Anitivirus xp 2008

salut,

voici le rapport de combo.fix
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Mimilolo\Application Data\inst.exe
C:\Program Files\Dcads Advanced Toolbar
C:\Program Files\Dcads Advanced Toolbar\buttons.xml
C:\Program Files\Dcads Advanced Toolbar\search.xml
C:\Program Files\Dcads Advanced Toolbar\toolbar.dll
C:\Program Files\Dcads Advanced Toolbar\uninstall.exe
C:\Program Files\Mozilla Firefox\components\nsBrowserOpt.dll
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))))))))
.

2008-06-26 17:17 . 2008-06-26 17:17 94,208 --a------ C:\WINDOWS\system32\pphcca7j0ecf1.exe
2008-06-26 12:43 . 2008-06-26 18:39 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-26 12:43 . 2008-06-26 12:43 <REP> d-------- C:\Documents and Settings\Mimilolo\Application Data\Malwarebytes
2008-06-26 12:43 . 2008-06-26 12:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-26 12:43 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-26 12:43 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-26 10:55 . 2008-06-26 10:55 <REP> d-------- C:\Program Files\Trend Micro
2008-06-25 13:15 . 2008-06-26 17:17 <REP> d-------- C:\Program Files\rhc9a7j0ecf1
2008-06-25 13:15 . 2008-06-25 13:15 <REP> d-------- C:\Documents and Settings\Mimilolo\Application Data\rhc9a7j0ecf1
2008-06-25 13:15 . 2008-06-26 17:17 60,928 --a------ C:\WINDOWS\system32\blphcca7j0ecf1.scr
2008-06-25 13:14 . 2008-06-25 13:14 109,056 --a------ C:\WINDOWS\system32\lphcca7j0ecf1.exe
2008-06-25 13:14 . 2008-06-26 17:16 90,838 --a------ C:\WINDOWS\system32\phcca7j0ecf1.bmp
2008-06-19 17:50 . 2008-06-19 17:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-19 17:50 . 2008-06-19 17:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 07:58 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 07:58 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-30 19:19 . 2008-05-30 21:06 537 --a------ C:\WINDOWS\eReg.dat
2008-05-30 19:18 . 2008-05-30 21:06 <REP> d-------- C:\Program Files\Maxis
2008-05-29 19:17 . 2008-05-29 19:20 <REP> d-------- C:\Program Files\Zapu
2008-05-29 19:17 . 2008-05-29 19:17 <REP> d-------- C:\Program Files\Share_Accelerator_MM
2008-05-29 19:17 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
2008-05-29 13:46 . 2008-06-15 17:46 <REP> d-------- C:\Program Files\LimeWire

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-16 21:35 --------- d-----w C:\Program Files\eMule
2008-06-15 15:46 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\LimeWire
2008-06-12 11:47 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\Samsung
2008-06-12 11:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-12 11:39 --------- d-----w C:\Program Files\Samsung
2008-05-31 09:42 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\Image Zone Express
2008-05-25 17:29 --------- d-----w C:\Program Files\Joyland Casino
2008-05-13 20:24 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\AdobeUM
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-23 12:17 47,360 ----a-w C:\Documents and Settings\Mimilolo\Application Data\pcouffin.sys
2006-05-30 15:00 630 -c--a-w C:\Program Files\UTILISAT.DBF
2006-05-30 15:00 516 -c--a-w C:\Program Files\reseau.net
2006-05-30 15:00 135 -c--a-w C:\Program Files\CielVideo.ini
2006-05-30 14:41 7,488 -c--a-w C:\Program Files\WKPRO.vds
2006-05-30 14:41 47,264 -c--a-w C:\Program Files\WKPRN.vds
2006-05-30 14:41 376,896 -c--a-w C:\Program Files\WKRES.vds
2006-04-26 18:32 4,608 -c--a-w C:\Program Files\UTILISAT.CDX
2006-04-26 18:23 90 -c--a-w C:\Program Files\SETUP.LOG
2006-04-26 18:23 113 -c--a-w C:\Program Files\CRUN.BIN
2006-04-01 07:43 4,677,596 -c--a-w C:\Program Files\eMule0.47a-Installer.exe
2006-01-28 06:59 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2002-08-01 13:49 254,020 -c--a-w C:\Program Files\camKernel.dll
2006-07-17 16:37 56 --sh--r C:\WINDOWS\system32\3D09915D30.sys
2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2005-11-18 08:02 8 -csha-r C:\WINDOWS\system32\EFF80A778C.sys
2008-01-13 17:54 10,072 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2004-08-05 12:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2004-08-05 12:00 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-05 12:00 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2007-12-04 18:41 550,912 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25 94208]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 11:36 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 10:59 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-07-08 11:05 729178]
"RemoteControl"="C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-17 10:58 98304]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"%FP%Friendly fts.exe"="C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe" [2003-05-06 09:28 72192]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-11-17 10:57 26112]
"SMrhc9a7j0ecf1"="C:\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1.exe" [2008-06-25 22:31 1214976]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 15:17 14743552 C:\WINDOWS\RTHDCPL.EXE]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-08 11:03 114688]
"lphcca7j0ecf1"="C:\WINDOWS\system32\lphcca7j0ecf1.exe" [2008-06-25 13:14 109056]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-08 11:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-08 10:59 77824]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AdobeVersionCue"=C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupSNK.exe

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-20 15:16:50 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 18:50:46
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-06-26 18:51:29
ComboFix-quarantined-files.txt 2008-06-26 16:51:24

Pre-Run: 9,699,500,032 octets libres
Post-Run: 9,936,248,832 octets libres

157 --- E O F --- 2008-06-20 19:26:28

J'attends, ta réponse, d'avence merci
Milard73

Voila les 2 rapports :
- combofix
ComboFix 08-06-20.4 - Mimilolo 2008-06-26 19:09:25.2 - NTFSx86
Endroit: D:\documents and settings\Mimilolo\mes documents\mes telechargements\ComboFix.exe
Command switches used :: D:\documents and settings\Mimilolo\mes documents\CFScript.txt..txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\system32\phcca7j0ecf1.bmp
C:\WINDOWS\system32\pphcca7j0ecf1.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Mimilolo\Application Data\rhc9a7j0ecf1
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\rhc9a7j0ecf1
C:\Program Files\rhc9a7j0ecf1\database.dat
C:\Program Files\rhc9a7j0ecf1\license.txt
C:\Program Files\rhc9a7j0ecf1\MFC71.dll
C:\Program Files\rhc9a7j0ecf1\MFC71ENU.DLL
C:\Program Files\rhc9a7j0ecf1\msvcp71.dll
C:\Program Files\rhc9a7j0ecf1\msvcr71.dll
C:\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1.exe
C:\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1.exe.local
C:\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1Skin.dll
C:\Program Files\rhc9a7j0ecf1\Uninstall.exe
C:\WINDOWS\system32\phcca7j0ecf1.bmp
C:\WINDOWS\system32\pphcca7j0ecf1.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))))))))
.

2008-06-26 12:43 . 2008-06-26 18:39 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-26 12:43 . 2008-06-26 12:43 <REP> d-------- C:\Documents and Settings\Mimilolo\Application Data\Malwarebytes
2008-06-26 12:43 . 2008-06-26 12:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-26 12:43 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-26 12:43 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-26 10:55 . 2008-06-26 10:55 <REP> d-------- C:\Program Files\Trend Micro
2008-06-25 13:15 . 2008-06-26 17:17 60,928 --a------ C:\WINDOWS\system32\blphcca7j0ecf1.scr
2008-06-25 13:14 . 2008-06-25 13:14 109,056 --a------ C:\WINDOWS\system32\lphcca7j0ecf1.exe
2008-06-19 17:50 . 2008-06-19 17:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-19 17:50 . 2008-06-19 17:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 07:58 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 07:58 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-30 19:19 . 2008-05-30 21:06 537 --a------ C:\WINDOWS\eReg.dat
2008-05-30 19:18 . 2008-05-30 21:06 <REP> d-------- C:\Program Files\Maxis
2008-05-29 19:17 . 2008-05-29 19:20 <REP> d-------- C:\Program Files\Zapu
2008-05-29 19:17 . 2008-05-29 19:17 <REP> d-------- C:\Program Files\Share_Accelerator_MM
2008-05-29 19:17 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
2008-05-29 13:46 . 2008-06-15 17:46 <REP> d-------- C:\Program Files\LimeWire

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-16 21:35 --------- d-----w C:\Program Files\eMule
2008-06-15 15:46 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\LimeWire
2008-06-12 11:47 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\Samsung
2008-06-12 11:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-12 11:39 --------- d-----w C:\Program Files\Samsung
2008-05-31 09:42 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\Image Zone Express
2008-05-25 17:29 --------- d-----w C:\Program Files\Joyland Casino
2008-05-13 20:24 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\AdobeUM
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-01-23 12:17 47,360 ----a-w C:\Documents and Settings\Mimilolo\Application Data\pcouffin.sys
2006-05-30 15:00 630 -c--a-w C:\Program Files\UTILISAT.DBF
2006-05-30 15:00 516 -c--a-w C:\Program Files\reseau.net
2006-05-30 15:00 135 -c--a-w C:\Program Files\CielVideo.ini
2006-05-30 14:41 7,488 -c--a-w C:\Program Files\WKPRO.vds
2006-05-30 14:41 47,264 -c--a-w C:\Program Files\WKPRN.vds
2006-05-30 14:41 376,896 -c--a-w C:\Program Files\WKRES.vds
2006-04-26 18:32 4,608 -c--a-w C:\Program Files\UTILISAT.CDX
2006-04-26 18:23 90 -c--a-w C:\Program Files\SETUP.LOG
2006-04-26 18:23 113 -c--a-w C:\Program Files\CRUN.BIN
2006-04-01 07:43 4,677,596 -c--a-w C:\Program Files\eMule0.47a-Installer.exe
2006-01-28 06:59 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2002-08-01 13:49 254,020 -c--a-w C:\Program Files\camKernel.dll
2006-07-17 16:37 56 --sh--r C:\WINDOWS\system32\3D09915D30.sys
2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2005-11-18 08:02 8 -csha-r C:\WINDOWS\system32\EFF80A778C.sys
2008-01-13 17:54 10,072 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2004-08-05 12:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2004-08-05 12:00 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-05 12:00 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2007-12-04 18:41 550,912 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-26_18.51.13,78 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-26 15:16:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-26 17:11:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25 94208]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 11:36 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 10:59 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-07-08 11:05 729178]
"RemoteControl"="C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-17 10:58 98304]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"%FP%Friendly fts.exe"="C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe" [2003-05-06 09:28 72192]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-11-17 10:57 26112]
"SMrhc9a7j0ecf1"="C:\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 15:17 14743552 C:\WINDOWS\RTHDCPL.EXE]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-08 11:03 114688]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-08 11:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-08 10:59 77824]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AdobeVersionCue"=C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-20 15:16:50 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 19:12:28
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-26 19:15:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 17:15:43
ComboFix2.txt 2008-06-26 16:51:29

Pre-Run: 10,250,100,736 octets libres
Post-Run: 10,228,572,160 octets libres

181 --- E O F --- 2008-06-20 19:26:28
Hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:17:55, on 26/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SMrhc9a7j0ecf1] C:\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/574/webolr/OCX/FlashAX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

voila les rapports.
ComboFix 08-06-20.4 - Mimilolo 2008-06-26 20:12:27.3 - NTFSx86
Endroit: D:\documents and settings\Mimilolo\mes documents\mes telechargements\ComboFix.exe
Command switches used :: D:\documents and settings\Mimilolo\mes documents\CFScript.txt..txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))))))))
.

2008-06-26 12:43 . 2008-06-26 18:39 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-26 12:43 . 2008-06-26 12:43 <REP> d-------- C:\Documents and Settings\Mimilolo\Application Data\Malwarebytes
2008-06-26 12:43 . 2008-06-26 12:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-26 12:43 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-26 12:43 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-26 10:55 . 2008-06-26 10:55 <REP> d-------- C:\Program Files\Trend Micro
2008-06-25 13:15 . 2008-06-26 17:17 60,928 --a------ C:\WINDOWS\system32\blphcca7j0ecf1.scr
2008-06-25 13:14 . 2008-06-25 13:14 109,056 --a------ C:\WINDOWS\system32\lphcca7j0ecf1.exe
2008-06-19 17:50 . 2008-06-19 17:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-19 17:50 . 2008-06-19 17:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 07:58 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 07:58 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-30 19:19 . 2008-05-30 21:06 537 --a------ C:\WINDOWS\eReg.dat
2008-05-30 19:18 . 2008-05-30 21:06 <REP> d-------- C:\Program Files\Maxis
2008-05-29 19:17 . 2008-05-29 19:20 <REP> d-------- C:\Program Files\Zapu
2008-05-29 19:17 . 2008-05-29 19:17 <REP> d-------- C:\Program Files\Share_Accelerator_MM
2008-05-29 19:17 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
2008-05-29 13:46 . 2008-06-15 17:46 <REP> d-------- C:\Program Files\LimeWire

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-16 21:35 --------- d-----w C:\Program Files\eMule
2008-06-15 15:46 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\LimeWire
2008-06-12 11:47 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\Samsung
2008-06-12 11:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-12 11:39 --------- d-----w C:\Program Files\Samsung
2008-05-31 09:42 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\Image Zone Express
2008-05-25 17:29 --------- d-----w C:\Program Files\Joyland Casino
2008-05-13 20:24 --------- d-----w C:\Documents and Settings\Mimilolo\Application Data\AdobeUM
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-23 12:17 47,360 ----a-w C:\Documents and Settings\Mimilolo\Application Data\pcouffin.sys
2006-05-30 15:00 630 -c--a-w C:\Program Files\UTILISAT.DBF
2006-05-30 15:00 516 -c--a-w C:\Program Files\reseau.net
2006-05-30 15:00 135 -c--a-w C:\Program Files\CielVideo.ini
2006-05-30 14:41 7,488 -c--a-w C:\Program Files\WKPRO.vds
2006-05-30 14:41 47,264 -c--a-w C:\Program Files\WKPRN.vds
2006-05-30 14:41 376,896 -c--a-w C:\Program Files\WKRES.vds
2006-04-26 18:32 4,608 -c--a-w C:\Program Files\UTILISAT.CDX
2006-04-26 18:23 90 -c--a-w C:\Program Files\SETUP.LOG
2006-04-26 18:23 113 -c--a-w C:\Program Files\CRUN.BIN
2006-04-01 07:43 4,677,596 -c--a-w C:\Program Files\eMule0.47a-Installer.exe
2006-01-28 06:59 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2002-08-01 13:49 254,020 -c--a-w C:\Program Files\camKernel.dll
2006-07-17 16:37 56 --sh--r C:\WINDOWS\system32\3D09915D30.sys
2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2005-11-18 08:02 8 -csha-r C:\WINDOWS\system32\EFF80A778C.sys
2008-01-13 17:54 10,072 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2004-08-05 12:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2004-08-05 12:00 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-05 12:00 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2007-12-04 18:41 550,912 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-26_18.51.13,78 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-26 15:16:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-26 17:11:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-06-26 17:12:04 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_600.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25 94208]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 11:36 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 10:59 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-07-08 11:05 729178]
"RemoteControl"="C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-17 10:58 98304]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"%FP%Friendly fts.exe"="C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe" [2003-05-06 09:28 72192]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-11-17 10:57 26112]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 15:17 14743552 C:\WINDOWS\RTHDCPL.EXE]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-08 11:03 114688]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-08 11:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-08 10:59 77824]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AdobeVersionCue"=C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-20 15:16:50 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 20:13:42
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-06-26 20:14:24
ComboFix-quarantined-files.txt 2008-06-26 18:14:17
ComboFix2.txt 2008-06-26 17:15:48
ComboFix3.txt 2008-06-26 16:51:29

Pre-Run: 10,275,840,000 octets libres
Post-Run: 10,264,285,184 octets libres

144 --- E O F --- 2008-06-20 19:26:28

Scan saved at 20:15:27, on 26/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/574/webolr/OCX/FlashAX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Et voila le rapport de malwarebytes :

Version de la base de données: 893

21:03:40 26/06/2008
mbam-log-6-26-2008 (21-03-40).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 112121
Temps écoulé: 31 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1Skin.dll.vir (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pphcca7j0ecf1.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3769C700-A9EF-4496-B938-18584755512E}\RP1144\A0085053.dll (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3769C700-A9EF-4496-B938-18584755512E}\RP1144\A0085054.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3769C700-A9EF-4496-B938-18584755512E}\RP1146\A0085203.dll (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3769C700-A9EF-4496-B938-18584755512E}\RP1146\A0085205.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Mimilolo\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
@+

Voila le rapport de clean
26/06/2008 a 21:39:21,39

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files
"C:\Program Files\Viewpoint\" FOUND
*** Fin du rapport !
@+

voila le rapport de clean:
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 26/06/2008 a 22:43:05,68

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files
tentative de suppression de "C:\Program Files\Viewpoint\"

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:51:20, on 26/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/574/webolr/OCX/FlashAX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

@+

salut,

voici le rapport d'antivir.



5C80001080100000000969210607

Windows XP 5.1
IA32
WinAspi: -
ahead WinASPI: File 'C:\Program Files\Nero\Nero 7\Core\Wnaspi32.dll': Ver=2.0.1.74, size=164112 bytes, created 02/11/2004 12:54:32

NT-SPTI used
Nero Version: 7.0.1.2
Internal Version: 7, 0, 1, 2

Recorder: <HL-DT-ST DVD-RW GWA-4082N>Version: CL02 - HA 1 TA 0 - 7.0.1.2
Adapter driver: <IDE> HA 1
Drive buffer : 2048kB
Bus Type : default (0) -> ATAPI, detected: ?
CD-ROM: <HL-DT-ST DVD-RW GWA-4082N>Version: CL02 - HA 1 TA 0 - 7.0.1.2
Adapter driver: <IDE> HA 1

=== Scsi-Device-Map ===
DiskPeripheral : WDC WD600VE-00HDT0 atapi Port 0 ID 0 DMA: On
CdRomPeripheral : HL-DT-ST DVD-RW GWA-4082N atapi Port 1 ID 0 DMA: On

=== CDRom-Device-Map ===
HL-DT-ST DVD-RW GWA-4082N F: CDRom0
=======================

AutoRun : 1
Excluded drive IDs:
WriteBufferSize: 83886080 (0) Byte
ShowDrvBufStat : 0
BUFE : 0
Physical memory : 1015MB (1039788kB)
Free physical memory: 548MB (561316kB)
Memory in use : 46 %
Uncached PFiles: 0x0
Use Inquiry : 1
Global Bus Type: default (0)
Check supported media : Disabled (0)

13.1.2008
CD-ROM (ISO)
17:51:40 #1 Text 0 File Isodoc.cpp, Line 6411
Iso document burn settings
------------------------------------------
Determine maximum speed : FALSE
Simulate : FALSE
Write : TRUE
Finalize CD : FALSE
Multisession : TRUE
Multisession type: : Start multisession
Burning mode : DAO
Mode : 1
ISO Level : 1 (Max. of 11 = 8 + 3 char)
Character set : ISO 9660
Joliet : TRUE
Allow pathdepth more than 8 directories : FALSE
Allow more than 255 characters in path : FALSE
Write ISO9660 ;1 file extensions : TRUE

17:51:40 #2 Text 0 File Burncd.cpp, Line 3008
HL-DT-ST DVD-RW GWA-4082N
Protection contre les ruptures activés

17:51:40 #3 Text 0 File ThreadedTransfer.cpp, Line 525
ReadBuffer-Pipe got 81920KB of Memory

17:51:40 #4 Text 0 File Reader.cpp, Line 124
Reader running

17:51:40 #5 Text 0 File Writer.cpp, Line 113
Writer F: HL-DT-ST DVD-RW GWA-4082N running

17:51:40 #6 ISO9660GEN -11 File Geniso.cpp, Line 3312
First writeable address = 0 (0x00000000)

17:51:46 #7 Text 0 File Burncd.cpp, Line 3302
Turn on Disc-At-Once, using CD-R/RW media

17:51:46 #8 Text 0 File DlgWaitCD.cpp, Line 279
Last possible write address on media: 359847 ( 79:59.72)
Last address to be written: 96719 ( 21:31.44)

17:51:46 #9 Text 0 File DlgWaitCD.cpp, Line 291
Write in overburning mode: NO (enabled: CD)

17:51:46 #10 Text 0 File DlgWaitCD.cpp, Line 2578
Recorder: HL-DT-ST DVD-RW GWA-4082N

17:51:46 #11 Text 0 File DlgWaitCD.cpp, Line 458
>>> Protocol of DlgWaitCD activities: <<<
=========================================

17:51:46 #12 Text 0 File ThreadedTransferInterface.cpp, Line 847
Setup items (after recorder preparation)
0: TRM_DATA_MODE1 ()
2 indices, index0 (150) not provided
original disc pos #0 + 96720 (96720) = #96720/21:29.45
relocatable, disc pos for caching/writing not required/ required, no patch infos
-> TRM_DATA_MODE1, 2048, config 0, wanted index0 0 blocks, length 96720 blocks [F: HL-DT-ST DVD-RW GWA-4082N]
--------------------------------------------------------------

17:51:46 #13 Text 0 File ThreadedTransferInterface.cpp, Line 1059
Prepare recorder [F: HL-DT-ST DVD-RW GWA-4082N] for write in CUE-sheet-DAO
DAO infos:
==========
MCN: ""
TOCType: 0x00; Session Closed, disc not fixated
Tracks 1 to 1:
1: TRM_DATA_MODE1, 2048/0x00, FilePos 0 307200 198389760, ISRC ""
DAO layout:
===========
__Start_|____Track_|_Idx_|_CtrlAdr_|_RecDep__________
-150 | lead-in | 0 | 0x41 | 0x00
-150 | 1 | 0 | 0x41 | 0x00
0 | 1 | 1 | 0x41 | 0x00
96720 | lead-out | 1 | 0x41 | 0x00

17:51:46 #14 Text 0 File SCSIPassThrough.cpp, Line 36
SPTILockVolume - completed successfully for FCTL_LOCK_VOLUME

17:51:46 #15 Phase 24 File dlgbrnst.cpp, Line 1725
Caching of files started

17:51:46 #16 Text 0 File Burncd.cpp, Line 4132
Cache writing successful.

17:51:46 #17 Phase 25 File dlgbrnst.cpp, Line 1725
Caching of files completed

17:51:46 #18 Phase 36 File dlgbrnst.cpp, Line 1725
Burn process started at 10x (1 500 Ko/s)

17:51:46 #19 Text 0 File ThreadedTransferInterface.cpp, Line 2685
Verifying disc position of item 0 (relocatable, disc pos, no patch infos, orig at #0): write at #0

17:51:46 #20 Text 0 File MMC.cpp, Line 16934
StartDAO : CD-Text - Off

17:51:46 #21 Text 0 File MMC.cpp, Line 21611
Set BUFE: Buffer underrun protection -> ON

17:51:46 #22 Text 0 File MMC.cpp, Line 17165
CueData, Len=32
41 00 00 14 00 00 00 00
41 01 00 10 00 00 00 00
41 01 01 10 00 00 02 00
41 aa 01 14 00 15 1f 2d

17:51:55 #23 Text 0 File Cdrdrv.cpp, Line 1197
17:51:55.625 - F: HL-DT-ST DVD-RW GWA-4082N : Queue again later

17:54:17 #24 SPTI -1093 File SCSIPassThrough.cpp, Line 323
F: CdRom0: SCSIStatus(x02) WinError(0) NeroError(-1093)
Sense Key: 0x03 (KEY_MEDIUM_ERROR)
Sense Code: 0x02
Sense Qual: 0x00
CDB Data: 0x2A 00 00 01 43 20 00 00 20 00 00 00
Sense Area: 0x70 00 03 00 00 00 00 10 3C 30 00 90 02
Buffer x05540000: Len x10000
0x00 05 1B 64 8A 52 B3 1C C8 CA 0A 36 79 EB 4E 45
0xD8 74 71 79 AE C9 84 69 09 E3 9C 11 F8 52 4C ED
0xB1 DA 72 19 F7 15 55 CE 00 F7 A9 B3 B8 24 21 92

17:54:17 #25 CDR -1093 File Writer.cpp, Line 302
No seek complete
F: HL-DT-ST DVD-RW GWA-4082N

17:54:17 #26 Text 0 File ThreadedTransfer.cpp, Line 228
all writers idle, stopping conversion

17:54:18 #27 SPTI -1093 File SCSIPassThrough.cpp, Line 323
F: CdRom0: SCSIStatus(x02) WinError(0) NeroError(-1093)
Sense Key: 0x03 (KEY_MEDIUM_ERROR)
Sense Code: 0x02
Sense Qual: 0x00
CDB Data: 0x35 02 00 00 00 00 00 00 00 00 00 00
Sense Area: 0x71 00 03 00 00 00 00 10 3C 30 00 90 02

17:54:18 #28 CDR -1093 File WriterStatus.cpp, Line 167
No seek complete
F: HL-DT-ST DVD-RW GWA-4082N

17:54:18 #29 TRANSFER -24 File WriterStatus.cpp, Line 167
Could not perform end of Disc-at-once

17:54:18 #30 Phase 38 File dlgbrnst.cpp, Line 1725
Burn process failed at 10x (1 500 Ko/s)


Existing drivers:

Et voila,


Avira AntiVir Personal
Report file date: vendredi 27 juin 2008 13:28

Scanning for 1165085 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode
Username: Mimilolo
Computer name: MILAU

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58
ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 19:12:34
ANTIVIR3.VDF : 7.0.3.68 57856 Bytes 25/03/2008 08:27:50
Engineversion : 8.1.0.28
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22
AESCRIPT.DLL : 8.1.0.19 229754 Bytes 07/04/2008 15:34:46
AESCN.DLL : 8.1.0.12 115060 Bytes 07/04/2008 15:34:46
AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:46
AEPACK.DLL : 8.1.1.0 364918 Bytes 18/03/2008 11:20:44
AEOFFICE.DLL : 8.1.0.15 192889 Bytes 07/04/2008 15:34:46
AEHEUR.DLL : 8.1.0.15 1147253 Bytes 07/04/2008 15:34:46
AEHELP.DLL : 8.1.0.11 115061 Bytes 07/04/2008 15:34:44
AEGEN.DLL : 8.1.0.15 299379 Bytes 07/04/2008 15:34:44
AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:44
AECORE.DLL : 8.1.0.25 168309 Bytes 08/04/2008 09:58:34
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: vendredi 27 juin 2008 13:28

Starting search for hidden objects.
The driver could not be initialized.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '35' files ).


Starting the file scan:

Begin scan in 'C:\' <BOOT>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\upload_moi_MILAU.tar.gz
[0] Archive type: GZ
--> upload_moi.tar
[1] Archive type: TAR (tape archiver)
--> qoobox/Quarantine/C/Program Files/rhc9a7j0ecf1/rhc9a7j0ecf1.exe.vir
[DETECTION] Contains suspicious code HEUR/Malware
--> WINDOWS/System32/lphcca7j0ecf1.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[NOTE] The file was moved to '48d0cf8f.qua'!
C:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier\clean\clean.cmd
[DETECTION] Contains suspicious code HEUR/HTML.Malware
[NOTE] The fund was classified as suspicious.
[NOTE] The file was moved to '48c9d128.qua'!
C:\Documents and Settings\Mimilolo\Local Settings\Application Data\Mozilla\Firefox\Profiles\awcnax74.default\Cache\3CD27B45d01
[0] Archive type: ZIP
--> clean/clean.cmd
[DETECTION] Contains suspicious code HEUR/HTML.Malware
[NOTE] The file was moved to '48a8d112.qua'!
C:\QooBox\Quarantine\C\Program Files\rhc9a7j0ecf1\rhc9a7j0ecf1.exe.vir
[DETECTION] Contains suspicious code HEUR/Malware
[NOTE] The fund was classified as suspicious.
[NOTE] The file was moved to '48c7d9de.qua'!
C:\SCATLAWS\3DYAMS2\3DYams2.exe
[DETECTION] Contains suspicious code HEUR/Malware
[NOTE] The file was moved to '48bdd9be.qua'!
C:\WINDOWS\system32\lphcca7j0ecf1.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[NOTE] The file was moved to '48cce6be.qua'!
Begin scan in 'D:\' <BACKUP>
Begin scan in 'E:\' <RECOVER>


End of the scan: vendredi 27 juin 2008 16:00
Used time: 2:32:16 min

The scan has been done completely.

6350 Scanning directories
361594 Files were scanned
2 viruses and/or unwanted programs were found
5 Files were classified as suspicious:
0 files were deleted
0 files were repaired
6 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
361592 Files not concerned
8123 Archives were scanned

@+

rapport Hijack,
Micro HijackThis v2.0.2
Scan saved at 19:17:07, on 27/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/574/webolr/OCX/FlashAX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Et voila !!!
Il est long ce rapport.

p version v1.4 - http://www.malekal.com
excute le 27/06/2008 à 20:29:16,17


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->27/06/2008 20:29:13
C:\WINDOWS\prefetch\AVWSC.EXE-347FCF75.pf -->27/06/2008 20:27:17
C:\WINDOWS\prefetch\CATCHME.EXE-2F28AC82.pf -->27/06/2008 20:22:35
C:\WINDOWS\prefetch\LISTDLLS.EXE-2D4B8444.pf -->27/06/2008 20:22:23
C:\WINDOWS\prefetch\GREP.EXE-1CA598B8.pf -->27/06/2008 20:22:23
C:\WINDOWS\prefetch\PSLIST.EXE-1018FA39.pf -->27/06/2008 20:22:22
C:\WINDOWS\prefetch\FPORT.EXE-1CC417B5.pf -->27/06/2008 20:22:21
C:\WINDOWS\prefetch\DUMPHIVE.EXE-1C7E8824.pf -->27/06/2008 20:22:20
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->27/06/2008 20:22:16
C:\WINDOWS\prefetch\GZIP.EXE-399738AE.pf -->27/06/2008 20:22:04

C:\WINDOWS\System32\drivers\mbamcatchme.sys -->19/06/2008 17:48:04
C:\WINDOWS\System32\drivers\mbam.sys -->19/06/2008 17:47:58
C:\WINDOWS\System32\drivers\bthport.sys -->14/06/2008 19:59:52
C:\WINDOWS\System32\drivers\rmcast.sys -->08/05/2008 14:28:49
C:\WINDOWS\System32\drivers\avipbb.sys -->04/03/2008 13:28:54
C:\WINDOWS\System32\drivers\avgntdd.sys -->21/01/2008 18:12:58
C:\WINDOWS\System32\drivers\avgntmgr.sys -->21/01/2008 18:11:30

C:\WINDOWS\System32\CONFIG.NT -->27/06/2008 19:26:47
C:\WINDOWS\System32\wpa.dbl -->27/06/2008 18:57:14
C:\WINDOWS\System32\blphcca7j0ecf1.scr -->26/06/2008 17:17:04
C:\WINDOWS\System32\MRT.exe -->30/05/2008 01:35:11
C:\WINDOWS\System32\quartz.dll -->07/05/2008 07:15:36
C:\WINDOWS\System32\mshtml.dll -->23/04/2008 22:16:42
C:\WINDOWS\System32\wininet.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\webcheck.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\urlmon.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\url.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\pngfilt.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\occache.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\mstime.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\msrating.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\mshtmled.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\msfeedsbs.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\msfeeds.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\jsproxy.dll -->23/04/2008 06:16:40
C:\WINDOWS\System32\inetcpl.cpl -->23/04/2008 06:16:40
C:\WINDOWS\System32\iertutil.dll -->23/04/2008 06:16:39
C:\WINDOWS\System32\iernonce.dll -->23/04/2008 06:16:39
C:\WINDOWS\System32\ieframe.dll -->23/04/2008 06:16:39
C:\WINDOWS\System32\iedkcs32.dll -->23/04/2008 06:16:39
C:\WINDOWS\System32\ieapfltr.dll -->23/04/2008 06:16:39
C:\WINDOWS\System32\ieaksie.dll -->23/04/2008 06:16:39

C:\WINDOWS\WindowsUpdate.log -->27/06/2008 19:27:17
C:\WINDOWS\0.log -->27/06/2008 18:57:15
C:\WINDOWS\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt -->27/06/2008 18:57:04
C:\WINDOWS\wiadebug.log -->27/06/2008 18:57:02
C:\WINDOWS\wiaservc.log -->27/06/2008 18:57:00
C:\WINDOWS\bootstat.dat -->27/06/2008 18:56:44
C:\WINDOWS\ntbtlog.txt -->27/06/2008 13:17:23
C:\WINDOWS\SchedLgU.Txt -->27/06/2008 13:15:59
C:\WINDOWS\setupact.log -->26/06/2008 22:45:00
C:\WINDOWS\win.ini -->26/06/2008 22:33:38
C:\WINDOWS\system.ini -->26/06/2008 22:33:38
C:\WINDOWS\setupapi.log -->26/06/2008 18:53:28
C:\WINDOWS\NeroDigital.ini -->24/06/2008 20:25:48
C:\WINDOWS\mozver.dat -->24/06/2008 13:22:15
C:\WINDOWS\tsoc.log -->20/06/2008 21:26:27

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1328
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x44080000 0xd0000 7.00.6000.16674 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16674 C:\WINDOWS\system32\iertutil.dll
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
0x44360000 0x5cd000 7.00.6000.16674 C:\WINDOWS\system32\ieframe.dll
0x44160000 0x127000 7.00.6000.16674 C:\WINDOWS\system32\urlmon.dll
0x442b0000 0x3c000 7.00.6000.16674 C:\WINDOWS\system32\webcheck.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
0x01140000 0x2b000 C:\Program Files\WinRAR\rarext.dll
0x10000000 0x65000 1.00.0000.0878 C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat Elements\ContextMenu.dll
0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
0x01170000 0x20000 1.00.0000.0878 C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat Elements\ContextMenu.fra
0x01190000 0x14000 2.00.0000.0005 C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL
0x02420000 0x56000 7.10.3052.0004 C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCP71.dll
0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL
0x011c0000 0x13000 7.00.0000.0011 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
0x011e0000 0x8000 1.00.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x00d40000 0xb000 6.00.0000.0878 C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
0x02be0000 0x171000 4.05.0168.0000 C:\Program Files\Share_Accelerator_MM\tbShar.dll
0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL
0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll
0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\system32\wshFR.DLL
0x36d30000 0x19000 11.00.5510.0000 C:\PROGRA~1\MICROS~2\OFFICE11\MCPS.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 680
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x011e0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll


Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 00F6-CCA7

Répertoire de C:\WINDOWS\system32

05/08/2004 14:00 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 10 213 793 792 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 00F6-CCA7

Répertoire de C:\WINDOWS\Downloaded Program Files

17/08/2006 12:48 <REP> .
17/08/2006 12:48 <REP> ..
26/01/2006 23:06 65 desktop.ini
06/09/2004 11:47 782 FlashAX.inf
26/08/2005 16:57 495 LegitCheckControl.inf
20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd
4 fichier(s) 2 504 octets

Total des fichiers listés :
4 fichier(s) 2 504 octets
2 Rép(s) 10 213 789 696 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-27 20:22:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-27 20:29:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
160 - fts.exe
224 - realplay.exe
240 - RTHDCPL.EXE
408 - NMBgMonitor.exe
432 - GoogleToolbarNo
528 - ctfmon.exe
636 - hpqtra08.exe
656 - csrss.exe
680 - winlogon.exe
724 - services.exe
736 - lsass.exe
836 - svchost.exe
880 - svchost.exe
940 - svchost.exe
968 - cmd.exe
980 - svchost.exe
1040 - svchost.exe
1176 - svchost.exe
1328 - explorer.exe
1404 - avguard.exe
1520 - ashServ.exe
2036 - SynTPEnh.exe
2368 - wmpnetwk.exe
2836 - hpqste08.exe
2856 - firefox.exe
3744 - alg.exe

Total number of processes = 27
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806CE000 - \WINDOWS\system32\hal.dll
F7A87000 - \WINDOWS\system32\KDCOM.DLL
F7997000 - \WINDOWS\system32\BOOTVID.dll
F7457000 - ACPI.sys
F7A89000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F7446000 - pci.sys
F7587000 - isapnp.sys
F7597000 - ohci1394.sys
F75A7000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F799B000 - compbatt.sys
F799F000 - \WINDOWS\system32\DRIVERS\BATTC.SYS
F7B4F000 - pciide.sys
F7807000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F7A8B000 - intelide.sys
F7428000 - pcmcia.sys
F75B7000 - MountMgr.sys
F7409000 - ftdisk.sys
F79A3000 - ACPIEC.sys
F7B50000 - \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
F780F000 - PartMgr.sys
F75C7000 - VolSnap.sys
F73F1000 - atapi.sys
F75D7000 - disk.sys
F75E7000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F73D1000 - fltMgr.sys
F73BF000 - sr.sys
F73A8000 - KSecDD.sys
F731B000 - Ntfs.sys
F72EE000 - NDIS.sys
F72D3000 - Mup.sys
F7747000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F7A73000 - \SystemRoot\system32\DRIVERS\CmBatt.sys
F6CCF000 - \SystemRoot\system32\DRIVERS\ialmnt5.sys
F6CBB000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F6C96000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
F78C7000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F6C73000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F78CF000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F7757000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F6C50000 - \SystemRoot\system32\DRIVERS\W33ND.SYS
F7767000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F78D7000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F6C21000 - \SystemRoot\system32\DRIVERS\SynTP.sys
F7AA9000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F78DF000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F7777000 - \SystemRoot\system32\DRIVERS\imapi.sys
F7C92000 - \SystemRoot\System32\Drivers\ElbyDelay.sys
F7787000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F7797000 - \SystemRoot\system32\DRIVERS\redbook.sys
F6BFE000 - \SystemRoot\system32\DRIVERS\ks.sys
F7C93000 - \SystemRoot\system32\DRIVERS\audstub.sys
F77A7000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7A7F000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F6BE7000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F77B7000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F77C7000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F78E7000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F6BD6000 - \SystemRoot\system32\DRIVERS\psched.sys
F77D7000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F78EF000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F78F7000 - \SystemRoot\system32\DRIVERS\raspti.sys
F6BBD000 - \SystemRoot\system32\DRIVERS\PPPoEWin.SYS
F77E7000 - \SystemRoot\system32\DRIVERS\termdd.sys
F7AAB000 - \SystemRoot\system32\DRIVERS\swenum.sys
F6B64000 - \SystemRoot\system32\DRIVERS\update.sys
F72A7000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F77F7000 - \SystemRoot\System32\Drivers\NDProxy.SYS
AAB77000 - \SystemRoot\system32\drivers\RtkHDAud.sys
AAB53000 - \SystemRoot\system32\drivers\portcls.sys
F7627000 - \SystemRoot\system32\drivers\drmk.sys
AAB2A000 - \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
AA91A000 - \SystemRoot\system32\DRIVERS\HSF_DPV.sys
AA86D000 - \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
F790F000 - \SystemRoot\System32\Drivers\Modem.SYS
F7647000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7ABB000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7BA6000 - \SystemRoot\System32\Drivers\Null.SYS
F7ABD000 - \SystemRoot\System32\Drivers\Beep.SYS
F7937000 - \SystemRoot\System32\drivers\vga.sys
F7ABF000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7AC1000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F793F000 - \SystemRoot\System32\Drivers\Msfs.SYS
F7947000 - \SystemRoot\System32\Drivers\Npfs.SYS
F6DE4000 - \SystemRoot\system32\DRIVERS\rasacd.sys
AA7D8000 - \SystemRoot\system32\DRIVERS\ipsec.sys
AA780000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F7657000 - \SystemRoot\System32\Drivers\aswTdi.SYS
AA758000 - \SystemRoot\system32\DRIVERS\netbt.sys
AA736000 - \SystemRoot\System32\drivers\afd.sys
F794F000 - \SystemRoot\System32\Drivers\StarOpen.SYS
F795F000 - \SystemRoot\system32\DRIVERS\ssmdrv.sys
AA6FB000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F7667000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F7677000 - \SystemRoot\System32\Drivers\Fips.SYS
F7687000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F6DD0000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F7697000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F796F000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
F7A27000 - \SystemRoot\system32\DRIVERS\mouhid.sys
AA680000 - \SystemRoot\system32\DRIVERS\avipbb.sys
F7AC7000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
AA5DD000 - \SystemRoot\System32\Drivers\aswSP.SYS
F798F000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
A9FD1000 - \SystemRoot\System32\Drivers\Fastfat.SYS
A9FB9000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7AFF000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
AA5BD000 - \SystemRoot\System32\drivers\Dxapi.sys
AA44E000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F7C5F000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9E3000 - \SystemRoot\System32\ialmdnt5.dll
BF9D5000 - \SystemRoot\System32\ialmrnt5.dll
BFA05000 - \SystemRoot\System32\ialmdev5.DLL
BFA36000 - \SystemRoot\System32\ialmdd5.DLL
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
AA41E000 - \SystemRoot\system32\DRIVERS\aswFsBlk.sys
A9F69000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
A9E63000 - \SystemRoot\System32\Drivers\aswMon2.SYS
A9D36000 - \SystemRoot\system32\drivers\wdmaud.sys
F6AC3000 - \SystemRoot\system32\drivers\sysaudio.sys
A9D16000 - \SystemRoot\System32\Drivers\Cdfs.SYS
A980A000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
F7AAD000 - \SystemRoot\System32\Drivers\ASCTRM.SYS
A98EA000 - \SystemRoot\System32\Drivers\ElbyCDIO.sys
A9779000 - \SystemRoot\System32\Drivers\HTTP.sys
A9D67000 - \SystemRoot\system32\DRIVERS\mdmxsdk.sys
A96FF000 - \SystemRoot\system32\DRIVERS\srv.sys
A9A56000 - \SystemRoot\system32\DRIVERS\secdrv.sys
A9444000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
A92E8000 - \SystemRoot\System32\Drivers\aswRdr.SYS
AA0F8000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
A967B000 - \SystemRoot\system32\DRIVERS\usbscan.sys
AA0E0000 - \SystemRoot\system32\DRIVERS\usbprint.sys
AA0E8000 - \SystemRoot\system32\DRIVERS\HPZius12.sys
A9836000 - \SystemRoot\system32\DRIVERS\HPZid412.sys
A9E0F000 - \SystemRoot\system32\DRIVERS\HPZipr12.sys
F7C56000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 139

Liste des programmes installes

1500_Help
1500Trb
Adobe Creative Suite
Adobe Flash Player ActiveX
Adobe Reader 7.0 - Français
Adobe SVG Viewer 3.0
AiO_Scan
AiOSoftware
AntivirXP08
Archiveur WinRAR
Avira AntiVir Personal – Free Antivirus
Browser Optimizer Superiorads
BufferChm
CloneDVD2
Correctif pour Lecteur Windows Media 11 (KB939683)
Correctif pour Windows Internet Explorer 7 (KB947864)
Correctif pour Windows XP (KB935448)
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB886185
Correctif Windows XP - KB887742
Correctif Windows XP - KB887797
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890859
Correctif Windows XP - KB891781
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
Dcads Advanced Toolbar
Dcads Games Collection
Destinations
DeviceManagementQFolder
DivX Player
DivX Pro
DocProc
eMule
eSupportQFolder
Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP
Fax
Friendly PPPoE v3.0.0.26
Google Toolbar for Internet Explorer
HDAUDIO Soft Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Image Zone Express
HP Imaging Device Functions 5.3
HP PSC & OfficeJet 5.3.B
HP Software Update
HP Solution Center & Imaging Support Tools 5.3
HPProductAssistant
Informations sur votre PC
Intel(R) Graphics Media Accelerator Driver for Mobile
IsoBuster 1.9
J2SE Runtime Environment 5.0 Update 4
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Joyland Casino
Learn2 Player (Uninstall Only)
Lecteur Windows Media 11
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
Mise à jour de sécurité pour Windows XP (KB890046)
Mise à jour de sécurité pour Windows XP (KB893066)
Mise à jour de sécurité pour Windows XP (KB893756)
Mise à jour de sécurité pour Windows XP (KB896358)
Mise à jour de sécurité pour Windows XP (KB896422)
Mise à jour de sécurité pour Windows XP (KB896423)
Mise à jour de sécurité pour Windows XP (KB896424)
Mise à jour de sécurité pour Windows XP (KB896428)
Mise à jour de sécurité pour Windows XP (KB899587)
Mise à jour de sécurité pour Windows XP (KB899591)
Mise à jour de sécurité pour Windows XP (KB900725)
Mise à jour de sécurité pour Windows XP (KB901017)
Mise à jour de sécurité pour Windows XP (KB901214)
Mise à jour de sécurité pour Windows XP (KB902400)
Mise à jour de sécurité pour Windows XP (KB904706)
Mise à jour de sécurité pour Windows XP (KB905414)
Mise à jour de sécurité pour Windows XP (KB905749)
Mise à jour de sécurité pour Windows XP (KB905915)
Mise à jour de sécurité pour Windows XP (KB908519)
Mise à jour de sécurité pour Windows XP (KB911280)
Mise à jour de sécurité pour Windows XP (KB911562)
Mise à jour de sécurité pour Windows XP (KB911567)
Mise à jour de sécurité pour Windows XP (KB911927)
Mise à jour de sécurité pour Windows XP (KB912919)
Mise à jour de sécurité pour Windows XP (KB913446)
Mise à jour de sécurité pour Windows XP (KB913580)
Mise à jour de sécurité pour Windows XP (KB914388)
Mise à jour de sécurité pour Windows XP (KB914389)
Mise à jour de sécurité pour Windows XP (KB916281)
Mise à jour de sécurité pour Windows XP (KB917159)
Mise à jour de sécurité pour Windows XP (KB917344)
Mise à jour de sécurité pour Windows XP (KB917422)
Mise à jour de sécurité pour Windows XP (KB917953)
Mise à jour de sécurité pour Windows XP (KB918118)
Mise à jour de sécurité pour Windows XP (KB918439)
Mise à jour de sécurité pour Windows XP (KB918899)
Mise à jour de sécurité pour Windows XP (KB919007)
Mise à jour de sécurité pour Windows XP (KB920213)
Mise à jour de sécurité pour Windows XP (KB920214)
Mise à jour de sécurité pour Windows XP (KB920670)
Mise à jour de sécurité pour Windows XP (KB920683)
Mise à jour de sécurité pour Windows XP (KB920685)
Mise à jour de sécurité pour Windows XP (KB921398)
Mise à jour de sécurité pour Windows XP (KB921503)
Mise à jour de sécurité pour Windows XP (KB921883)
Mise à jour de sécurité pour Windows XP (KB922616)
Mise à jour de sécurité pour Windows XP (KB922760)
Mise à jour de sécurité pour Windows XP (KB922819)
Mise à jour de sécurité pour Windows XP (KB923191)
Mise à jour de sécurité pour Windows XP (KB923414)
Mise à jour de sécurité pour Windows XP (KB923689)
Mise à jour de sécurité pour Windows XP (KB923694)
Mise à jour de sécurité pour Windows XP (KB923980)
Mise à jour de sécurité pour Windows XP (KB924191)
Mise à jour de sécurité pour Windows XP (KB924270)
Mise à jour de sécurité pour Windows XP (KB924496)
Mise à jour de sécurité pour Windows XP (KB924667)
Mise à jour de sécurité pour Windows XP (KB925454)
Mise à jour de sécurité pour Windows XP (KB925486)
Mise à jour de sécurité pour Windows XP (KB925902)
Mise à jour de sécurité pour Windows XP (KB926255)
Mise à jour de sécurité pour Windows XP (KB926436)
Mise à jour de sécurité pour Windows XP (KB927779)
Mise à jour de sécurité pour Windows XP (KB927802)
Mise à jour de sécurité pour Windows XP (KB928255)
Mise à jour de sécurité pour Windows XP (KB928843)
Mise à jour de sécurité pour Windows XP (KB929123)
Mise à jour de sécurité pour Windows XP (KB930178)
Mise à jour de sécurité pour Windows XP (KB931261)
Mise à jour de sécurité pour Windows XP (KB931784)
Mise à jour de sécurité pour Windows XP (KB932168)
Mise à jour de sécurité pour Windows XP (KB933729)
Mise à jour de sécurité pour Windows XP (KB935839)
Mise à jour de sécurité pour Windows XP (KB935840)
Mise à jour de sécurité pour Windows XP (KB936021)
Mise à jour de sécurité pour Windows XP (KB938829)
Mise à jour de sécurité pour Windows XP (KB941202)
Mise à jour de sécurité pour Windows XP (KB941568)
Mise à jour de sécurité pour Windows XP (KB941569)
Mise à jour de sécurité pour Windows XP (KB941644)
Mise à jour de sécurité pour Windows XP (KB941693)
Mise à jour de sécurité pour Windows XP (KB943055)
Mise à jour de sécurité pour Windows XP (KB943460)
Mise à jour de sécurité pour Windows XP (KB943485)
Mise à jour de sécurité pour Windows XP (KB944653)
Mise à jour de sécurité pour Windows XP (KB945553)
Mise à jour de sécurité pour Windows XP (KB946026)
Mise à jour de sécurité pour Windows XP (KB948590)
Mise à jour de sécurité pour Windows XP (KB948881)
Mise à jour de sécurité pour Windows XP (KB950749)
Mise à jour de sécurité pour Windows XP (KB950760)
Mise à jour de sécurité pour Windows XP (KB950762)
Mise à jour de sécurité pour Windows XP (KB951376-v2)
Mise à jour de sécurité pour Windows XP (KB951376)
Mise à jour de sécurité pour Windows XP (KB951698)
Mise à jour pour Windows XP (KB894391)
Mise à jour pour Windows XP (KB900485)
Mise à jour pour Windows XP (KB908531)
Mise à jour pour Windows XP (KB910437)
Mise à jour pour Windows XP (KB916595)
Mise à jour pour Windows XP (KB920872)
Mise à jour pour Windows XP (KB922582)
Mise à jour pour Windows XP (KB927891)
Mise à jour pour Windows XP (KB929338)
Mise à jour pour Windows XP (KB930916)
Mise à jour pour Windows XP (KB931836)
Mise à jour pour Windows XP (KB932823-v3)
Mise à jour pour Windows XP (KB933360)
Mise à jour pour Windows XP (KB936357)
Mise à jour pour Windows XP (KB938828)
Mise à jour pour Windows XP (KB942763)
Monaco Gold Casino
Mozilla Firefox (2.0.0.14)
MSN Messenger 7.5
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Nero 7 Demo
NewCopy
PowerDVD
PowerProducer
ProductContext
QuickTime
Readme
RealPlayer Basic
REALTEK Gigabit and Fast Ethernet NIC Driver
Realtek High Definition Audio Driver
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
Samsung PC Studio 3
Samsung PC Studio 3 USB Driver Installer
Samsung Samples Installer
Scan
ScannerCopy
Search Assistant Dcads
Search Suggestion Tool Dcads
Share Accelerator MM Toolbar
SimCity 4
SolutionCenter
Status
Synaptics Pointing Device Driver
TrayApp
TuneUp Utilities 2006
Unload
Utilitaire de sauvegarde Windows
Viewpoint Media Player
WebFldrs XP
WebReg
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin



Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 00F6-CCA7

Répertoire de C:\Program Files

27/06/2008 13:05 <REP> .
27/06/2008 13:05 <REP> ..
26/06/2006 22:07 <REP> 00000000
20/12/2007 19:30 <REP> ACAD2000
27/01/2006 20:26 <REP> Adobe
28/01/2006 11:14 <REP> Alwil Software
31/01/2006 20:47 <REP> Anuman Interactive
23/04/2003 19:37 <REP> AutoDesk AutoCad 2000 + Serial + Cd Key + Auto Code
27/06/2008 13:05 <REP> Avira
04/02/2006 14:21 <REP> Black Isle
04/11/2007 18:36 <REP> Boonty
01/08/2002 15:49 254 020 camKernel.dll
26/04/2006 20:23 <REP> CAMTOOLS
06/04/2008 19:37 <REP> Casino Challenge
26/04/2006 20:23 <REP> CIEL
06/04/2008 19:37 <REP> Ciel e-Commerce
30/05/2006 17:00 135 CielVideo.ini
16/11/2005 12:25 <REP> CONEXANT
26/04/2006 20:23 113 CRUN.BIN
16/11/2005 13:51 <REP> CyberLink
29/11/2007 22:39 <REP> Dcads Games Collection
06/04/2008 19:37 <REP> DivX
27/01/2006 21:46 <REP> Elaborate Bytes
16/06/2008 23:35 <REP> eMule
01/04/2006 09:43 4 677 596 eMule0.47a-Installer.exe
29/03/2006 19:16 <REP> fdjeux
26/06/2008 19:09 <REP> Fichiers communs
01/04/2006 12:44 <REP> Friendly Technologies
06/04/2008 19:45 <REP> Google
25/02/2006 20:14 <REP> Hewlett-Packard
16/11/2005 12:43 <REP> HighMAT CD Writing Wizard
16/11/2005 13:51 <REP> Home Cinema
25/02/2006 20:15 <REP> HP
06/04/2008 19:36 <REP> IKEA HomePlanner
16/11/2005 12:16 <REP> Intel
12/06/2008 03:03 <REP> Internet Explorer
23/03/2008 19:47 <REP> Java
25/05/2008 19:29 <REP> Joyland Casino
17/11/2005 10:58 <REP> Learn2.com
15/06/2008 17:46 <REP> LimeWire
26/06/2008 18:39 <REP> Malwarebytes' Anti-Malware
30/05/2008 21:06 <REP> Maxis
16/11/2005 12:15 <REP> Messenger
05/11/2007 19:40 <REP> Micro Application
16/11/2005 11:55 <REP> microsoft frontpage
27/01/2006 19:59 <REP> Microsoft Office
27/01/2006 19:59 <REP> Microsoft.NET
16/11/2005 11:52 <REP> Movie Maker
27/06/2008 19:07 <REP> Mozilla Firefox
06/04/2008 19:40 <REP> MSN
16/11/2005 11:51 <REP> MSN Gaming Zone
18/11/2005 10:03 <REP> MSN Messenger
27/01/2006 20:14 <REP> Nero
16/11/2005 11:52 <REP> NetMeeting
16/11/2005 11:51 <REP> Online Services
13/06/2007 21:44 <REP> Outlook Express
17/11/2005 10:58 <REP> QuickTime
17/11/2005 10:57 <REP> Real
16/11/2005 12:19 <REP> Realtek
26/06/2006 22:07 <REP> REDIST
30/05/2006 17:00 516 reseau.net
12/06/2008 13:39 <REP> Samsung
16/11/2005 11:53 <REP> Services en ligne
26/04/2006 20:23 90 SETUP.LOG
29/05/2008 19:17 <REP> Share_Accelerator_MM
27/01/2006 21:51 <REP> Smart Projects
13/04/2008 18:04 <REP> splendido_fr
16/11/2005 12:26 <REP> Synaptics
26/06/2008 10:55 <REP> Trend Micro
27/01/2006 21:55 <REP> TuneUp Utilities 2006
26/04/2006 20:32 4 608 UTILISAT.CDX
30/05/2006 17:00 630 UTILISAT.DBF
06/04/2008 19:37 <REP> Wanadoo
28/12/2006 21:06 <REP> Windows Media Connect 2
06/04/2008 19:37 <REP> Windows Media Player
16/11/2005 11:51 <REP> Windows NT
27/01/2006 19:59 <REP> WinRAR
30/05/2006 16:41 47 264 WKPRN.vds
30/05/2006 16:41 7 488 WKPRO.vds
30/05/2006 16:41 376 896 WKRES.vds
16/11/2005 11:55 <REP> xerox
29/05/2008 19:20 <REP> Zapu
11 fichier(s) 5 369 356 octets
71 Rép(s) 10 193 809 408 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 00F6-CCA7

Répertoire de C:\Program Files\fichiers communs

26/06/2008 19:09 <REP> .
26/06/2008 19:09 <REP> ..
06/04/2008 19:37 <REP> Adobe
27/01/2006 20:27 <REP> Adobe Systems Shared
27/01/2006 20:16 <REP> Ahead
06/04/2008 19:37 <REP> AOL
27/01/2006 19:59 <REP> DESIGNER
28/01/2006 08:59 278 528 FDEUnInstaller.exe
01/04/2006 12:44 <REP> FTL Shared
25/02/2006 20:12 <REP> Hewlett-Packard
25/02/2006 20:15 <REP> HP
16/11/2005 12:25 <REP> InstallShield
18/11/2005 10:01 <REP> Java
29/11/2007 23:48 <REP> Microsoft Shared
16/11/2005 11:52 <REP> MSSoap
17/11/2005 10:57 <REP> Nullsoft
17/11/2005 10:57 <REP> Real
16/11/2005 11:52 <REP> Services
16/11/2005 12:46 <REP> SpeechEngines
13/06/2007 21:44 <REP> System
1 fichier(s) 278 528 octets
19 Rép(s) 10 193 809 408 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 00F6-CCA7

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

27/01/2006 19:59 <REP> .
27/01/2006 19:59 <REP> ..
27/01/2006 19:59 <REP> 1033
27/01/2006 19:59 <REP> 1036
11/07/2003 11:15 1 292 872 MSONSEXT.DLL
15/07/2003 07:52 35 896 MSOSV.DLL
03/06/1999 13:09 122 937 MSOWS409.DLL
07/03/2001 08:00 127 033 MSOWS40c.DLL
11/07/2003 03:25 80 448 PKMWS.DLL
5 fichier(s) 1 659 186 octets
4 Rép(s) 10 193 805 312 octets libres




c:\Documents and Settings\Mimilolo\Application Data\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
c:\Documents and Settings\Mimilolo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
c:\Documents and Settings\Mimilolo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
c:\Documents and Settings\Mimilolo\Bureau\bgoldpak.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Mimilolo\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier\clean\gzip.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier\clean\LFiles.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier\clean\pskill.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier\clean\tar.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avadmin.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avcenter.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avconfig.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avgnt.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avguard.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avnotify.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avscan.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\avwsc.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\guardgui.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\imp64b.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\licmgr.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\preupd.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\sched.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\setup.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\update.exe
c:\Documents and Settings\Mimilolo\Bureau\Nouveau dossier (2)\basic\wsctool.exe
c:\Documents and Settings\All Users\Application Data\microgaming\cache\a\advancedslots1_temp.37e91badb56f49775900493796886528.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\a\advancedslots1_temp.56257dd6162711fd045b980df60e3e25.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\a\advancedslots1_temp.8a06ca9368d87091bc18256214f0ffe1.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\a\advancedslots1xxx_temp.31b4026f06bf6a58dac069b91ce9f87e.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\a\advancedslots1xxx_temp.5e88daf7f878d5efd2174cb92d6c65e0.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\b\bjghighstreakautoplayplugin.daa7cf372053cea211edcbea65d22b12.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\b\bjghighstreakplugin.3e93030461895e6c47198d045c8d1cf9.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\b\bjghighstreakstatsplugin.145ee00ec8a028833dd329dab350af61.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\b\bjghighstreakstrategylogic1.191efcf9140c2fe6e0f5d9a976a4dc62.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\b\bjghighstreakstrategyui1.57392ae0d395ad2b922b909eeea4d57f.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\b\bjghighstreakxxx.b4ec12e8f6a82be74843d2bd8895d089.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\c\complexpickxofybonus_temp.08605981adfd307c6b4a171bff0fc06e.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\g\gamble2_temp.26f9c8c015d827f52f79be90c9c65d15.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\m\menucore.a7e49e2acd1f78ab2ea99157de3f63cc.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\m\menucore.fb9657b6417a76d3399bd4e877e28a97.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\m\mptadvancedslots.039a84427e76ab4e1715f80765a76305.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\m\mptleaderboard.91fac472d1ff352976950258719d35a2.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\m\mpvslotxxx.e5675e7198cee47ae84db3a4020d9441.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\s\simplepickxofybonus_temp.72ea7bbc511b024cb0eafd21daabe862.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\s\simplepickxofybonus_temp.ccad7e5a940d5494ce317984dbb504e2.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\s\simplepickxofychoicebonus.9167e61332ddecec88b6ba8808c2cf26.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\s\simplepickxofyskillbonus.232275c0370e638a0d86e6eb4412129e.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\s\simplepickxofyskillbonus.9217a2b384f498835fd4199838199dc2.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\t\transition_temp.b1ca11d4e648e5135eea6ec5f3d901f9.dll
c:\Documents and Settings\All Users\Application Data\microgaming\cache\t\transition_temp.f2db29e849012eed19e3ef95b46b955b.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
c:\Documents and Settings\Mimilolo\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\Mimilolo\Application Data\Mozilla\Firefox\Profiles\awcnax74.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
c:\Documents and Settings\Mimilolo\Application Data\Mozilla\Firefox\Profiles\awcnax74.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_MILAU.tar.gz a l'adresse http://upload.malekal.com

@+

Ca a l'air d'aller, le seul probleme, c'est qu'il reste les icones dans le menu "demarrer programme" et je n'ose pas les supprimer par peur de le réveiller !!!!!
@+

Oui, je plus les voir ces icones de m.....!!

Ca a l'air d'être nickel, je te remercie pour ces conseils precieux. A bientot sur le forum....

voila,
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:59, on 27/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Friendly Technologies\BroadbandAccess\fts.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/574/webolr/OCX/FlashAX.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Voila le rapport de tool cleaner
>- Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Mimilolo\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Mimilolo\Bureau\DiagHelp.zip: trouvé !
C:\Documents and Settings\Mimilolo\Bureau\DiagHelp: trouvé !
C:\Documents and Settings\Mimilolo\Local Settings\Temp\DiagHelp.zip: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

Aplus

encore merci,
@+