Ordi infecté par Win32:Agent-BSU[Trojan]

Merci je m'y met tout de suite et je t'envoies ça!

Voila j'ai fait tout ce que tu m'as suggéré.

Un détail cependant, le scan avec MalwareByte's Anti-Malware a été fait en mode sans échec comme conseillé dans le tutoriel. J'espère que ça ne posera pas de pb!

Je commence à avoir des sueurs froides: plus je fais des scans, plus ya des virus! Pitié fais en sorte que ça s'arrête!!!!!

Un grand merci pour tout ce que tu fais.

--------------------------------------------------------------------------------------------------------------------

[b]SDFix: Version 1.167 [/b]
Run by Nicolas on 08/04/2008 at 15:13

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\348006~1 - Deleted
C:\WINDOWS\b155.exe - Deleted
C:\WINDOWS\kiasys.dll - Deleted
C:\WINDOWS\yeTyezzd.sys - Deleted



Folder C:\Program Files\Temporary - Removed


Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-08 15:17:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:8d2e78b2
"s1"=dword:00e80e43
"s2"=dword:0c332b91
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:3c,35,a9,50,dd,93,d1,b3,ef,44,48,71,05,e0,96,ff,99,d4,27,26,11,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:3c,35,a9,50,dd,93,d1,b3,ef,44,48,71,05,e0,96,ff,99,d4,27,26,11,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"D:\\Quake III Arena\\quake3.exe"="D:\\Quake III Arena\\quake3.exe:*:Enabled:quake3"
"C:\\Program Files\\MSN Gaming Zone\\Windows\\chkrzm.exe"="C:\\Program Files\\MSN Gaming Zone\\Windows\\chkrzm.exe:*:Enabled:Jeu de dames sur Internet"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"C:\\Program Files\\OneClick\\OneClick.exe"="C:\\Program Files\\OneClick\\OneClick.exe:*:Disabled:OneClick"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Disabled:Windows Messenger"
"D:\\Quake 4\\Quake4.exe"="D:\\Quake 4\\Quake4.exe:*:Enabled:Quake 4"
"C:\\Program Files\\Fichiers communs\\AOL\\1142969704\\ee\\aolsoftware.exe"="C:\\Program Files\\Fichiers communs\\AOL\\1142969704\\ee\\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\PRONOTE 2007\\PRONOTE client.exe"="C:\\PRONOTE 2007\\PRONOTE client.exe:*:Enabled:PRONOTE client"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Mozilla Firefox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 10 May 2004 54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Mon 10 May 2004 156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Mon 10 May 2004 31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Mon 19 Dec 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 27 Nov 2007 245,248 ...H. --- "C:\Documents and Settings\Nicolas\Bureau\~WRL0573.tmp"
Sat 20 Oct 2007 31,744 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL0140.tmp"
Thu 22 Feb 2007 19,456 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL0156.tmp"
Thu 22 Feb 2007 20,480 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL0165.tmp"
Sat 20 Oct 2007 44,032 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL0258.tmp"
Sat 20 Oct 2007 41,984 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL0343.tmp"
Thu 22 Feb 2007 29,184 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL0370.tmp"
Sat 20 Oct 2007 40,448 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL1350.tmp"
Sat 20 Oct 2007 40,448 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL1887.tmp"
Thu 22 Feb 2007 25,088 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL1926.tmp"
Sun 3 Feb 2008 103,936 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL1990.tmp"
Sun 18 Mar 2007 69,632 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL2427.tmp"
Sat 20 Oct 2007 36,864 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL2619.tmp"
Sun 18 Mar 2007 67,072 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL2724.tmp"
Sun 18 Mar 2007 76,288 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL2842.tmp"
Sun 3 Feb 2008 100,864 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL3023.tmp"
Sat 20 Oct 2007 41,472 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL3351.tmp"
Sun 18 Mar 2007 76,288 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL3985.tmp"
Sat 20 Oct 2007 44,544 ...H. --- "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Word\~WRL4072.tmp"
Mon 19 Dec 2005 4,348 ...H. --- "C:\Documents and Settings\Nicolas\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Wed 1 Feb 2006 20 A..H. --- "C:\Documents and Settings\Nicolas\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Mon 19 Dec 2005 400 ...H. --- "C:\Documents and Settings\Nicolas\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Wed 1 Feb 2006 1,536 A..H. --- "C:\Documents and Settings\Nicolas\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"
Sun 18 Dec 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"

[b]Finished![/b]



------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.11
Version de la base de données: 599

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 91808
Temps écoulé: 18 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\CPV (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videoPl.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\CPV (Trojan.Downloader) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\CPV\CPV7.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0089171.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0089178.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tcpip_patcher.sys (Trojan.Proxy) -> Quarantined and deleted successfully.


----------------------------------------------------------------------------------------------------------------------


BitDefender Online Scanner


Rapport d'analyse généré à: Tue, Apr 08, 2008 - 16:24:45


Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;H:\;


Statistiques

Temps 00:28:18

Fichiers 86732

Directoires 5172

Secteurs de boot 5

Archives 1609

Paquets programmes 10342



Résultats

Virus identifiés 6

Fichiers infectés 11

Fichiers suspects 0

Avertissements 0

Désinfectés 0

Fichiers effacés 11




Info sur les moteurs

Définition virus 1132035

Version des moteurs AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins 16

Archive des plugins 41

Unpack des plugins 7

E-mail plugins 6

Système plugins 5




Paramètres d'analyse

Première action Désinfecté

Seconde Action Supprimé

Heuristique Oui

Acceptez les avertissements Oui

Extensions analysées

exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions


Analyse d'emails Oui

Analyse des Archives Oui

Analyser paquets programmes Oui

Analyse des fichiers Oui

Analyse de boot Oui





Fichier analysé


Statut

C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\411RC30S\lstest[1].exe

Infecté par: Trojan.Delf.Inject.F


C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\411RC30S\lstest[1].exe


Echec de la désinfection

C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\411RC30S\lstest[1].exe


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP382\A0065840.exe


Infecté par: Trojan.Downloader.Zlob.ABMI

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP382\A0065840.exe


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0000


Infecté par: Trojan.Downloader.Zlob.ABPV

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0000


Echec de la désinfection

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0000


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)


Echec de la mise à jour

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0006


Infecté par: Trojan.Downloader.Zlob.ABMT

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0006


Echec de la désinfection

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0006


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)


Echec de la mise à jour

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0008=>(NSIS g)=>lzma_nsis0000


Infecté par: Trojan.Downloader.Zlob.ABMT

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0008=>(NSIS g)=>lzma_nsis0000


Echec de la désinfection

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0008=>(NSIS g)=>lzma_nsis0000


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP383\A0066016.exe=>(NSIS o)=>lzma_nsis0008=>(NSIS g)


Echec de la mise à jour

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP411\A0086056.exe


Infecté par: Packer.Malware.Crypter.C

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP411\A0086056.exe


Echec de la désinfection

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP411\A0086056.exe


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0087170.exe


Infecté par: Packer.Malware.Crypter.C

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0087170.exe


Echec de la désinfection

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0087170.exe


Supprimé

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0089224.dll


Infecté par: Trojan.BHO.OAE

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP414\A0089224.dll


Supprimé

C:\WINDOWS\system32\aliceeadsl.exe


Infecté par: Packer.Malware.Crypter.C

C:\WINDOWS\system32\aliceeadsl.exe


Echec de la désinfection

C:\WINDOWS\system32\aliceeadsl.exe


Supprimé

C:\WINDOWS\system32\MicroSecure.exe


Infecté par: Trojan.Delf.Inject.F

C:\WINDOWS\system32\MicroSecure.exe


Echec de la désinfection

C:\WINDOWS\system32\MicroSecure.exe


Supprimé

C:\WINDOWS\system32\NTSecurity.exe


Infecté par: Trojan.Delf.Inject.F

C:\WINDOWS\system32\NTSecurity.exe


Echec de la désinfection

C:\WINDOWS\system32\NTSecurity.exe


Supprimé

Vraiment merci.
Je me lance tout de suite.

Voila tous les rapports. Il me semble qu'il ne reste pas grand chose à part cet aliceeadsl.exe!!!

ComboFix 08-04-07.5 - Nicolas 2008-04-08 17:01:02.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.129 [GMT 2:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\Combo-Fix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-08 to 2008-04-08 ))))))))))))))))))))))))))))))))))))
.

2008-04-08 15:53 . 2008-04-08 15:53 <REP> d-------- C:\WINDOWS\LastGood
2008-04-08 15:53 . 2008-04-08 16:25 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Malwarebytes
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-08 15:12 . 2008-04-08 15:12 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-08 15:06 . 2008-04-08 15:19 <REP> d-------- C:\SDFix
2008-04-08 11:33 . 2008-04-08 11:33 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Grisoft
2008-04-08 11:32 . 2008-04-08 11:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-08 11:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-08 10:42 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-08 10:42 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\118294.78
2008-04-08 10:42 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-06 22:59 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-06 22:59 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-06 22:59 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-06 22:59 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-06 22:59 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-06 22:59 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-06 22:59 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-06 22:59 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-06 22:59 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-06 22:59 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-03 15:44 . 2008-04-08 16:12 56,320 --a------ C:\WINDOWS\system32\aliceeadsl.exe
2008-04-02 19:00 . 2008-04-02 18:59 361,984 --a------ C:\WINDOWS\system32\spolsv.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-08 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-04-08 08:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-07 21:58 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Skype
2008-04-07 21:53 --------- d-----w C:\Program Files\DivX
2008-04-06 21:24 --------- d-----w C:\Program Files\Notepad++
2008-04-06 21:24 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Notepad++
2008-04-06 15:42 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-28 15:51 --------- d-----w C:\Program Files\Ludiclub
2008-03-07 12:25 --------- d-----w C:\Program Files\AOL 9.0
2008-03-05 18:36 --------- d-----w C:\Program Files\Java
2008-03-02 16:31 --------- d-----w C:\Program Files\eMule
2008-03-02 16:26 37,888 ----a-w C:\WINDOWS\system32\rar.exe
2008-02-29 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-02-29 01:07 3,520 ----a-w C:\WINDOWS\system32\tmp.reg
2008-02-28 23:25 --------- d-----w C:\Program Files\Trend Micro
2008-02-28 10:37 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-13 18:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-08 09:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2006-05-28 16:33 26,140 ----a-w C:\Documents and Settings\Nicolas\TB2Categories000.dat
2005-12-13 14:49 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
1992-01-28 13:04 475,136 ----a-w C:\Program Files\Berlitz.EXE
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-25 21:54 23090984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"aliceeadsl"="C:\WINDOWS\system32\aliceeadsl.exe" [2008-04-08 16:12 56320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22 7618560]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2007-06-21 12:01 70952]
"HostManager"="C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe" [2006-09-26 02:52 50736]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-05-18 03:15 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-05-17 04:37 69632]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 C:\WINDOWS\system32\nvmctray.dll]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-06-28 18:27 181488]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-23 18:12 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*aliceeadsl"="C:\WINDOWS\system32\aliceeadsl.exe" [2008-04-08 16:12 56320]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"aliceeadsl"="C:\WINDOWS\system32\aliceeadsl.exe" [2008-04-08 16:12 56320]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2005-12-13 16:57:44 156784]
HPAiODevice(hp psc 700 series) - 1.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe [2002-04-30 18:26:44 491580]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-08-31 16:35:40 67128]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 22:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2008-03-29 19:37 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
--a------ 2007-10-25 17:33 563984 C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-06-01 11:22 1519616 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-10-23 18:12 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regscan]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2005-04-15 05:01 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"D:\\Quake III Arena\\quake3.exe"=
"C:\\Program Files\\MSN Gaming Zone\\Windows\\chkrzm.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Quake 4\\Quake4.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\1142969704\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\PRONOTE 2007\\PRONOTE client.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:*:Disabled:@xpsp2res.dll,-22004
"19491:TCP"= 19491:TCP:PORT_19491
"9485:TCP"= 9485:TCP:PORT_9485
"39993:TCP"= 39993:TCP:PORT_39993
"43555:TCP"= 43555:TCP:PORT_43555
"31867:TCP"= 31867:TCP:PORT_31867
"5473:TCP"= 5473:TCP:PORT_5473
"51508:TCP"= 51508:TCP:PORT_51508
"58461:TCP"= 58461:TCP:PORT_58461
"11320:TCP"= 11320:TCP:PORT_11320
"61410:TCP"= 61410:TCP:PORT_61410
"13880:TCP"= 13880:TCP:PORT_13880
"14707:TCP"= 14707:TCP:PORT_14707
"21195:TCP"= 21195:TCP:PORT_21195
"27398:TCP"= 27398:TCP:PORT_27398
"30298:TCP"= 30298:TCP:PORT_30298
"65348:TCP"= 65348:TCP:PORT_65348
"5782:TCP"= 5782:TCP:PORT_5782
"35426:TCP"= 35426:TCP:PORT_35426
"51656:TCP"= 51656:TCP:PORT_51656
"43458:TCP"= 43458:TCP:PORT_43458
"31242:TCP"= 31242:TCP:PORT_31242
"15973:TCP"= 15973:TCP:PORT_15973
"51365:TCP"= 51365:TCP:PORT_51365
"64346:TCP"= 64346:TCP:PORT_64346
"35535:TCP"= 35535:TCP:PORT_35535
"13128:TCP"= 13128:TCP:PORT_13128
"46681:TCP"= 46681:TCP:PORT_46681
"30329:TCP"= 30329:TCP:PORT_30329
"50617:TCP"= 50617:TCP:PORT_50617
"26425:TCP"= 26425:TCP:PORT_26425
"38423:TCP"= 38423:TCP:PORT_38423
"63186:TCP"= 63186:TCP:PORT_63186
"46461:TCP"= 46461:TCP:PORT_46461
"14547:TCP"= 14547:TCP:PORT_14547
"27298:TCP"= 27298:TCP:PORT_27298
"37270:TCP"= 37270:TCP:PORT_37270
"18105:TCP"= 18105:TCP:PORT_18105
"16836:TCP"= 16836:TCP:PORT_16836
"48950:TCP"= 48950:TCP:PORT_48950
"44871:TCP"= 44871:TCP:PORT_44871
"53113:TCP"= 53113:TCP:PORT_53113
"23896:TCP"= 23896:TCP:PORT_23896
"59289:TCP"= 59289:TCP:PORT_59289
"35555:TCP"= 35555:TCP:PORT_35555
"26391:TCP"= 26391:TCP:PORT_26391
"52430:TCP"= 52430:TCP:PORT_52430
"10410:TCP"= 10410:TCP:PORT_10410
"8368:TCP"= 8368:TCP:PORT_8368
"20469:TCP"= 20469:TCP:PORT_20469
"20376:TCP"= 20376:TCP:PORT_20376
"7040:TCP"= 7040:TCP:PORT_7040
"26421:TCP"= 26421:TCP:PORT_26421
"13369:TCP"= 13369:TCP:PORT_13369
"50244:TCP"= 50244:TCP:PORT_50244
"52358:TCP"= 52358:TCP:PORT_52358
"50975:TCP"= 50975:TCP:PORT_50975
"46942:TCP"= 46942:TCP:PORT_46942
"26301:TCP"= 26301:TCP:PORT_26301
"19851:TCP"= 19851:TCP:PORT_19851
"20820:TCP"= 20820:TCP:PORT_20820
"25270:TCP"= 25270:TCP:PORT_25270
"48707:TCP"= 48707:TCP:PORT_48707
"33984:TCP"= 33984:TCP:PORT_33984
"6325:TCP"= 6325:TCP:PORT_6325
"32207:TCP"= 32207:TCP:PORT_32207
"36410:TCP"= 36410:TCP:PORT_36410
"53338:TCP"= 53338:TCP:@xpsp2res.dll,-22005
"44985:TCP"= 44985:TCP:@xpsp2res.dll,-22005
"23932:TCP"= 23932:TCP:@xpsp2res.dll,-22005
"58011:TCP"= 58011:TCP:@xpsp2res.dll,-22005

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 NBXG7031;NB 802.11g XG703 SP1 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2004-09-17 11:56]
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys []
S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-05-12 16:24]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c4152c2-4277-11da-9e2d-806d6172696f}]
\Shell\AutoRun\command - G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eafbbfe-af28-11dc-81ca-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3324cd33-df18-11dc-8208-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84d049a7-c51d-11dc-81dd-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5c8f250-3b2b-11db-8018-0013d3396ad7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B4B4C8D3-87AC-3E5A-738A-C154F40D8901}]
C:\WINDOWS\system32\aliceeadsl.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-08 17:02:51
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-08 17:03:24
ComboFix-quarantined-files.txt 2008-04-08 15:03:20
Pre-Run: 14,019,473,408 octets libres
Post-Run: 14,008,725,504 octets libres
.
2008-03-13 19:57:13 --- E O F ---




---------------------------------------------------------------------------------------------------------------------------



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:19:20, on 08/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\fichiers communs\aol\1142969704\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1142969704\ee\aolsoftware.exe
C:\WINDOWS\system32\hpoipm07.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [*aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe
O4 - HKUS\S-1-5-18\..\Run: [aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe (User 'Default user')
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &eBay Search - res://E:\Programmes Nicolas\barre outil ebay\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} - http://www.1-click.com/common/files/installer-hidden-test.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/fr/check/qdiagh.cab?326
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: h @  - h @  (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Vraiment un énorme merci pour ton aide, ta patience et ta disponibilité. Tu m'as sorti une énorme épine du pied.
Mon ordi se porte beaucoup mieux meme s'il reste ce fameux virus qui, d'après ce que j'ai pu voir sur les forums, est tenace.

MERCI JLPJLP

Bonjour

Grosse panique a bord! Avast me détecte un cheval de troie toute les 10 s!!!!
C'est insupportable!
Et ce depuis que j'ai supprimé les fichiers aliceeadsl avec hijackthis.
Que faire?
Je joins le dernier rapport Bitdefender.

MERCI



BitDefender Online Scanner







Rapport d'analyse généré à: Wed, Apr 09, 2008 - 16:40:19









Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;H:\;















Statistiques

Temps


00:27:59

Fichiers


80551

Directoires


4793

Secteurs de boot


5

Archives


1543

Paquets programmes


10210







Résultats

Virus identifiés


1

Fichiers infectés


2

Fichiers suspects


0

Avertissements


0

Désinfectés


0

Fichiers effacés


2







Info sur les moteurs

Définition virus


1132739

Version des moteurs


AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins


16

Archive des plugins


41

Unpack des plugins


7

E-mail plugins


6

Système plugins


5







Paramètres d'analyse

Première action


Désinfecté

Seconde Action


Supprimé

Heuristique


Oui

Acceptez les avertissements


Oui

Extensions analysées


exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions




Analyse d'emails


Oui

Analyse des Archives


Oui

Analyser paquets programmes


Oui

Analyse des fichiers


Oui

Analyse de boot


Oui








Fichier analysé


Statut

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP417\A0089325.exe


Infecté par: Packer.Malware.Crypter.C

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP417\A0089325.exe


Echec de la désinfection

C:\System Volume Information\_restore{1609C2F3-A122-443D-A28F-F4E4600BFFAF}\RP417\A0089325.exe


Supprimé

C:\WINDOWS\system32\aliceeadsl.exe


Infecté par: Packer.Malware.Crypter.C

C:\WINDOWS\system32\aliceeadsl.exe


Echec de la désinfection

C:\WINDOWS\system32\aliceeadsl.exe


Supprimé

C'est ce que j'ai fait tout à l'heure j'ai réussit à supprimer les trois fichiers contenant aliceeadsl en 2 coups en les fixant avec HIjackthis.
J'ai ensuite lancé un Bitdefender pour voir s'il restait quelquechose ( voir le rapport posté précedemment) et c'est a ce moment la que j'ai eu des messages de avast m'indiquant que le fichier C:\WINDOWS\system32\aliceeadsl.exe
contient le virus Win32:Rootkit-gen [Rtk]. Je le met donc en quarantaine mais il réapparait 10 s après ( exactement le même au même endroit!). Et ceci se reproduit à chaque fois que je mets en quarantaine!

Je ne suis pas chez alice pour l'adsl!

J'essaie de refaire un fix sur les fichiers que tu m'as indiqués.

En fait, je n'ai que 2 fichiers contenant aliceadsl dans log HIjackthis que je n'arrive pas a supprimer
c'est:
O4 - HKLM\..\RunOnce: [*aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe
O4 - HKCU\..\Run: [aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe

En fait ils disparaissent après 2 ou trois fix mais sont toujours la quand je relance un HIjackthis.

Autre fait troublant (pour moi du moins qui n'y connais pas grand chose), dans la rubrique "fichiers importants de la zone de quarantaine" de avast apparaissent 3 fichiers que j'avais pourtant supprimés hier, tous localisés dans C:\WINDOWS\system32\. voici leur nom:

kernell32.dll

winsock.dll

wsock32.dll

Peut être cela a-til un lien avec mes pb?

Non je ne suis pas chez Alice.

Fichier kernel32.dll reçu le 2008.03.27 15:29:35 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.3.26.0 2008.03.27 -
AntiVir 7.6.0.75 2008.03.27 -
Authentium 4.93.8 2008.03.27 -
Avast 4.7.1098.0 2008.03.26 -
AVG 7.5.0.516 2008.03.27 -
BitDefender 7.2 2008.03.27 -
CAT-QuickHeal 9.50 2008.03.26 -
ClamAV 0.92.1 2008.03.27 -
DrWeb 4.44.0.09170 2008.03.27 -
eSafe 7.0.15.0 2008.03.18 -
eTrust-Vet 31.3.5648 2008.03.27 -
Ewido 4.0 2008.03.27 -
F-Prot 4.4.2.54 2008.03.27 -
F-Secure 6.70.13260.0 2008.03.27 -
FileAdvisor 1 2008.03.27 -
Fortinet 3.14.0.0 2008.03.27 -
Ikarus T3.1.1.20 2008.03.27 -
Kaspersky 7.0.0.125 2008.03.27 -
McAfee 5260 2008.03.26 -
Microsoft 1.3301 2008.03.27 -
NOD32v2 2978 2008.03.27 -
Norman 5.80.02 2008.03.26 -
Panda 9.0.0.4 2008.03.26 -
Prevx1 V2 2008.03.27 -
Rising 20.37.32.00 2008.03.27 -
Sophos 4.27.0 2008.03.27 -
Sunbelt 3.0.978.0 2008.03.18 -
Symantec 10 2008.03.27 -
TheHacker 6.2.92.256 2008.03.27 -
VBA32 3.12.6.3 2008.03.25 -
VirusBuster 4.3.26:9 2008.03.26 -
Webwasher-Gateway 6.6.2 2008.03.27 -

Information additionnelle
File size: 1049600 bytes
MD5: 6f1fe2ae7b22eb9ced1bff533c9455ea
SHA1: f9e2797d2e140f4ef679f36eba2e1709a6c09b84
PEiD: -


**************************************************************

Fichier winsock.dll reçu le 2008.04.03 20:27:53 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.4.3.3 2008.04.03 -
AntiVir 7.6.0.80 2008.04.03 -
Authentium 4.93.8 2008.04.03 -
Avast 4.7.1098.0 2008.04.02 -
AVG 7.5.0.516 2008.04.03 -
BitDefender 7.2 2008.04.03 -
CAT-QuickHeal 9.50 2008.04.02 -
ClamAV 0.92.1 2008.04.03 -
DrWeb 4.44.0.09170 2008.04.03 -
eSafe 7.0.15.0 2008.04.01 -
eTrust-Vet 31.3.5667 2008.04.03 -
Ewido 4.0 2008.04.03 -
F-Prot 4.4.2.54 2008.04.03 -
F-Secure 6.70.13260.0 2008.04.03 -
FileAdvisor 1 2008.04.03 -
Fortinet 3.14.0.0 2008.04.03 -
Ikarus T3.1.1.20 2008.04.03 -
Kaspersky 7.0.0.125 2008.04.03 -
McAfee 5266 2008.04.03 -
Microsoft 1.3408 2008.04.03 -
NOD32v2 2999 2008.04.03 -
Norman 5.80.02 2008.04.03 -
Panda 9.0.0.4 2008.04.03 -
Prevx1 V2 2008.04.03 -
Rising 20.38.60.00 2008.04.03 -
Sophos 4.28.0 2008.04.03 -
Sunbelt 3.0.978.0 2008.03.18 -
Symantec 10 2008.04.03 -
TheHacker 6.2.92.263 2008.04.03 -
VBA32 3.12.6.3 2008.03.25 -
VirusBuster 4.3.26:9 2008.04.03 -
Webwasher-Gateway 6.6.2 2008.04.03 -

Information additionnelle
File size: 2864 bytes
MD5: 68485c5ef0e2efcebf21bbb1042b823b
SHA1: e144b904302cccf4db0cccfe5be7b00533ffb7d7
PEiD: -


*********************************************************

wsock32.dll

F-Prot;4.4.2.54;2008.04.08;-
F-Secure;6.70.13260.0;2008.04.09;-
FileAdvisor;1;2008.04.09;-
Fortinet;3.14.0.0;2008.04.09;-
Ikarus;T3.1.1.26;2008.04.09;-
Kaspersky;7.0.0.125;2008.04.09;-
McAfee;5270;2008.04.09;-
Microsoft;1.3408;2008.04.09;-
NOD32v2;3014;2008.04.09;-
Norman;5.80.02;2008.04.09;-
Panda;9.0.0.4;2008.04.08;-
Prevx1;V2;2008.04.09;-
Rising;20.39.12.00;2008.04.08;-
Sophos;4.28.0;2008.04.09;-
Sunbelt;3.0.1032.0;2008.04.08;-
Symantec;10;2008.04.09;-
TheHacker;6.2.92.269;2008.04.09;-
VBA32;3.12.6.4;2008.04.06;-
VirusBuster;4.3.26:9;2008.04.09;-
Webwasher-Gateway;6.6.2;2008.04.09;-

Information additionnelle
File size: 25088 bytes
MD5...: 2f267f8eb4d4014af223d62d94920aba
SHA1..: 224b5dac0c62a9e30064692d09962c6e3070f02d
SHA256: 6d53860776ad3afe17a2276807dc20023393e61cc9e1b39e18ecb8bdc5919897
SHA512: 5daa227c24136ae898fd3fff0e15f662f31d714f9451cb223b80a6a10eb86f28<BR>972cfe15c4fa437c1f909226ea1d0e50480c1053180b9d92b776573b2fd9751d
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.:

***************************************************

Pour aliceeadsl ça ne veut pas démarrer et ça m'affiche:

0 bytes size received / Se ha recibido un archivo vacio

CCM - Charte d'utilisation de CommentCaMarche.net J'ai même essayé après avoir affiché les dossiers cachés mais rien à faire pour tester aliceeadsl.

En revanche il existe déjà une discussion sur ce pb:

http://www.commentcamarche.net/forum/affich 5781356 aliceeadsl exe virus

Il semble que Kaspersky et SpyBot neutralise le virus concerné. Cependant un autre pb va se poser:
Quand je désinstalle avast, ce que j'ai voulu faire récemment pour le remplacer par antivir, mon ordinateur ne veut plus démarrer en mode normal. et après ré&installation de avast en mode sans échec, plus de pb!

J'ai vraiment de gros problèmes avec mon ordi!!!

Merci jlpjlp

Je ne pourrais me lancer dans ces manips que demain dans l'après midi.
Je te souhaite une excellente soirée.

A demain j'espère.

Bonjour jlpjlp,

aswSP non infecté
aswFsBlk non infecté

J'ai lancé RavAntivirus avec clé USB: ordi sain.

Je fais la suite ( combofix) donc je ferme tout. Je te redonne des nouvelles dès que c'est fini.

Voila tout est fait mais j'ai l'impression qu'il reste encore un fichier (sur 2 au départ) aliceeadsl.
J'ai fait 2 fois la manip de création de CFscript et le passage dans ComboFix:
La première en écrivant tout à la main, j'ai suivi bêtement tes instructions ( fermer toutes les applications avant de créer le document texte) mais j'avais un doute sur un espace présent ou pas dans le texte.
La seconde en faisant un copier coller à partir de ce que tu m'as envoyé (applications non fermées pendant la création du document texte)

Voici dans l'ordre de création les deux rapports puis le rapport Hijackthis.

A LA MAIN:
ComboFix 08-04-09.9 - Nicolas 2008-04-10 15:54:47.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.168 [GMT 2:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nicolas\Bureau\CFscript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color

FILE ::
C:\WINDOWS\system32\aliceeadsl.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))))))))
.

2008-04-09 18:00 . 2008-04-09 18:02 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-08 15:53 . 2008-04-09 16:12 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Malwarebytes
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-08 15:12 . 2008-04-08 15:12 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-08 15:06 . 2008-04-08 15:19 <REP> d-------- C:\SDFix
2008-04-08 11:33 . 2008-04-08 11:33 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Grisoft
2008-04-08 11:32 . 2008-04-08 11:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-08 11:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-08 10:42 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-08 10:42 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\118294.78
2008-04-08 10:42 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-06 22:59 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-06 22:59 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-06 22:59 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-06 22:59 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-06 22:59 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-06 22:59 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-06 22:59 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-06 22:59 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-06 22:59 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-06 22:59 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-02 19:00 . 2008-04-02 18:59 361,984 --a------ C:\WINDOWS\system32\spolsv.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 17:31 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Skype
2008-04-08 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-04-08 08:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-07 21:53 --------- d-----w C:\Program Files\DivX
2008-04-06 21:24 --------- d-----w C:\Program Files\Notepad++
2008-04-06 21:24 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Notepad++
2008-04-06 15:42 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-28 15:51 --------- d-----w C:\Program Files\Ludiclub
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-07 12:25 --------- d-----w C:\Program Files\AOL 9.0
2008-03-05 18:36 --------- d-----w C:\Program Files\Java
2008-03-02 16:31 --------- d-----w C:\Program Files\eMule
2008-03-02 16:26 37,888 ----a-w C:\WINDOWS\system32\rar.exe
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-02-28 23:25 --------- d-----w C:\Program Files\Trend Micro
2008-02-28 10:37 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-13 18:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-08 09:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2006-05-28 16:33 26,140 ----a-w C:\Documents and Settings\Nicolas\TB2Categories000.dat
2005-12-13 14:49 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
1992-01-28 13:04 475,136 ----a-w C:\Program Files\Berlitz.EXE
.

((((((((((((((((((((((((((((( snapshot@2008-04-08_17.03.07,45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-07 02:08:32 124,928 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\advpack.dll
+ 2007-12-19 22:53:23 347,136 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtmsft.dll
+ 2007-12-07 02:08:32 214,528 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtrans.dll
+ 2007-12-07 02:08:32 133,120 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\extmgr.dll
+ 2007-12-07 02:08:32 63,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\icardie.dll
+ 2007-12-06 11:02:31 70,656 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ie4uinit.exe
+ 2007-12-07 02:08:32 153,088 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakeng.dll
+ 2007-12-07 02:08:32 230,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieaksie.dll
+ 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakui.dll
+ 2007-12-07 02:08:32 383,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieapfltr.dll
+ 2007-12-07 02:08:32 384,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iedkcs32.dll
+ 2007-12-07 02:08:33 6,066,176 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieframe.dll
+ 2007-12-07 02:08:33 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iernonce.dll
+ 2007-12-07 02:08:33 267,776 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iertutil.dll
+ 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieudinit.exe
+ 2007-12-06 11:03:16 625,664 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
+ 2007-12-07 02:08:33 27,648 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\jsproxy.dll
+ 2007-12-07 02:08:33 459,264 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeeds.dll
+ 2007-12-07 02:08:33 52,224 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeedsbs.dll
+ 2007-12-08 09:38:36 3,592,192 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll
+ 2007-12-07 02:08:34 478,208 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll
+ 2007-12-07 02:08:34 193,024 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll
+ 2007-12-07 02:08:34 671,232 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mstime.dll
+ 2007-12-07 02:08:34 102,912 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll
+ 2008-01-11 05:36:55 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\updspapi.dll
+ 2007-12-07 02:08:34 105,984 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\url.dll
+ 2007-12-07 02:08:34 1,159,680 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\urlmon.dll
+ 2007-12-07 02:08:34 233,472 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll
+ 2007-12-07 02:08:34 824,832 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
+ 2008-04-10 13:56:18 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
- 2007-12-07 02:08:32 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-03-01 12:58:06 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2007-12-07 02:08:32 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-03-01 12:58:06 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
- 2006-06-26 17:41:32 148,480 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-02-20 05:35:05 45,568 -c----w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
- 2007-12-19 22:53:23 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-03-01 12:58:06 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-12-07 02:08:32 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-03-01 12:58:06 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-12-07 02:08:32 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-03-01 12:58:06 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2007-06-19 13:32:25 282,112 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2008-02-20 06:51:00 282,624 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
- 2007-12-07 02:08:32 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-03-01 12:58:06 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2007-12-06 11:02:31 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-02-29 08:56:41 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2007-12-07 02:08:32 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-03-01 12:58:06 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-12-07 02:08:32 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-03-01 12:58:06 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2007-12-07 02:08:32 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-03-01 12:58:07 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2007-12-07 02:08:32 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-03-01 12:58:07 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-12-07 02:08:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-03-01 12:58:08 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2007-12-07 02:08:33 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-03-01 12:58:08 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-12-07 02:08:33 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-03-01 12:58:08 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2007-12-06 11:03:16 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-02-29 08:57:05 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-12-07 02:08:33 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-03-01 12:58:08 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2007-12-07 02:08:33 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-03-01 12:58:08 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2007-12-07 02:08:33 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-03-01 12:58:08 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2007-12-08 09:38:36 3,592,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-03-01 16:28:10 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-12-07 02:08:34 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-03-01 12:58:09 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2007-12-07 02:08:34 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-03-01 12:58:10 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2007-12-07 02:08:34 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-03-01 12:58:10 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
- 2007-12-07 02:08:34 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-03-01 12:58:10 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-01-11 05:36:55 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-03-01 12:58:10 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-12-07 02:08:34 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-03-01 12:58:10 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2007-12-07 02:08:34 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-03-01 12:58:10 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-12-07 02:08:34 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-03-01 12:58:11 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-03-08 15:33:58 1,843,712 -c----w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2008-03-20 08:09:22 1,845,376 -c----w C:\WINDOWS\system32\dllcache\win32k.sys
- 2007-12-07 02:08:34 824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-03-01 12:58:11 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2006-06-26 17:41:32 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-02-20 05:35:05 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2007-12-19 22:53:23 347,136 ------w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-03-01 12:58:06 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2007-12-07 02:08:32 214,528 ------w C:\WINDOWS\system32\dxtrans.dll
+ 2008-03-01 12:58:06 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-12-07 02:08:32 133,120 ------w C:\WINDOWS\system32\extmgr.dll
+ 2008-03-01 12:58:06 133,120 ------w C:\WINDOWS\system32\extmgr.dll
- 2007-07-18 14:36:41 230,392 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-09 16:29:54 230,392 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2007-12-07 02:08:32 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-03-01 12:58:06 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-12-06 11:02:31 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-02-29 08:56:41 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
- 2007-12-07 02:08:32 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
+ 2008-03-01 12:58:06 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
- 2007-12-07 02:08:32 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
+ 2008-03-01 12:58:06 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
- 2007-12-06 04:59:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll
+ 2008-02-15 05:44:25 161,792 ------w C:\WINDOWS\system32\ieakui.dll
- 2007-12-07 02:08:32 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-03-01 12:58:07 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-12-07 02:08:32 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-03-01 12:58:07 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
- 2007-12-07 02:08:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-03-01 12:58:08 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-12-07 02:08:33 44,544 ------w C:\WINDOWS\system32\iernonce.dll
+ 2008-03-01 12:58:08 44,544 ------w C:\WINDOWS\system32\iernonce.dll
- 2007-12-07 02:08:33 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-03-01 12:58:08 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-12-07 02:08:33 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
+ 2008-03-01 12:58:08 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
- 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe
- 2007-12-07 02:08:33 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-03-01 12:58:08 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-12-07 02:08:33 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-03-01 12:58:08 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2007-12-08 09:38:36 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-03-01 16:28:10 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-12-07 02:08:34 478,208 ------w C:\WINDOWS\system32\mshtmled.dll
+ 2008-03-01 12:58:09 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2007-12-07 02:08:34 193,024 ------w C:\WINDOWS\system32\msrating.dll
+ 2008-03-01 12:58:10 193,024 ------w C:\WINDOWS\system32\msrating.dll
- 2007-12-07 02:08:34 671,232 ------w C:\WINDOWS\system32\mstime.dll
+ 2008-03-01 12:58:10 671,232 ------w C:\WINDOWS\system32\mstime.dll
- 2007-12-07 02:08:34 102,912 ------w C:\WINDOWS\system32\occache.dll
+ 2008-03-01 12:58:10 102,912 ------w C:\WINDOWS\system32\occache.dll
- 2008-01-11 05:36:55 44,544 ------w C:\WINDOWS\system32\pngfilt.dll
+ 2008-03-01 12:58:10 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-12-07 02:08:34 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-03-01 12:58:10 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-12-07 02:08:34 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-03-01 12:58:10 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2007-12-07 02:08:34 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-03-01 12:58:11 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-04-10 13:41:39 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_110.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-25 21:54 23090984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"aliceeadsl"="C:\WINDOWS\system32\aliceeadsl.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22 7618560]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2007-06-21 12:01 70952]
"HostManager"="C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe" [2006-09-26 02:52 50736]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-05-18 03:15 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-05-17 04:37 69632]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 C:\WINDOWS\system32\nvmctray.dll]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-06-28 18:27 181488]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" []

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2005-12-13 16:57:44 156784]
HPAiODevice(hp psc 700 series) - 1.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe [2002-04-30 18:26:44 491580]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-08-31 16:35:40 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2008-03-29 19:37 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
--a------ 2007-10-25 17:33 563984 C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-06-01 11:22 1519616 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-10-23 18:12 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regscan]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2005-04-15 05:01 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"D:\\Quake III Arena\\quake3.exe"=
"C:\\Program Files\\MSN Gaming Zone\\Windows\\chkrzm.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Quake 4\\Quake4.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\1142969704\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\PRONOTE 2007\\PRONOTE client.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:*:Disabled:@xpsp2res.dll,-22004
"19491:TCP"= 19491:TCP:PORT_19491
"9485:TCP"= 9485:TCP:PORT_9485
"39993:TCP"= 39993:TCP:PORT_39993
"43555:TCP"= 43555:TCP:PORT_43555
"31867:TCP"= 31867:TCP:PORT_31867
"5473:TCP"= 5473:TCP:PORT_5473
"51508:TCP"= 51508:TCP:PORT_51508
"58461:TCP"= 58461:TCP:PORT_58461
"11320:TCP"= 11320:TCP:PORT_11320
"61410:TCP"= 61410:TCP:PORT_61410
"13880:TCP"= 13880:TCP:PORT_13880
"14707:TCP"= 14707:TCP:PORT_14707
"21195:TCP"= 21195:TCP:PORT_21195
"27398:TCP"= 27398:TCP:PORT_27398
"30298:TCP"= 30298:TCP:PORT_30298
"65348:TCP"= 65348:TCP:PORT_65348
"5782:TCP"= 5782:TCP:PORT_5782
"35426:TCP"= 35426:TCP:PORT_35426
"51656:TCP"= 51656:TCP:PORT_51656
"43458:TCP"= 43458:TCP:PORT_43458
"31242:TCP"= 31242:TCP:PORT_31242
"15973:TCP"= 15973:TCP:PORT_15973
"51365:TCP"= 51365:TCP:PORT_51365
"64346:TCP"= 64346:TCP:PORT_64346
"35535:TCP"= 35535:TCP:PORT_35535
"13128:TCP"= 13128:TCP:PORT_13128
"46681:TCP"= 46681:TCP:PORT_46681
"30329:TCP"= 30329:TCP:PORT_30329
"50617:TCP"= 50617:TCP:PORT_50617
"26425:TCP"= 26425:TCP:PORT_26425
"38423:TCP"= 38423:TCP:PORT_38423
"63186:TCP"= 63186:TCP:PORT_63186
"46461:TCP"= 46461:TCP:PORT_46461
"14547:TCP"= 14547:TCP:PORT_14547
"27298:TCP"= 27298:TCP:PORT_27298
"37270:TCP"= 37270:TCP:PORT_37270
"18105:TCP"= 18105:TCP:PORT_18105
"16836:TCP"= 16836:TCP:PORT_16836
"48950:TCP"= 48950:TCP:PORT_48950
"44871:TCP"= 44871:TCP:PORT_44871
"53113:TCP"= 53113:TCP:PORT_53113
"23896:TCP"= 23896:TCP:PORT_23896
"59289:TCP"= 59289:TCP:PORT_59289
"35555:TCP"= 35555:TCP:PORT_35555
"26391:TCP"= 26391:TCP:PORT_26391
"52430:TCP"= 52430:TCP:PORT_52430
"10410:TCP"= 10410:TCP:PORT_10410
"8368:TCP"= 8368:TCP:PORT_8368
"20469:TCP"= 20469:TCP:PORT_20469
"20376:TCP"= 20376:TCP:PORT_20376
"7040:TCP"= 7040:TCP:PORT_7040
"26421:TCP"= 26421:TCP:PORT_26421
"13369:TCP"= 13369:TCP:PORT_13369
"50244:TCP"= 50244:TCP:PORT_50244
"52358:TCP"= 52358:TCP:PORT_52358
"50975:TCP"= 50975:TCP:PORT_50975
"46942:TCP"= 46942:TCP:PORT_46942
"26301:TCP"= 26301:TCP:PORT_26301
"19851:TCP"= 19851:TCP:PORT_19851
"20820:TCP"= 20820:TCP:PORT_20820
"25270:TCP"= 25270:TCP:PORT_25270
"48707:TCP"= 48707:TCP:PORT_48707
"33984:TCP"= 33984:TCP:PORT_33984
"6325:TCP"= 6325:TCP:PORT_6325
"32207:TCP"= 32207:TCP:PORT_32207
"36410:TCP"= 36410:TCP:PORT_36410
"53338:TCP"= 53338:TCP:@xpsp2res.dll,-22005
"44985:TCP"= 44985:TCP:@xpsp2res.dll,-22005
"23932:TCP"= 23932:TCP:@xpsp2res.dll,-22005
"58011:TCP"= 58011:TCP:@xpsp2res.dll,-22005

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 NBXG7031;NB 802.11g XG703 SP1 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2004-09-17 11:56]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys []
S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-05-12 16:24]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c4152c2-4277-11da-9e2d-806d6172696f}]
\Shell\AutoRun\command - G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eafbbfe-af28-11dc-81ca-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3324cd33-df18-11dc-8208-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84d049a7-c51d-11dc-81dd-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5c8f250-3b2b-11db-8018-0013d3396ad7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 15:56:23
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-10 15:57:19
ComboFix-quarantined-files.txt 2008-04-10 13:57:05
ComboFix2.txt 2008-04-08 15:03:25
Pre-Run: 15,574,552,576 octets libres
Post-Run: 15,563,710,464 octets libres
.
2008-04-09 16:02:52 --- E O F ---




*****************************************************************
****************************************************************
****************************************************************

AVEC COPIER COLLER:

ComboFix 08-04-09.9 - Nicolas 2008-04-10 16:03:11.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.157 [GMT 2:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nicolas\Bureau\CFscript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color

FILE ::
C:\WINDOWS\system32\aliceeadsl.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))))))))
.

2008-04-09 18:00 . 2008-04-09 18:02 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-08 15:53 . 2008-04-09 16:12 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Malwarebytes
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-08 15:12 . 2008-04-08 15:12 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-08 15:06 . 2008-04-08 15:19 <REP> d-------- C:\SDFix
2008-04-08 11:33 . 2008-04-08 11:33 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Grisoft
2008-04-08 11:32 . 2008-04-08 11:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-08 11:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-08 10:42 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-08 10:42 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\118294.78
2008-04-08 10:42 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-06 22:59 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-06 22:59 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-06 22:59 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-06 22:59 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-06 22:59 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-06 22:59 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-06 22:59 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-06 22:59 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-06 22:59 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-06 22:59 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-02 19:00 . 2008-04-02 18:59 361,984 --a------ C:\WINDOWS\system32\spolsv.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 17:31 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Skype
2008-04-08 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-04-08 08:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-07 21:53 --------- d-----w C:\Program Files\DivX
2008-04-06 21:24 --------- d-----w C:\Program Files\Notepad++
2008-04-06 21:24 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Notepad++
2008-04-06 15:42 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-28 15:51 --------- d-----w C:\Program Files\Ludiclub
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-07 12:25 --------- d-----w C:\Program Files\AOL 9.0
2008-03-05 18:36 --------- d-----w C:\Program Files\Java
2008-03-02 16:31 --------- d-----w C:\Program Files\eMule
2008-03-02 16:26 37,888 ----a-w C:\WINDOWS\system32\rar.exe
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-02-28 23:25 --------- d-----w C:\Program Files\Trend Micro
2008-02-28 10:37 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-13 18:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-08 09:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2006-05-28 16:33 26,140 ----a-w C:\Documents and Settings\Nicolas\TB2Categories000.dat
2005-12-13 14:49 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
1992-01-28 13:04 475,136 ----a-w C:\Program Files\Berlitz.EXE
.

((((((((((((((((((((((((((((( snapshot_2008-04-10_15.56.50,40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-10 13:56:18 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-10 14:04:22 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-25 21:54 23090984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"aliceeadsl"="C:\WINDOWS\system32\aliceeadsl.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22 7618560]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2007-06-21 12:01 70952]
"HostManager"="C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe" [2006-09-26 02:52 50736]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-05-18 03:15 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-05-17 04:37 69632]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 C:\WINDOWS\system32\nvmctray.dll]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-06-28 18:27 181488]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2005-12-13 16:57:44 156784]
HPAiODevice(hp psc 700 series) - 1.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe [2002-04-30 18:26:44 491580]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-08-31 16:35:40 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2008-03-29 19:37 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
--a------ 2007-10-25 17:33 563984 C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-06-01 11:22 1519616 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-10-23 18:12 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regscan]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2005-04-15 05:01 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"D:\\Quake III Arena\\quake3.exe"=
"C:\\Program Files\\MSN Gaming Zone\\Windows\\chkrzm.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Quake 4\\Quake4.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\1142969704\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\PRONOTE 2007\\PRONOTE client.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:*:Disabled:@xpsp2res.dll,-22004
"19491:TCP"= 19491:TCP:PORT_19491
"9485:TCP"= 9485:TCP:PORT_9485
"39993:TCP"= 39993:TCP:PORT_39993
"43555:TCP"= 43555:TCP:PORT_43555
"31867:TCP"= 31867:TCP:PORT_31867
"5473:TCP"= 5473:TCP:PORT_5473
"51508:TCP"= 51508:TCP:PORT_51508
"58461:TCP"= 58461:TCP:PORT_58461
"11320:TCP"= 11320:TCP:PORT_11320
"61410:TCP"= 61410:TCP:PORT_61410
"13880:TCP"= 13880:TCP:PORT_13880
"14707:TCP"= 14707:TCP:PORT_14707
"21195:TCP"= 21195:TCP:PORT_21195
"27398:TCP"= 27398:TCP:PORT_27398
"30298:TCP"= 30298:TCP:PORT_30298
"65348:TCP"= 65348:TCP:PORT_65348
"5782:TCP"= 5782:TCP:PORT_5782
"35426:TCP"= 35426:TCP:PORT_35426
"51656:TCP"= 51656:TCP:PORT_51656
"43458:TCP"= 43458:TCP:PORT_43458
"31242:TCP"= 31242:TCP:PORT_31242
"15973:TCP"= 15973:TCP:PORT_15973
"51365:TCP"= 51365:TCP:PORT_51365
"64346:TCP"= 64346:TCP:PORT_64346
"35535:TCP"= 35535:TCP:PORT_35535
"13128:TCP"= 13128:TCP:PORT_13128
"46681:TCP"= 46681:TCP:PORT_46681
"30329:TCP"= 30329:TCP:PORT_30329
"50617:TCP"= 50617:TCP:PORT_50617
"26425:TCP"= 26425:TCP:PORT_26425
"38423:TCP"= 38423:TCP:PORT_38423
"63186:TCP"= 63186:TCP:PORT_63186
"46461:TCP"= 46461:TCP:PORT_46461
"14547:TCP"= 14547:TCP:PORT_14547
"27298:TCP"= 27298:TCP:PORT_27298
"37270:TCP"= 37270:TCP:PORT_37270
"18105:TCP"= 18105:TCP:PORT_18105
"16836:TCP"= 16836:TCP:PORT_16836
"48950:TCP"= 48950:TCP:PORT_48950
"44871:TCP"= 44871:TCP:PORT_44871
"53113:TCP"= 53113:TCP:PORT_53113
"23896:TCP"= 23896:TCP:PORT_23896
"59289:TCP"= 59289:TCP:PORT_59289
"35555:TCP"= 35555:TCP:PORT_35555
"26391:TCP"= 26391:TCP:PORT_26391
"52430:TCP"= 52430:TCP:PORT_52430
"10410:TCP"= 10410:TCP:PORT_10410
"8368:TCP"= 8368:TCP:PORT_8368
"20469:TCP"= 20469:TCP:PORT_20469
"20376:TCP"= 20376:TCP:PORT_20376
"7040:TCP"= 7040:TCP:PORT_7040
"26421:TCP"= 26421:TCP:PORT_26421
"13369:TCP"= 13369:TCP:PORT_13369
"50244:TCP"= 50244:TCP:PORT_50244
"52358:TCP"= 52358:TCP:PORT_52358
"50975:TCP"= 50975:TCP:PORT_50975
"46942:TCP"= 46942:TCP:PORT_46942
"26301:TCP"= 26301:TCP:PORT_26301
"19851:TCP"= 19851:TCP:PORT_19851
"20820:TCP"= 20820:TCP:PORT_20820
"25270:TCP"= 25270:TCP:PORT_25270
"48707:TCP"= 48707:TCP:PORT_48707
"33984:TCP"= 33984:TCP:PORT_33984
"6325:TCP"= 6325:TCP:PORT_6325
"32207:TCP"= 32207:TCP:PORT_32207
"36410:TCP"= 36410:TCP:PORT_36410
"53338:TCP"= 53338:TCP:@xpsp2res.dll,-22005
"44985:TCP"= 44985:TCP:@xpsp2res.dll,-22005
"23932:TCP"= 23932:TCP:@xpsp2res.dll,-22005
"58011:TCP"= 58011:TCP:@xpsp2res.dll,-22005

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 NBXG7031;NB 802.11g XG703 SP1 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2004-09-17 11:56]
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys []
S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-05-12 16:24]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c4152c2-4277-11da-9e2d-806d6172696f}]
\Shell\AutoRun\command - G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eafbbfe-af28-11dc-81ca-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3324cd33-df18-11dc-8208-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84d049a7-c51d-11dc-81dd-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5c8f250-3b2b-11db-8018-0013d3396ad7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 16:04:28
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-10 16:05:20
ComboFix-quarantined-files.txt 2008-04-10 14:05:07
ComboFix2.txt 2008-04-10 13:57:20
ComboFix3.txt 2008-04-08 15:03:25
Pre-Run: 15,574,286,336 octets libres
Post-Run: 15,563,956,224 octets libres
.
2008-04-09 16:02:52 --- E O F ---




***********************************************************************
***********************************************************************
**********************************************************************


HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:06:50, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\fichiers communs\aol\1142969704\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1142969704\ee\aolsoftware.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\runonce.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &eBay Search - res://E:\Programmes Nicolas\barre outil ebay\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} - http://www.1-click.com/common/files/installer-hidden-test.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Voilà c'est fait. Toujours là grrrrrrr. Quel poison ce truc!

COMBOFIX

ComboFix 08-04-09.9 - Nicolas 2008-04-10 17:17:00.4 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.128 [GMT 2:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nicolas\Bureau\CFscript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\system32\aliceeadsl.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))))))))
.

2008-04-09 18:00 . 2008-04-09 18:02 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-08 15:53 . 2008-04-09 16:12 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Malwarebytes
2008-04-08 15:26 . 2008-04-08 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-08 15:12 . 2008-04-08 15:12 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-08 15:06 . 2008-04-08 15:19 <REP> d-------- C:\SDFix
2008-04-08 11:33 . 2008-04-08 11:33 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Grisoft
2008-04-08 11:32 . 2008-04-08 11:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-08 11:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-08 10:42 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-08 10:42 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-08 10:42 . 2008-04-08 10:42 3,120 --a------ C:\WINDOWS\118294.78
2008-04-08 10:42 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-06 22:59 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-06 22:59 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-06 22:59 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-06 22:59 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-06 22:59 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-06 22:59 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-06 22:59 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-06 22:59 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-06 22:59 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-06 22:59 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-02 19:00 . 2008-04-02 18:59 361,984 --a------ C:\WINDOWS\system32\spolsv.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 17:31 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Skype
2008-04-08 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-04-08 08:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-07 21:53 --------- d-----w C:\Program Files\DivX
2008-04-06 21:24 --------- d-----w C:\Program Files\Notepad++
2008-04-06 21:24 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Notepad++
2008-04-06 15:42 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-28 15:51 --------- d-----w C:\Program Files\Ludiclub
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-07 12:25 --------- d-----w C:\Program Files\AOL 9.0
2008-03-05 18:36 --------- d-----w C:\Program Files\Java
2008-03-02 16:31 --------- d-----w C:\Program Files\eMule
2008-03-02 16:26 37,888 ----a-w C:\WINDOWS\system32\rar.exe
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-02-28 23:25 --------- d-----w C:\Program Files\Trend Micro
2008-02-28 10:37 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-13 18:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-08 09:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2006-05-28 16:33 26,140 ----a-w C:\Documents and Settings\Nicolas\TB2Categories000.dat
2005-12-13 14:49 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
1992-01-28 13:04 475,136 ----a-w C:\Program Files\Berlitz.EXE
.

((((((((((((((((((((((((((((( snapshot_2008-04-10_15.56.50,40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-10 13:56:18 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-10 15:18:17 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-25 21:54 23090984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"aliceeadsl"="C:\WINDOWS\system32\aliceeadsl.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22 7618560]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"AOLDialer"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" [2007-06-21 12:01 70952]
"HostManager"="C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe" [2006-09-26 02:52 50736]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-05-18 03:15 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-05-17 04:37 69632]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 C:\WINDOWS\system32\nvmctray.dll]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-06-28 18:27 181488]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
AOL 9.0 Ic“ne AOL.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2005-12-13 16:57:44 156784]
HPAiODevice(hp psc 700 series) - 1.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe [2002-04-30 18:26:44 491580]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-08-31 16:35:40 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2008-03-29 19:37 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
--a------ 2007-10-25 17:33 563984 C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-06-01 11:22 1519616 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-10-23 18:12 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regscan]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2005-04-15 05:01 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"D:\\Quake III Arena\\quake3.exe"=
"C:\\Program Files\\MSN Gaming Zone\\Windows\\chkrzm.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Quake 4\\Quake4.exe"=
"C:\\Program Files\\Fichiers communs\\AOL\\1142969704\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\PRONOTE 2007\\PRONOTE client.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:*:Disabled:@xpsp2res.dll,-22004
"19491:TCP"= 19491:TCP:PORT_19491
"9485:TCP"= 9485:TCP:PORT_9485
"39993:TCP"= 39993:TCP:PORT_39993
"43555:TCP"= 43555:TCP:PORT_43555
"31867:TCP"= 31867:TCP:PORT_31867
"5473:TCP"= 5473:TCP:PORT_5473
"51508:TCP"= 51508:TCP:PORT_51508
"58461:TCP"= 58461:TCP:PORT_58461
"11320:TCP"= 11320:TCP:PORT_11320
"61410:TCP"= 61410:TCP:PORT_61410
"13880:TCP"= 13880:TCP:PORT_13880
"14707:TCP"= 14707:TCP:PORT_14707
"21195:TCP"= 21195:TCP:PORT_21195
"27398:TCP"= 27398:TCP:PORT_27398
"30298:TCP"= 30298:TCP:PORT_30298
"65348:TCP"= 65348:TCP:PORT_65348
"5782:TCP"= 5782:TCP:PORT_5782
"35426:TCP"= 35426:TCP:PORT_35426
"51656:TCP"= 51656:TCP:PORT_51656
"43458:TCP"= 43458:TCP:PORT_43458
"31242:TCP"= 31242:TCP:PORT_31242
"15973:TCP"= 15973:TCP:PORT_15973
"51365:TCP"= 51365:TCP:PORT_51365
"64346:TCP"= 64346:TCP:PORT_64346
"35535:TCP"= 35535:TCP:PORT_35535
"13128:TCP"= 13128:TCP:PORT_13128
"46681:TCP"= 46681:TCP:PORT_46681
"30329:TCP"= 30329:TCP:PORT_30329
"50617:TCP"= 50617:TCP:PORT_50617
"26425:TCP"= 26425:TCP:PORT_26425
"38423:TCP"= 38423:TCP:PORT_38423
"63186:TCP"= 63186:TCP:PORT_63186
"46461:TCP"= 46461:TCP:PORT_46461
"14547:TCP"= 14547:TCP:PORT_14547
"27298:TCP"= 27298:TCP:PORT_27298
"37270:TCP"= 37270:TCP:PORT_37270
"18105:TCP"= 18105:TCP:PORT_18105
"16836:TCP"= 16836:TCP:PORT_16836
"48950:TCP"= 48950:TCP:PORT_48950
"44871:TCP"= 44871:TCP:PORT_44871
"53113:TCP"= 53113:TCP:PORT_53113
"23896:TCP"= 23896:TCP:PORT_23896
"59289:TCP"= 59289:TCP:PORT_59289
"35555:TCP"= 35555:TCP:PORT_35555
"26391:TCP"= 26391:TCP:PORT_26391
"52430:TCP"= 52430:TCP:PORT_52430
"10410:TCP"= 10410:TCP:PORT_10410
"8368:TCP"= 8368:TCP:PORT_8368
"20469:TCP"= 20469:TCP:PORT_20469
"20376:TCP"= 20376:TCP:PORT_20376
"7040:TCP"= 7040:TCP:PORT_7040
"26421:TCP"= 26421:TCP:PORT_26421
"13369:TCP"= 13369:TCP:PORT_13369
"50244:TCP"= 50244:TCP:PORT_50244
"52358:TCP"= 52358:TCP:PORT_52358
"50975:TCP"= 50975:TCP:PORT_50975
"46942:TCP"= 46942:TCP:PORT_46942
"26301:TCP"= 26301:TCP:PORT_26301
"19851:TCP"= 19851:TCP:PORT_19851
"20820:TCP"= 20820:TCP:PORT_20820
"25270:TCP"= 25270:TCP:PORT_25270
"48707:TCP"= 48707:TCP:PORT_48707
"33984:TCP"= 33984:TCP:PORT_33984
"6325:TCP"= 6325:TCP:PORT_6325
"32207:TCP"= 32207:TCP:PORT_32207
"36410:TCP"= 36410:TCP:PORT_36410
"53338:TCP"= 53338:TCP:@xpsp2res.dll,-22005
"44985:TCP"= 44985:TCP:@xpsp2res.dll,-22005
"23932:TCP"= 23932:TCP:@xpsp2res.dll,-22005
"58011:TCP"= 58011:TCP:@xpsp2res.dll,-22005

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 NBXG7031;NB 802.11g XG703 SP1 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2004-09-17 11:56]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys []
S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-05-12 16:24]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c4152c2-4277-11da-9e2d-806d6172696f}]
\Shell\AutoRun\command - G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eafbbfe-af28-11dc-81ca-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3324cd33-df18-11dc-8208-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84d049a7-c51d-11dc-81dd-0060b3dc5bd7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5c8f250-3b2b-11db-8018-0013d3396ad7}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 17:18:24
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-10 17:19:24
ComboFix-quarantined-files.txt 2008-04-10 15:19:17
ComboFix2.txt 2008-04-10 14:05:21
ComboFix3.txt 2008-04-10 13:57:20
ComboFix4.txt 2008-04-08 15:03:25
Pre-Run: 15,547,633,664 octets libres
Post-Run: 15,537,348,608 octets libres
.
2008-04-09 16:02:52 --- E O F ---


*******************************************************************************
******************************************************************************
******************************************************************************

HIJACKTHIS


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:20:40, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\fichiers communs\aol\1142969704\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1142969704\ee\aolsoftware.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1142969704\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [aliceeadsl] C:\WINDOWS\system32\aliceeadsl.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &eBay Search - res://E:\Programmes Nicolas\barre outil ebay\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} - http://www.1-click.com/common/files/installer-hidden-test.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe