
Extracteur d'icônes version 3.0 
Flash Decompiler 
Flash Decompiler Trillix 
Formatage de carte mémoire SD TOSHIBA 
Free - Kit de connexion 
Gestion d'énergie TOSHIBA 
getPlus(R)_dll 
High Definition Audio Driver Package - KB888111 
HijackThis 2.0.2 
Hotfix for Windows Media Format 11 SDK (KB929399) 
Hotfix for Windows Media Player 10 (KB903157) 
Hotfix for Windows XP (KB915865) 
Hotfix for Windows XP (KB926239) 
Html To Image 2.0 
HTMLPad 2007 Pro v8.31 
Hyper Lobby Pro Client version 3.9.111 
IL-2 Sturmovik 1946 
IL-2 Sturmovik 1946 
Instant Demo 
Intel(R) PRO Network Connections Drivers 
Internet Download Manager 
Internet Explorer Developer Toolbar 
InterVideo WinDVD Creator 2 
InterVideo WinDVD for TOSHIBA 
Ipswitch WS_FTP Professional 2007 
IsoBuster 2.2 
J2SE Runtime Environment 5.0 Update 6 
Java 2 Runtime Environment, SE v1.4.2_04 
Java DB 10.2.2.0 
Java(TM) 6 Update 2 
Java(TM) 6 Update 3 
Java(TM) SE Development Kit 6 Update 2 
JavaScript Collector 1.1.0.4 
Kaspersky On-line Scanner 
Kaspersky Online Scanner 
KompoZer 0.77 
La boite a couleurs version 1.6.14 
Lecteur Windows Media 11 
Logiciel Intel(R) PROSet/Wireless 
Macromedia Flash Player 
Manuels TOSHIBA 
Mapedit 
mCore 
mDrWiFi 
mHelp 
Microsoft .NET Framework 1.0 Hotfix (KB887998) 
Microsoft .NET Framework 1.0 Hotfix (KB930494) 
Microsoft .NET Framework 1.1 
Microsoft .NET Framework 1.1 
Microsoft .NET Framework 1.1 French Language Pack 
Microsoft .NET Framework 1.1 Hotfix (KB928366) 
Microsoft .NET Framework 2.0 
Microsoft .NET Framework 2.0 
Microsoft BootVis 
Microsoft Compression Client Pack 1.0 for Windows XP 
Microsoft Internationalized Domain Names Mitigation APIs 
Microsoft National Language Support Downlevel APIs 
Microsoft Office Excel Viewer 2003 
Microsoft Office OneNote 2003 
Microsoft User-Mode Driver Framework Feature Pack 1.0 
Microsoft Visual C++ 2005 Redistributable 
Mise à jour de sécurité pour Lecteur Windows Media (KB911564) 
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734) 
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782) 
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782) 
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) 
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615) 
Mise à jour de sécurité pour Windows XP (KB890046) 
Mise à jour de sécurité pour Windows XP (KB893756) 
Mise à jour de sécurité pour Windows XP (KB896358) 
Mise à jour de sécurité pour Windows XP (KB896422) 
Mise à jour de sécurité pour Windows XP (KB896423) 
Mise à jour de sécurité pour Windows XP (KB896424) 
Mise à jour de sécurité pour Windows XP (KB896428) 
Mise à jour de sécurité pour Windows XP (KB899587) 
Mise à jour de sécurité pour Windows XP (KB899589) 
Mise à jour de sécurité pour Windows XP (KB899591) 
Mise à jour de sécurité pour Windows XP (KB900725) 
Mise à jour de sécurité pour Windows XP (KB901017) 
Mise à jour de sécurité pour Windows XP (KB901190) 
Mise à jour de sécurité pour Windows XP (KB901214) 
Mise à jour de sécurité pour Windows XP (KB902400) 
Mise à jour de sécurité pour Windows XP (KB904706) 
Mise à jour de sécurité pour Windows XP (KB905414) 
Mise à jour de sécurité pour Windows XP (KB905749) 
Mise à jour de sécurité pour Windows XP (KB908519) 
Mise à jour de sécurité pour Windows XP (KB908531) 
Mise à jour de sécurité pour Windows XP (KB911280) 
Mise à jour de sécurité pour Windows XP (KB911562) 
Mise à jour de sécurité pour Windows XP (KB911567) 
Mise à jour de sécurité pour Windows XP (KB911927) 
Mise à jour de sécurité pour Windows XP (KB912919) 
Mise à jour de sécurité pour Windows XP (KB913580) 
Mise à jour de sécurité pour Windows XP (KB914388) 
Mise à jour de sécurité pour Windows XP (KB914389) 
Mise à jour de sécurité pour Windows XP (KB916281) 
Mise à jour de sécurité pour Windows XP (KB917344) 
Mise à jour de sécurité pour Windows XP (KB917422) 
Mise à jour de sécurité pour Windows XP (KB917953) 
Mise à jour de sécurité pour Windows XP (KB918118) 
Mise à jour de sécurité pour Windows XP (KB918439) 
Mise à jour de sécurité pour Windows XP (KB919007) 
Mise à jour de sécurité pour Windows XP (KB920213) 
Mise à jour de sécurité pour Windows XP (KB920670) 
Mise à jour de sécurité pour Windows XP (KB920683) 
Mise à jour de sécurité pour Windows XP (KB920685) 
Mise à jour de sécurité pour Windows XP (KB921503) 
Mise à jour de sécurité pour Windows XP (KB922819) 
Mise à jour de sécurité pour Windows XP (KB923191) 
Mise à jour de sécurité pour Windows XP (KB923414) 
Mise à jour de sécurité pour Windows XP (KB923689) 
Mise à jour de sécurité pour Windows XP (KB923694) 
Mise à jour de sécurité pour Windows XP (KB923980) 
Mise à jour de sécurité pour Windows XP (KB924191) 
Mise à jour de sécurité pour Windows XP (KB924270) 
Mise à jour de sécurité pour Windows XP (KB924496) 
Mise à jour de sécurité pour Windows XP (KB924667) 
Mise à jour de sécurité pour Windows XP (KB925902) 
Mise à jour de sécurité pour Windows XP (KB926255) 
Mise à jour de sécurité pour Windows XP (KB926436) 
Mise à jour de sécurité pour Windows XP (KB927779) 
Mise à jour de sécurité pour Windows XP (KB927802) 
Mise à jour de sécurité pour Windows XP (KB928255) 
Mise à jour de sécurité pour Windows XP (KB928843) 
Mise à jour de sécurité pour Windows XP (KB929123) 
Mise à jour de sécurité pour Windows XP (KB930178) 
Mise à jour de sécurité pour Windows XP (KB931261) 
Mise à jour de sécurité pour Windows XP (KB931768) 
Mise à jour de sécurité pour Windows XP (KB931784) 
Mise à jour de sécurité pour Windows XP (KB932168) 
Mise à jour de sécurité pour Windows XP (KB933729) 
Mise à jour de sécurité pour Windows XP (KB935839) 
Mise à jour de sécurité pour Windows XP (KB935840) 
Mise à jour de sécurité pour Windows XP (KB936021) 
Mise à jour de sécurité pour Windows XP (KB937894) 
Mise à jour de sécurité pour Windows XP (KB938829) 
Mise à jour de sécurité pour Windows XP (KB941202) 
Mise à jour de sécurité pour Windows XP (KB941568) 
Mise à jour de sécurité pour Windows XP (KB941569) 
Mise à jour de sécurité pour Windows XP (KB941644) 
Mise à jour de sécurité pour Windows XP (KB943460) 
Mise à jour de sécurité pour Windows XP (KB943485) 
Mise à jour de sécurité pour Windows XP (KB944653) 
Mise à jour pour Lecteur Windows Media 10 (KB913800) 
Mise à jour pour Lecteur Windows Media 10 (KB926251) 
Mise à jour pour Windows XP (KB894391) 
Mise à jour pour Windows XP (KB898461) 
Mise à jour pour Windows XP (KB900485) 
Mise à jour pour Windows XP (KB904942) 
Mise à jour pour Windows XP (KB910437) 
Mise à jour pour Windows XP (KB916595) 
Mise à jour pour Windows XP (KB920872) 
Mise à jour pour Windows XP (KB922582) 
Mise à jour pour Windows XP (KB927891) 
Mise à jour pour Windows XP (KB930916) 
Mise à jour pour Windows XP (KB931836) 
Mise à jour pour Windows XP (KB933360) 
Mise à jour pour Windows XP (KB936357) 
Mise à jour pour Windows XP (KB938828) 
Mise à jour pour Windows XP (KB942763) 
mIWA 
mLogView 
mMHouse 
Mozilla Firefox (2.0.0.11) 
mPfMgr 
mPfWiz 
mProSafe 
MSXML 4.0 SP2 (KB927978) 
MSXML 4.0 SP2 (KB936181) 
MultipleIEs 
mWlsSafe 
mXML 
mZConfig 
Notepad++ 
NVIDIA Drivers 
Open Studio 1.0 
Opera 9.25 
Outil de diagnostic PC TOSHIBA 
Outil de diagnostic PC TOSHIBA 
Password Keeper 
PDF Settings 
phpDesigner 2007 Professional version 5.5 
PHPMaker 5.0 
PSPad editor 
QuickTime 
QuickTime 
RealPlayer 
Realtek High Definition Audio Driver 
RegCure 1.5.0.0 
Réducteur de bruit lect. CD/DVD 
Safari 
SAGEM F@st 800-908 
Script Edit 
SD Secure Module 
Security Update pour Microsoft .NET Framework 2.0 (KB928365) 
Shareaza version 2.2.5.0 
SnagIt 8 
Snap Shots 
Son virtuel TOSHIBA 
Sonic DLA 
Sonic Encoders 
Sonic RecordNow! 
Sothink DHTML Menu 8 
Sothink JWScroller 
Sothink SWF Decompiler 
Spelling Dictionaries Support For Adobe Reader 8 
Spybot - Search & Destroy 
Spybot - Search & Destroy 1.4 
Startup Faster! 
Style Master 4.6 
SUPER © Version 2008.bld.24 (Jan 18, 2008) 
Sygate Personal Firewall Pro 
Synaptics Pointing Device Driver 
Texas Instruments PCIxx21/x515/xx12 drivers. 
Texefex 3.1 
Text-Osterone 1.117 
Tidy (February 16th, 2006) 
TIPCI 
TopStyle (Version 3) 
TOSHIBA ConfigFree 
TOSHIBA Hotkey Utility 
TOSHIBA Software Modem 
TOSHIBA TouchPad ON/Off Utility 
TOSHIBA Utilities 
TuneUp Utilities 2008 
Ulead GIF Animator 5 ESD 
Unlocker 1.8.5 
Utilitaire de zoom TOSHIBA 
Vim 7.1 (self-installing) 
VSO Image Resizer 1.3.3 
Web Easy Professional 7 
Web Easy Professional 7 
Web Easy Professional 7 
Web Easy Professional 7 
Web Easy Professional 7 
Web Easy Professional 7 
Web Gallery Builder version 1.87 
WebFldrs XP 
Website Popularity 2.0 
Website Submitter 2.0 
Windows Desktop Search  
Windows Installer 3.1 (KB893803) 
Windows Internet Explorer 7 
Windows Media Format 11 runtime 
Windows Media Format 11 runtime 
Windows Media Player 11 
Windows Media Player Firefox Plugin 
Windows XP Édition Media Center 2005 KB888316 
Windows XP Media Center Edition 2005 KB894553 
Windows XP Media Center Edition 2005 KB895678 
Windows XP Media Center Edition 2005 KB925766 
WinHex 
WinHighlight 2.6.7 
WinHTTrack Website Copier 3.41-2 
WinRAR archiver 
WMHelp XMLPad 
X10 Hardware(TM) 
Yahoo! Install Manager 
Yahoo! Toolbar avec bloqueur de fenêtres pop-up 
Yaldex PopUp 4.9 
Your Uninstaller! 2008 Version 6.0 


 
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est 38D4-907A

 Répertoire de C:\Program Files

04/02/2008  21:18    <REP>          .
04/02/2008  21:18    <REP>          ..
10/12/2007  11:42    <REP>          Activision
27/01/2008  19:39    <REP>          Adobe
05/02/2008  01:02    <REP>          Advanced JPEG Compressor
12/08/2007  09:25    <REP>          Alwil Software
04/11/2007  18:10    <REP>          Amaya
22/10/2007  09:20    <REP>          AnFX 5
17/01/2008  10:59    <REP>          Apple Software Update
18/11/2007  15:51    <REP>          Aptana
26/08/2007  01:46    <REP>          Arigola Html2Php Converter
15/01/2008  17:21    <REP>          Autoplay Media Studio 6.0.5.0
02/11/2007  17:36    <REP>          Avanquest
02/11/2007  17:36    <REP>          Avanquest update
27/07/2007  23:45    <REP>          AviSynth 2.5
08/08/2007  17:04    <REP>          Beyond Compare 2
14/05/2007  13:10    <REP>          Bonjour
19/10/2007  20:40    <REP>          Bradbury
25/01/2008  19:52    <REP>          CCleaner
17/11/2007  21:40    <REP>          CHM To PDF Converter PRO
26/04/2007  22:33    <REP>          Common Files
16/08/2007  17:35    <REP>          CPoint
13/09/2007  18:29    <REP>          Digital Dutch
12/01/2008  01:10    <REP>          DivX
26/08/2007  01:46    <REP>          EasyPHP1-8
14/11/2007  15:36    <REP>          Eltima Software
03/02/2008  02:10    <REP>          eRightSoft
15/11/2007  13:33    <REP>          Extracteur Icones 3
28/01/2008  23:14    <REP>          Fichiers communs
25/10/2007  19:14    <REP>          File Renamer Deluxe
14/05/2007  16:54    <REP>          Free.fr
21/07/2007  00:40    <REP>          Grisoft
10/07/2007  20:32    <REP>          Html To Image
18/01/2008  00:35    <REP>          HTMLPad 2007
03/02/2008  19:04    <REP>          HyperLobbyPro3
03/11/2007  20:03    <REP>          IEInspector
26/04/2007  15:23    <REP>          Intel
04/08/2007  08:00    <REP>          Internet Download Manager
14/12/2007  10:27    <REP>          Internet Explorer
26/04/2007  22:35    <REP>          InterVideo
25/07/2007  16:20    <REP>          Ipswitch
15/01/2008  13:56    <REP>          JAlbum
12/11/2007  18:55    <REP>          Java
10/08/2007  09:39    <REP>          JavaScript Collector
19/07/2007  13:47    <REP>          JMBerthier
09/08/2007  13:25    <REP>          KompoZer
30/07/2007  09:25    <REP>          LaBoiteACouleurs
21/07/2007  08:11    <REP>          Lavasoft
26/04/2007  22:36    <REP>          ltmoh
06/01/2008  00:00    <REP>          Maguma Open Studio
01/11/2007  09:26    <REP>          Mapedit
26/04/2007  22:36    <REP>          Messenger
03/11/2007  23:33    <REP>          Microsoft
14/12/2007  17:04    <REP>          Microsoft BootVis
26/04/2007  22:36    <REP>          microsoft frontpage
26/04/2007  22:36    <REP>          Microsoft Office
14/01/2008  22:26    <REP>          Microsoft SQL Server
26/04/2007  22:36    <REP>          Microsoft.NET
08/01/2008  11:02    <REP>          Micro-Sys Software
26/04/2007  22:36    <REP>          Movie Maker
05/02/2008  17:13    <REP>          Mozilla Firefox
26/04/2007  22:36    <REP>          MSN
26/04/2007  22:36    <REP>          MSN Gaming Zone
26/04/2007  22:36    <REP>          MSN Toolbar Suite
07/08/2007  21:37    <REP>          MultipleIEs
13/10/2007  23:47                 0 MultiTransefind.ini
26/04/2007  22:36    <REP>          NetMeeting
10/11/2007  15:57    <REP>          NetPlay Software
20/01/2008  00:26    <REP>          Notepad++
26/04/2007  22:37    <REP>          Offre Wanadoo
26/04/2007  22:37    <REP>          Online Services
23/12/2007  15:16    <REP>          Opera
17/06/2007  08:00    <REP>          Outlook Express
21/11/2007  22:47    <REP>          phpDesigner 2007 Professional
08/09/2007  17:37    <REP>          PHPMaker 5
11/11/2007  17:40    <REP>          PSPad editor
24/07/2007  11:55    <REP>          QuickTime
01/11/2007  16:56    <REP>          Real
26/04/2007  22:37    <REP>          Realtek
18/01/2008  18:46    <REP>          RegCure
17/01/2008  11:00    <REP>          Safari
14/05/2007  16:57    <REP>          SAGEM
27/09/2007  09:25    <REP>          Script Edit
26/04/2007  22:37    <REP>          Services en ligne
21/07/2007  07:48    <REP>          Shareaza
01/02/2008  22:46    <REP>          Sisulizer 1
13/11/2007  02:45    <REP>          SlideshowZilla
02/12/2007  18:01    <REP>          Smart Projects
23/09/2007  08:02    <REP>          Snap Shots
17/07/2007  16:01    <REP>          SoftChris
26/07/2007  00:32    <REP>          Software by Design
26/04/2007  22:37    <REP>          Sonic
28/12/2007  02:08    <REP>          SourceTec
12/08/2007  11:24    <REP>          Spybot - Search & Destroy
07/01/2008  02:17    <REP>          Spybot - Search & Destroya
15/12/2007  22:39    <REP>          Startup Faster
09/01/2008  21:28    <REP>          Submit Suite
11/07/2007  23:36    <REP>          Sun
12/08/2007  09:38    <REP>          Sygate
26/04/2007  22:37    <REP>          Synaptics
22/07/2007  09:58    <REP>          TechSmith
20/11/2007  10:09    <REP>          Texefex
15/07/2007  08:29    <REP>          Tidy
26/04/2007  22:38    <REP>          Toshiba
25/01/2008  14:37    <REP>          Trend Micro
04/02/2008  16:11    <REP>          TuneUp Utilities 2008
02/12/2007  18:39    <REP>          Ubisoft
22/09/2007  18:43    <REP>          Ulead Systems
01/08/2007  19:24    <REP>          Unlocker
21/07/2007  07:59    <REP>          uTorrent
23/09/2007  09:55    <REP>          Vertical Moon
08/08/2007  17:33    <REP>          Vim
01/08/2007  13:14    <REP>          VSO
20/11/2007  15:06    <REP>          Web Gallery Builder
13/05/2007  17:00    <REP>          western civilisation
26/04/2007  22:38    <REP>          Windows Desktop Search
04/01/2008  16:41    <REP>          Windows Media Connect 2
04/01/2008  16:41    <REP>          Windows Media Player
26/04/2007  22:39    <REP>          Windows NT
26/04/2007  22:39    <REP>          Windows Plus
08/09/2007  17:37    <REP>          Windows Script Control
22/10/2007  09:20    <REP>          WinHex
15/01/2008  16:35    <REP>          WinHighlight
11/07/2007  20:58    <REP>          WinHTTrack
07/08/2007  01:17    <REP>          WinRAR
10/08/2007  21:11    <REP>          WMHelp Software
26/04/2007  22:39    <REP>          X10 Hardware
26/04/2007  22:39    <REP>          xerox
13/08/2007  23:55    <REP>          Xinox Software
01/08/2007  23:54    <REP>          Yahoo!
19/11/2007  13:52    <REP>          Yaldex Software
08/12/2007  23:14    <REP>          Your Uninstaller 2008
               1 fichier(s)                0 octets
             131 Rép(s)  44 587 233 280 octets libres
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est 38D4-907A

 Répertoire de C:\Program Files\fichiers communs

28/01/2008  23:14    <REP>          .
28/01/2008  23:14    <REP>          ..
25/07/2007  22:31    <REP>          Adobe
08/09/2007  17:37    <REP>          e.World
26/04/2007  22:33    <REP>          InstallShield
26/04/2007  22:33    <REP>          InterVideo
26/04/2007  22:33    <REP>          Java
21/03/2003  12:45           250 544 keyhelp.ocx
14/05/2007  13:03    <REP>          Macrovision Shared
18/08/2007  11:29    <REP>          Microsoft Shared
26/04/2007  22:34    <REP>          MSSoap
26/04/2007  22:34    <REP>          ODBC
08/11/2007  22:29    <REP>          Real
26/04/2007  22:34    <REP>          Services
05/08/2007  22:36    <REP>          SourceTec
26/04/2007  22:34    <REP>          SpeechEngines
29/07/2007  17:04    <REP>          SWF Studio
12/08/2007  09:19    <REP>          Symantec Shared
17/06/2007  08:00    <REP>          System
14/01/2008  22:26    <REP>          Wise Installation Wizard
08/11/2007  22:29    <REP>          xing shared
               1 fichier(s)          250 544 octets
              20 Rép(s)  44 587 241 472 octets libres
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est 38D4-907A

 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

26/04/2007  22:34    <REP>          .
26/04/2007  22:34    <REP>          ..
26/04/2007  22:34    <REP>          1033
26/04/2007  22:34    <REP>          1036
11/07/2003  09:15         1 292 872 MSONSEXT.DLL
15/07/2003  05:52            35 896 MSOSV.DLL
03/06/1999  11:09           122 937 MSOWS409.DLL
07/03/2001  06:00           127 033 MSOWS40c.DLL
11/07/2003  01:25            80 448 PKMWS.DLL
               5 fichier(s)        1 659 186 octets
               4 Rép(s)  44 587 241 472 octets libres
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est 38D4-907A

 Répertoire de C:\Program Files\common files

26/04/2007  22:33    <REP>          .
26/04/2007  22:33    <REP>          ..
26/04/2007  22:33    <REP>          X10
               0 fichier(s)                0 octets
               3 Rép(s)  44 587 241 472 octets libres
 
 
 
 
c:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
c:\Documents and Settings\user\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
c:\Documents and Settings\user\Application Data\Aptana\Aptana Studio\configuration\org.eclipse.osgi\bundles\46\1\.cp\samples\sockets\ChatService\ChatService\bin\Release\ChatService.exe
c:\Documents and Settings\user\Application Data\Aptana\Aptana Studio\configuration\org.eclipse.osgi\bundles\46\1\.cp\samples\sockets\ChatService\ChatService\bin\Release\ChatService.vshost.exe
c:\Documents and Settings\user\Application Data\Aptana\Aptana Studio\configuration\org.eclipse.osgi\bundles\46\1\.cp\samples\sockets\ChatService\ChatService\obj\Debug\ChatService.exe
c:\Documents and Settings\user\Application Data\Aptana\Aptana Studio\configuration\org.eclipse.osgi\bundles\46\1\.cp\samples\sockets\ChatService\ChatService\obj\Release\ChatService.exe
c:\Documents and Settings\user\Application Data\Microsoft\Installer\{C619B312-19F3-460A-9F7B-443248379F18}\ARPPRODUCTICON.exe
c:\Documents and Settings\user\Application Data\Real\RealPlayer\setup\AU_setup.exe
c:\Documents and Settings\user\Bureau\TidyGUIfr.exe
c:\Documents and Settings\user\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\user\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\user\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\user\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\user\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\user\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\user\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\user\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\user\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\user\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\user\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\user\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\user\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\user\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\user\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\user\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\user\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\user\Bureau\Essais\fr.exe
c:\Documents and Settings\user\Bureau\Essais\bgmen\WEB SERVER\Web_dream\Web_Installers\InstData\Windows\VM\install.exe
c:\Documents and Settings\user\Bureau\Essais\flvmdigui105\flvmdi.exe
c:\Documents and Settings\user\Bureau\Essais\flvmdigui105\flvmdigui.exe
c:\Documents and Settings\user\Bureau\Essais\flvmdigui105\flvmdi294exe\flvmdi.exe
c:\Documents and Settings\user\Bureau\Essais\javascriptfr_TOOL\LoadingProgressBar_Gen\LoadingProgress Gen.exe
c:\Documents and Settings\user\Bureau\exemple\fr\TidyGUIfr.exe
c:\Documents and Settings\user\Bureau\exemple\fr\fr\TidyGUIfr.exe
c:\Documents and Settings\user\Bureau\exemple\fr\fr\Nouveau dossier\TidyGUIfr.exe
c:\Documents and Settings\user\Bureau\exemple\fr\fr\Nouveau dossier\fr\TidyGUIfr.exe
c:\Documents and Settings\user\Bureau\flash\flash\NAVIGATEUROSCDROM\NAVIGATEUR OS CDROM\CDROM\CDRomControleProjection.exe
c:\Documents and Settings\user\Bureau\flash\flash\NAVIGATEUROSCDROM\NAVIGATEUR OS CDROM\CDROM\fscommand\Frise.exe
c:\Documents and Settings\user\Bureau\flash\flash\NAVIGATEUROSCDROM\__MACOSX\NAVIGATEUR OS CDROM\CDROM\._CDRomControleProjection.exe
c:\Documents and Settings\user\Bureau\flash\flash\NAVIGATEUROSCDROM\__MACOSX\NAVIGATEUR OS CDROM\CDROM\fscommand\._Frise.exe
c:\Documents and Settings\user\Bureau\flash\NAVIGATEUROSCDROM\NAVIGATEUR OS CDROM\CDROM\CDRomControleProjection.exe
c:\Documents and Settings\user\Bureau\flash\NAVIGATEUROSCDROM\NAVIGATEUR OS CDROM\CDROM\fscommand\Frise.exe
c:\Documents and Settings\user\Bureau\flash\NAVIGATEUROSCDROM\__MACOSX\NAVIGATEUR OS CDROM\CDROM\._CDRomControleProjection.exe
c:\Documents and Settings\user\Bureau\flash\NAVIGATEUROSCDROM\__MACOSX\NAVIGATEUR OS CDROM\CDROM\fscommand\._Frise.exe
c:\Documents and Settings\user\Bureau\menu\Nouveau dossier\quickmenu5.exe
c:\Documents and Settings\user\Bureau\menu\Nouveau dossier\keygen\keygen.exe
c:\Documents and Settings\user\Bureau\menu\Nouveau dossier\navstudio\Install\InstMsiA.Exe
c:\Documents and Settings\user\Bureau\menu\Nouveau dossier\navstudio\Install\InstMsiW.Exe
c:\Documents and Settings\user\Bureau\menu\Nouveau dossier\navstudio\Install\Setup.Exe
c:\Documents and Settings\user\Bureau\menu\Nouveau dossier\visual_interface\quickmenu5.exe
c:\Documents and Settings\user\Bureau\Nouveau dossier\FlashAmpPro3\FlashAmpPro3\FlashAmp Pro 3.exe
c:\Documents and Settings\user\Bureau\o\bg.exe
c:\Documents and Settings\user\Bureau\o\image-resize.exe
c:\Documents and Settings\user\Bureau\o\SlideshowZillar.exe
c:\Documents and Settings\user\Bureau\o\StyleMaster46.exe
c:\Documents and Settings\user\Bureau\o\asv5\asv5.exe
c:\Documents and Settings\user\Bureau\o\asv5\addons\asvcb.exe
c:\Documents and Settings\user\Bureau\o\asv5\addons\asvfaf.exe
c:\Documents and Settings\user\Bureau\o\asv5\addons\asvmxp.exe
c:\Documents and Settings\user\Bureau\o\asv5\addons\asvpc.exe
c:\Documents and Settings\user\Bureau\o\asv5\addons\asvsol.exe
c:\Documents and Settings\user\Bureau\o\jsFMake2\jsFile.exe
c:\Documents and Settings\user\Bureau\o\Reflet\Reflet.exe
c:\Documents and Settings\user\Bureau\o\Scrutico\Scrutico.exe
c:\Documents and Settings\user\Bureau\o\SDFix\catchme.exe
c:\Documents and Settings\user\Bureau\o\SDFix\dummy.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\cliptext.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\download.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\dummy.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\ERUNT.EXE
c:\Documents and Settings\user\Bureau\o\SDFix\apps\FixPath.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\isadmin.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\LS.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\MD5File.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\Process.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\procs.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\psservice.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\RegDACL.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\regedit.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\RestartIt!.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\sc.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\SF.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\shutdown.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\swreg.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\swsc.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\unzip.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\WINMSG.EXE
c:\Documents and Settings\user\Bureau\o\SDFix\apps\zip.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\Replace\W2K.exe
c:\Documents and Settings\user\Bureau\o\SDFix\apps\Replace\XP.exe
c:\Documents and Settings\user\Bureau\o\SDFix\backups\attrib.exe
c:\Documents and Settings\user\Bureau\o\SDFix\backups\find.exe
c:\Documents and Settings\user\Bureau\o\SDFix\backups\findstr.exe
c:\Documents and Settings\user\Bureau\o\SDFix\backups\regedit.exe
c:\Documents and Settings\user\Bureau\o\Visioimg\Visioimg.exe
c:\Documents and Settings\user\Bureau\optimize\optimize.exe
c:\Documents and Settings\user\Bureau\optimize\php_view.exe
c:\Documents and Settings\user\Bureau\optimize\tidy.exe
c:\Documents and Settings\user\Bureau\RAD WEB\Create Web Site in Dreamweaver  8 by RAD.exe
c:\Documents and Settings\user\Bureau\RAD WEB\Create Web Site in Flash 8 by RAD.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\Copy of BG\CD_Root\autorun.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\Copy of BG\CD_Root\AutoPlay\Docs\WebsitePopularity.sfx.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\Copy of BG\CD_Root\AutoPlay\Docs\websitepopularitysetup.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\dream\CD_Root\autorun.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\dream\CD_Root\AutoPlay\Docs\QuickTimeInstaller.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\flash\CD_Root\autorun.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\autorun.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\amaya-WinXP-9.99-2.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\boite_a_couleurs.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\easyphp1-8_setup.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\FileZilla_2_2_29_setup.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\gimp-mode_gimp_mode_2.2.17_francais_18452.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\gvim71.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\kompozer-077-win32.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\multiple-ie-setup.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\npp.4.6.Installer.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\pspad453inst_en.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\TidyGUI_2.sfx.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\TidyGUIfr.sfx.exe
c:\Documents and Settings\user\Bureau\RAD WEB\AUTOPLAY PROJET\webmaster pack\CD_Root\AutoPlay\Docs\UnFREEgifaniator.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\amaya-WinXP-9.99.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\gimp-2.4.1-i686-setup.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\kompozer-077-win32.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\multiple-ie-setup.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\npp.4.6.Installer.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\npp.4.7.3.Installer.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\nvu-1.0-win32-installer-full.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\pack\Webmaster_package_by_RAD.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\Zoomifyer EZ v3.1\Zoomifyer EZ v3.0.exe
c:\Documents and Settings\user\Bureau\RAD WEB\outilswebmaster\Zoomifyer EZ v3.1\Zoomifyer EZ v3.1\Zoomifyer EZ v3.0.exe
c:\Documents and Settings\user\Bureau\RAD WEB\SOME HELP forum\usb_format.exe
c:\Documents and Settings\user\Bureau\swftools\font2swf.exe
c:\Documents and Settings\user\Bureau\swftools\gif2swf.exe
c:\Documents and Settings\user\Bureau\swftools\jpeg2swf.exe
c:\Documents and Settings\user\Bureau\swftools\pdf2swf.exe
c:\Documents and Settings\user\Bureau\swftools\png2swf.exe
c:\Documents and Settings\user\Bureau\swftools\swfbbox.exe
c:\Documents and Settings\user\Bureau\swftools\swfc.exe
c:\Documents and Settings\user\Bureau\swftools\swfcombine.exe
c:\Documents and Settings\user\Bureau\swftools\swfdump.exe
c:\Documents and Settings\user\Bureau\swftools\swfextract.exe
c:\Documents and Settings\user\Bureau\swftools\swfstrings.exe
c:\Documents and Settings\user\Bureau\swftools\wav2swf.exe
c:\Documents and Settings\user\Bureau\TC\amaya-WinXP-10.0-pre.exe
c:\Documents and Settings\user\Bureau\TC\tidy.exe
c:\Documents and Settings\user\Bureau\TC\Advanced_JPEG_Compressor_v5.1\ajpegcompr.exe
c:\Documents and Settings\user\Bureau\TC\Advanced_JPEG_Compressor_v5.1\Advanced JPEG Compressor v5.0\setup.exe
c:\Documents and Settings\user\Bureau\TC\Advanced_JPEG_Compressor_v5.1\Advanced JPEG Compressor v5.0\Crack\ajc.exe
c:\Documents and Settings\user\Bureau\TC\Advanced_JPEG_Compressor_v5.1\Advanced.JPEG.Compressor.v5.1.Patch-tRUE\Advanced.JPEG.Compressor.v5.1.Patch-tRUE\Patch.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\highlight-setup-2.6.7.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\setup.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\setup_main_suite.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\TexefexSetup.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\AVG Anti-Spyware Plus 7.5.1.43-3339\AVG Anti-Spyware Plus 7.5.1.43-3339\avgas-setup-7.5.1.43-3339.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\AVG Anti-Spyware Plus 7.5.1.43-3339\AVG Anti-Spyware Plus 7.5.1.43-3339\Patch\patch.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\htmlpad8_full\htmlpad8_full.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\IsoBuster_Pro_2.2.0.1_Final\IsoBuster Pro 2.2.0.1 - Final\isobuster_all_lang.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\IsoBuster_Pro_2.2.0.1_Final\IsoBuster Pro 2.2.0.1 - Final\keygen.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\Keygen TuneUp Utilities 2008\TU2008 Keymaker.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\SlideshowZilla_1.11\slideshowzilla_setup.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\SlideshowZilla_1.11\SlideshowZilla 1.11\slideshowzilla_setup.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\SlideshowZilla_1.11\SlideshowZilla 1.11\Crack\Loader.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\Sothink.JavaScript.Web.Scroller.v1.0.71127.Cracked-iNViSiBLE\jwscroller\Setup.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\TexefexSetup.exe\Texefex.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\TexefexSetup.exe\TexefexSetup.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\Yaldex.PopUp\ypu.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\Yaldex.PopUp\CRACK\YaldexPopUp.exe
c:\Documents and Settings\user\Bureau\TC\ARCHIVES\Your Uninstaller Pro 2008 V6.1.1232\Keygen.exe
c:\Documents and Settings\user\Bureau\TC\torrent\Call_Of_Duty_4-Razor19111\Call_Of_Duty_4_Crackfix_And_Keygen-Razor1911 blizz26\iw3sp.exe
c:\Documents and Settings\user\Bureau\TC\torrent\Call_Of_Duty_4-Razor19111\Call_Of_Duty_4_Crackfix_And_Keygen-Razor1911 blizz26\rzr-cod4.exe
c:\Documents and Settings\user\Bureau\TC\Website Popularity v2.0.rar\WebsitePopularity.sfx.exe
c:\Documents and Settings\user\Bureau\TC\Website Popularity v2.0.rar\websitepopularitysetup.exe
c:\Documents and Settings\user\Bureau\TC\Website Popularity v2.0.rar\crack\WebsitePopularity.exe
c:\Documents and Settings\user\Local Settings\Application Data\Adobe\Updater5\Install\devicecentral1\DC.exe
c:\Documents and Settings\user\Local Settings\Application Data\Adobe\Updater5\Install\flash9-en_US\flash9-en_US_9_0_2_Update.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3004\Setup.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3004\redist\WindowsInstaller-KB893803-v2-x86.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3004\redist\WindowsServer2003-KB898715-ia64-enu.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3004\redist\WindowsServer2003-KB898715-x64-enu.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3004\redist\WindowsServer2003-KB898715-x86-enu.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3004\redist\WindowsXP-KB898715-x64-enu.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3152\Setup.exe
c:\Documents and Settings\user\Local Settings\Application Data\Installer3152\redist\Windows

ComboFix 08-02.05.3 - user 2008-02-06 16:08:05.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.599 [GMT 1:00]
Endroit: C:\Documents and Settings\user\Bureau\ComboFix.exe
 * Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\bhtex.dll
C:\WINDOWS\bhtsrc32.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\poof


(((((((((((((((((((((((((((((   Fichiers cr‚‚s 2008-01-06 to 2008-02-06  ))))))))))))))))))))))))))))))))))))
.

2008-02-05 18:59 . 2008-02-05 19:46	<REP>	d--------	C:\Program Files\Flash Website Design
2008-02-05 17:17 . 2008-02-05 17:17	9,561,543	--a------	C:\upload_moi_YOUR-6FBB7B0EF0.tar.gz
2008-02-05 00:26 . 2008-02-05 00:31	<REP>	d--------	C:\Documents and Settings\user\dwhelper
2008-02-04 12:55 . 2008-02-05 09:42	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-02-04 12:55 . 2008-02-04 12:55	1,409	--a------	C:\WINDOWS\QTFont.for
2008-02-03 02:10 . 2008-02-03 02:10	<REP>	d--------	C:\Program Files\eRightSoft
2008-02-03 02:10 . 2007-12-17 14:43	27,648	---hs----	C:\WINDOWS\system32\Smab0.dll
2008-02-02 14:14 . 2008-02-02 14:14	<REP>	d--------	C:\WINDOWS\system32\Kaspersky Lab
2008-01-28 22:38 . 2008-01-28 22:38	<REP>	d--------	C:\Documents and Settings\user\Application Data\HTML Executable
2008-01-28 09:42 . 2008-01-28 09:43	<REP>	d--------	C:\WINDOWS\ERUNT
2008-01-27 16:53 . 2003-02-02 19:06	153,088	--a------	C:\WINDOWS\system32\UNRAR3.dll
2008-01-27 16:53 . 2002-03-06 00:00	75,264	--a------	C:\WINDOWS\system32\unacev2.dll
2008-01-26 14:03 . 2008-01-27 20:46	<REP>	d--------	C:\WINDOWS\BDOSCAN8
2008-01-25 19:52 . 2008-01-25 19:52	<REP>	d--------	C:\Program Files\CCleaner
2008-01-25 14:37 . 2008-01-25 14:37	<REP>	d--------	C:\Program Files\Trend Micro
2008-01-25 09:27 . 2008-01-28 12:19	476	--a------	C:\WINDOWS\system32\FlashAmpPro3.inf
2008-01-18 18:40 . 2008-01-18 18:46	<REP>	d--------	C:\Program Files\RegCure
2008-01-18 17:56 . 2001-08-23 16:25	1,706,800	---------	C:\WINDOWS\system32\gdiplus.dll
2008-01-18 17:56 . 2004-08-19 13:37	950,272	--a------	C:\WINDOWS\system32\ltimg14N.dll
2008-01-18 17:56 . 2005-03-02 19:57	834,048	--a------	C:\WINDOWS\system32\xwpdlx20.ocx
2008-01-18 17:56 . 2004-08-23 17:56	495,616	--a------	C:\WINDOWS\system32\ltkrn14N.dll
2008-01-18 17:56 . 2004-08-12 13:33	299,008	--a------	C:\WINDOWS\system32\LTDIS14N.dll
2008-01-18 17:56 . 2004-08-19 13:37	282,624	--a------	C:\WINDOWS\system32\ltefx14N.dll
2008-01-18 17:56 . 2004-08-19 13:37	167,936	--a------	C:\WINDOWS\system32\ltfil14N.DLL
2008-01-18 16:28 . 2008-01-18 16:28	16	--a------	C:\WINDOWS\system32\dp48x.hlx
2008-01-18 00:35 . 2008-01-18 00:35	<REP>	d--------	C:\Program Files\HTMLPad 2007
2008-01-18 00:35 . 2008-01-18 00:35	<REP>	d--------	C:\Documents and Settings\user\Application Data\Blumentals
2008-01-17 11:00 . 2008-01-17 11:00	<REP>	d--------	C:\Program Files\Safari
2008-01-17 10:59 . 2008-01-17 10:59	<REP>	d--------	C:\Program Files\Apple Software Update
2008-01-17 10:59 . 2008-01-17 10:59	<REP>	d--------	C:\Documents and Settings\All Users\Application Data\Apple
2008-01-15 16:35 . 2008-01-28 13:09	<REP>	d--------	C:\Documents and Settings\user\Application Data\highlight-gui
2008-01-15 16:34 . 2008-01-15 16:35	<REP>	d--------	C:\Program Files\WinHighlight
2008-01-15 16:34 . 2008-01-15 16:34	<REP>	d--h-----	C:\Documents and Settings\user\Application Data\WinHighlight
2008-01-14 17:07 . 2008-01-14 22:26	<REP>	d--------	C:\Program Files\Microsoft SQL Server
2008-01-14 17:07 . 2008-01-14 17:07	<REP>	d--------	C:\Documents and Settings\All Users\Application Data\ExclamationSoft
2008-01-14 17:07 . 1998-10-29 15:45	306,688	--a------	C:\WINDOWS\IsUninst.exe
2008-01-14 17:07 . 2002-12-17 16:23	33,340	---------	C:\WINDOWS\system32\dbmsqlgc.dll
2008-01-14 17:07 . 2002-10-20 14:05	24,576	---------	C:\WINDOWS\system32\dbmsgnet.dll
2008-01-09 16:56 . 1993-07-23 18:31	210,944	--a------	C:\WINDOWS\system32\MSVCRT10.DLL
2008-01-09 16:15 . 2008-01-09 16:15	<REP>	d--------	C:\Documents and Settings\user\Application Data\Aurora Web Editor
2008-01-09 15:01 . 2008-01-09 15:01	53,248	--a------	C:\WINDOWS\bdoscandel.exe
2008-01-09 15:01 . 2008-01-09 15:01	453	--a------	C:\WINDOWS\bdoscandellang.ini
2008-01-09 12:02 . 2008-01-09 12:02	118	--a------	C:\WINDOWS\system32\MRT.INI
2008-01-08 11:02 . 2008-01-08 11:02	<REP>	d--------	C:\Program Files\Micro-Sys Software
2008-01-07 19:40 . 2008-01-09 21:28	<REP>	d--------	C:\Program Files\Submit Suite
2008-01-07 02:17 . 2008-01-07 02:17	<REP>	d--------	C:\Program Files\Spybot - Search & Destroya

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-06 15:15	---------	d---a-w	C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-06 14:51	---------	d-----w	C:\Documents and Settings\user\Application Data\SiteAdvisor
2008-02-06 10:26	---------	d-----w	C:\Documents and Settings\user\Application Data\uTorrent
2008-02-06 10:02	---------	d-----w	C:\Documents and Settings\user\Application Data\DMCache
2008-02-05 20:04	---------	d-----w	C:\Program Files\Java
2008-02-05 00:02	---------	d-----w	C:\Program Files\Advanced JPEG Compressor
2008-02-04 15:11	---------	d-----w	C:\Program Files\TuneUp Utilities 2008
2008-02-03 18:04	---------	d-----w	C:\Program Files\HyperLobbyPro3
2008-02-01 21:46	---------	d-----w	C:\Program Files\Sisulizer 1
2008-01-27 17:28	---------	d-----w	C:\Documents and Settings\user\Application Data\Vso
2008-01-19 23:26	---------	d-----w	C:\Program Files\Notepad++
2008-01-17 13:55	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-17 10:00	---------	d-----w	C:\Documents and Settings\user\Application Data\Apple Computer
2008-01-15 16:21	---------	d-----w	C:\Program Files\Autoplay Media Studio 6.0.5.0
2008-01-15 12:56	---------	d-----w	C:\Program Files\JAlbum
2008-01-14 21:26	---------	d-----w	C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-12 17:39	---------	d-----w	C:\Documents and Settings\user\Application Data\PSpad
2008-01-12 00:10	---------	d-----w	C:\Program Files\DivX
2008-01-07 01:19	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-06 18:43	---------	d-----w	C:\Documents and Settings\user\Application Data\MxBoost
2008-01-05 23:00	---------	d-----w	C:\Program Files\Maguma Open Studio
2008-01-04 16:42	9,344	----a-w	C:\WINDOWS\system32\drivers\NSDriver.sys
2008-01-04 16:42	8,320	----a-w	C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-01-04 15:41	---------	d-----w	C:\Program Files\Windows Media Connect 2
2008-01-04 11:42	---------	d-----w	C:\Documents and Settings\user\Application Data\Notepad++
2007-12-28 01:08	---------	d-----w	C:\Program Files\SourceTec
2007-12-27 00:37	---------	d-----w	C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-12-23 14:16	---------	d-----w	C:\Program Files\Opera
2007-12-15 21:39	---------	d-----w	C:\Program Files\Startup Faster
2007-12-15 21:38	---------	d-----w	C:\Documents and Settings\user\Application Data\URSoft
2007-12-14 16:04	---------	d-----w	C:\Program Files\Microsoft BootVis
2007-12-10 10:55	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2007-12-10 10:42	---------	d-----w	C:\Program Files\Activision
2007-12-08 22:14	---------	d-----w	C:\Program Files\Your Uninstaller 2008
2007-12-02 17:53	98,304	----a-w	C:\WINDOWS\system32CmdLineExt.dll
2007-11-19 12:36	720,896	----a-w	C:\WINDOWS\iun6002ev.exe
2007-11-14 14:16	74,752	----a-w	C:\WINDOWS\ST6UNST.EXE
2007-11-14 14:16	253,952	------w	C:\WINDOWS\Setup1.exe
2007-10-13 22:47	0	----a-w	C:\Program Files\MultiTransefind.ini
2003-03-21 11:45	250,544	----a-w	C:\Program Files\Fichiers communs\keyhelp.ocx
2006-05-03 10:06	163,328	--sh--r	C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47	31,232	--sh--r	C:\WINDOWS\system32\msfDX.dll
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BB81C3DB-2DEA-4AE9-96B3-13E6661FF03B}]
2007-09-23 08:02	389120	--a------	C:\Program Files\Snap Shots\snapbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}
{8CD8EA48-D284-477E-B6DF-85D1E39D855F}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[HKEY_CLASSES_ROOT\clsid\{8cd8ea48-d284-477e-b6df-85d1e39d855f}]
[HKEY_CLASSES_ROOT\Snapbar.SnapShots.1]
[HKEY_CLASSES_ROOT\TypeLib\{F57712B7-CEDB-4C0E-915B-4BB043CEF769}]
[HKEY_CLASSES_ROOT\Snapbar.SnapShots]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{8CD8EA48-D284-477E-B6DF-85D1E39D855F}"= C:\Program Files\Snap Shots\snapbar1.dll [2007-09-23 08:02 389120]

[HKEY_CLASSES_ROOT\clsid\{8cd8ea48-d284-477e-b6df-85d1e39d855f}]
[HKEY_CLASSES_ROOT\Snapbar.SnapShots.1]
[HKEY_CLASSES_ROOT\TypeLib\{F57712B7-CEDB-4C0E-915B-4BB043CEF769}]
[HKEY_CLASSES_ROOT\Snapbar.SnapShots]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartupFaster"="C:\Program Files\Startup Faster\startuploader.exe" [2007-12-07 21:19 1631456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-03-13 12:11 233472]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"nwiz"=nwiz.exe /installquiet /keeploaded /nodetect
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-10 13:00]
R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 09:45]
S3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-09-29 12:46]
S3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 13:47]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-04 16:11]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-17 09:59:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-01 16:17:57 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-02-06 15:14:46 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-18 17:40:24 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-06 16:15:19
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs 
Les fichiers cach‚s: 0 

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Startup Faster\sfAgent.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-06 16:20:21 - machine was rebooted
ComboFix-quarantined-files.txt  2008-02-06 15:20:18
.
2008-01-09 11:02:31	--- E O F ---  

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-02-06 16:41:08
PROTECTIONS: 1
MALWARE: 31
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
avast! antivirus 4.7.1098 [VPS 080205-0]     4.7.1098                      No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00000431  adware/ist.istbar                  Adware              No        1         Yes            No           hkey_current_user\software\microsoft\errlook
00133411  adware/toolbarsimbar               Adware              No        0         Yes            No           HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{a26abcf0-1c8f-46e7-a67c-0489dc21b9cc}
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.doubleclick.net/]
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@doubleclick[1].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.atdmt.com/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@atdmt[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.tradedoubler.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.mediaplex.com/]
00145869  Cookie/SpyLog                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.spylog.com/]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.com.com/]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@com[1].txt
00167647  Cookie/Yadro                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.yadro.ru/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.xiti.com/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@xiti[2].txt
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@fe.lea.lycos[2].txt
00167724  Cookie/HotLog                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.hotlog.ru/]
00167747  Cookie/Azjmp                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.azjmp.com/]
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.toplist.cz/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@statcounter[2].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.statcounter.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[ad.yieldmanager.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.bs.serving-sys.com/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@weborama[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.weborama.fr/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@adtech[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.adtech.de/]
00168114  Cookie/onestat.com                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[stat.onestat.com/]
00168114  Cookie/onestat.com                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[stat.onestat.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@fl01.ct2.comclick[2].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[fl01.ct2.comclick.com/]
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@media.adrevolver[3].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.overture.com/]
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.overture.com/]
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@overture[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.zedo.com/]
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.zedo.com/]
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.bluestreak.com/]
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Cookies\user@adrevolver[1].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.adrevolver.com/]
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.adultfriendfinder.com/]
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.adultfriendfinder.com/]
00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.atwola.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\0z0qos5s.default\cookies.txt[.smartadserver.com/]
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS\Nircmd.exe
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

File C:\Documents and Settings\user\Application Data\SecuROM\UserData\???????????p?????????infected by "BkCln.Unknown"Virus. Action Taken: File Renamed.
File C:\Documents and Settings\user\Application Data\SecuROM\UserData\???????????p?????????infected by "BkCln.Unknown"Virus. Action Taken: File Renamed.

 07/02/2008 ---- 12:36:00,73  

----------------------------------
§§§§§§ [SysTraymon] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_USERS\S-1-5-21-2866812634-333601086-4030790872-1005\Software\ASProtect]
"SystemTray Monitor"="SysTraymon.exe"

"snap_shots_ie[1]"="C:\\Documents and Settings\\user\\Local Settings\\Temporary Internet Files\\Content.IE5\\N0IKLY07\\snap_shots_ie[1].exe"
"SysTraymon"="C:\\WINDOWS\\system32\\SysTraymon.exe"

[HKEY_USERS\S-1-5-21-2866812634-333601086-4030790872-1005\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="SysTraymon.exe"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------