Antivirus xp 2008

On continue demain si tu veux.

Salut,

Alors lire :
https://forum.malekal.com/viewtopic.php?f=56&t=13195
et
https://forum.malekal.com/viewtopic.php?f=3&t=11842&st=0&sk=t&sd=a&start=0

Bonne continuation

merci , mais la reponse est axees sur une personne , non ?

ou sont tes protections ?????????????????????

quelles protections ? je n'ai malheureusement aucuns antivirus , ni scan ...
je n'y connais rien en informatique
aidez moi svp !

bin,mon pote!!ou ma pote, lol,
tes vachement bien infecté!!!
j'en n'ai pour des heures!
bon reste en lignes

merci pour ton aide !
je suis desolée pour le boulot que je te donne
merci

tu as un parefeu?

ceux de windows xp , mais rien d'autre ... :S

Salut,

Vu que ça n'avance pas, je prends le relais.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

c'est déja ca

bon,t'as plusieurs infections dont probablement vundo,lop, trojan dow win32.mutant,etc,etc
on va commencer par ca

***soit minutieux***stp lis bien ce qui est noter(je sais c'est pas folichon!)

Télécharge SDfix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. Tu peux suivre le tutorial SDFix de Malekal pour t'aider :

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
[*]Redémarre ton ordinateur
[*]Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
[*]A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
[*]Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
[*]Choisis ton compte.
Déroule la liste des instructions ci-dessous :
[*]Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
[*]Appuie sur Y pour commencer le processus de nettoyage.
[*]Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
[*]Appuie sur une touche pour redémarrer le PC.
[*]Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
[*]Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
[*]Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
[*]Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
[*]Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

ensuite

Télécharge LOP S&D de Eric71.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Double-clique dessus pour lancer l'installation.
Double-clique sur le raccourci Lop S&D présent sur ton bureau.
Séléctionne la langue souhaitée, puis choisis l'Option 1 ( Recherche )
Patiente jusqu'à la fin du scan.
Poste le rapport généré ( Il se trouve ici: C:\lopR.txt )

Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , choisis l' onglet Fichier , puis clique sur Nouvelle tâche; tape alors explorer.exe et valide.

c'est pas terminer, y a encore des truc a faire après

!!!!!!!!!!!!!!Vu que ça n'avance pas!!!!!!!!!!!!!!
bref il ta fallus 25 secondes pour lire le log?

"bref il ta fallus 25 secondes pour lire le log?"
---> 10 secondes environ.

ComboFix 08-08-17.03 - conforama 2008-08-18 1:03:24.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.512 [GMT 2:00]
Endroit: C:\Documents and Settings\conforama\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\#SharedObjects\S4DHZLVM\iforex.com
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\#SharedObjects\S4DHZLVM\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\#SharedObjects\S4DHZLVM\interclick.com
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\#SharedObjects\S4DHZLVM\interclick.com\ud.sol
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\conforama\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\conforama\Application Data\rhcgkqj0e54t
C:\Documents and Settings\conforama\Cookies\conforama@outils.yesmessenger[2].txt
C:\Documents and Settings\conforama\UserData
C:\Documents and Settings\conforama\UserData\ABWPQRE7\showHideState[1].xml
C:\Documents and Settings\conforama\UserData\ABWPQRE7\showHideState[2].xml
C:\Documents and Settings\conforama\UserData\ABWPQRE7\Tdy58[1].xml
C:\Documents and Settings\conforama\UserData\ETIXUVKH\historySearchPos[1].xml
C:\Documents and Settings\conforama\UserData\ETIXUVKH\showHideState[1].xml
C:\Documents and Settings\conforama\UserData\ETIXUVKH\showHideState[2].xml
C:\Documents and Settings\conforama\UserData\ETIXUVKH\undefined[1].xml
C:\Documents and Settings\conforama\UserData\F1JDFCQY\advstNetId[1].xml
C:\Documents and Settings\conforama\UserData\F1JDFCQY\iconState[1].xml
C:\Documents and Settings\conforama\UserData\F1JDFCQY\iconState[2].xml
C:\Documents and Settings\conforama\UserData\index.dat
C:\Documents and Settings\conforama\UserData\KZQ3A7YX\historySitePos[1].xml
C:\Documents and Settings\conforama\UserData\KZQ3A7YX\iconState[1].xml
C:\Documents and Settings\conforama\UserData\KZQ3A7YX\iconState[2].xml
C:\Program Files\rhcgkqj0e54t
C:\WINDOWS\BMfb01c008.txt
C:\WINDOWS\BMfb01c008.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pack.epk
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\abnhecqe.ini
C:\WINDOWS\system32\abnhecqe.ini2
C:\WINDOWS\system32\abnhecqe.tmp
C:\WINDOWS\system32\agxoybvc.ini
C:\WINDOWS\system32\aifsxere.ini
C:\WINDOWS\system32\aljdolil.dll
C:\WINDOWS\system32\bbatyaun.ini
C:\WINDOWS\system32\bgnptges.dll
C:\WINDOWS\system32\blphclkqj0e54t.scr
C:\WINDOWS\system32\btxwibag.ini
C:\WINDOWS\system32\clplrpdt.ini
C:\WINDOWS\system32\clpmvvih.dll
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\csuqkruo.ini
C:\WINDOWS\system32\cvohqsex.ini
C:\WINDOWS\system32\ddhkfiyy.dll
C:\WINDOWS\system32\deekytox.dll
C:\WINDOWS\system32\dkkhjqkk.dll
C:\WINDOWS\system32\dmbyesbx.dll
c:\windows\system32\Drivers\Winha23.sys
C:\WINDOWS\system32\dxkosphh.dll
C:\WINDOWS\system32\eeitjckw.dll
C:\WINDOWS\system32\emaltrul.ini
C:\WINDOWS\system32\eqblqaxv.ini
C:\WINDOWS\system32\ewufwclj.dll
C:\WINDOWS\system32\fblviedk.ini
C:\WINDOWS\system32\fettihht.ini
C:\WINDOWS\system32\ffijansj.ini
C:\WINDOWS\system32\fhroetuk.ini
C:\WINDOWS\system32\frheumlr.ini
C:\WINDOWS\system32\ftqxpbcw.ini
C:\WINDOWS\system32\gabiwxtb.dll
C:\WINDOWS\system32\gjllm.ini
C:\WINDOWS\system32\gjllm.ini2
C:\WINDOWS\system32\griqwikn.dll
C:\WINDOWS\system32\gsxpvccl.ini
C:\WINDOWS\system32\gsxpvccl.ini2
C:\WINDOWS\system32\gsxpvccl.tmp
C:\WINDOWS\system32\hhpsokxd.ini
C:\WINDOWS\system32\hivvmplc.ini
C:\WINDOWS\system32\hpvypylp.dll
C:\WINDOWS\system32\hqascrrv.ini
C:\WINDOWS\system32\hqsglsmg.dll
C:\WINDOWS\system32\hunyfeka.ini
C:\WINDOWS\system32\hwioahhj.dll
C:\WINDOWS\system32\hxybngwq.dll
C:\WINDOWS\system32\ifkleyoi.dll
C:\WINDOWS\system32\ioyelkfi.ini
C:\WINDOWS\system32\iqwcdejt.ini
C:\WINDOWS\system32\ixhmuhrn.dll
C:\WINDOWS\system32\jrbssplg.ini
C:\WINDOWS\system32\kefhtspa.ini
C:\WINDOWS\system32\kexxwfrb.dll
C:\WINDOWS\system32\kkqjhkkd.ini
C:\WINDOWS\system32\koykmype.ini
C:\WINDOWS\system32\kuteorhf.dll
C:\WINDOWS\system32\lclnsbhc.dll
C:\WINDOWS\system32\lmplybew.dll
C:\WINDOWS\system32\lnmgmppw.dll
C:\WINDOWS\system32\lphclkqj0e54t.exe
C:\WINDOWS\system32\lurtlame.dll
C:\WINDOWS\system32\lwulcodl.ini
C:\WINDOWS\system32\lwulcodl.ini2
C:\WINDOWS\system32\lwulcodl.tmp
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mktseljl.ini
C:\WINDOWS\system32\mtfdewfa.dll
C:\WINDOWS\system32\mvvtgcdj.dll
C:\WINDOWS\system32\nbyfbeto.dll
C:\WINDOWS\system32\ncckhcqp.dll
C:\WINDOWS\system32\njtvltwb.ini
C:\WINDOWS\system32\nrhumhxi.ini
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\nyvsgjco.dll
C:\WINDOWS\system32\otebfybn.ini
C:\WINDOWS\system32\ourkqusc.dll
C:\WINDOWS\system32\ovrbxnba.dll
C:\WINDOWS\system32\pdhmuytr.ini
C:\WINDOWS\system32\phclkqj0e54t.bmp
C:\WINDOWS\system32\plypyvph.ini
C:\WINDOWS\system32\pphclkqj0e54t.exe
C:\WINDOWS\system32\pqgrjqgc.dll
C:\WINDOWS\system32\prbgjima.dll
C:\WINDOWS\system32\psrhavlv.dll
C:\WINDOWS\system32\qmieoknkfq_navtmp.dat
C:\WINDOWS\system32\qykqxkjf.ini
C:\WINDOWS\system32\rbwqrwhn.dll
C:\WINDOWS\system32\rgvdonbc.ini
C:\WINDOWS\system32\rjthytpk.dll
C:\WINDOWS\system32\rmxtngcn.ini
C:\WINDOWS\system32\sayaskq.dat
C:\WINDOWS\system32\sayaskq.exe
C:\WINDOWS\system32\sayaskq_nav.dat
C:\WINDOWS\system32\sayaskq_navps.dat
C:\WINDOWS\system32\soektaib.ini
C:\WINDOWS\system32\sujoruxj.ini
C:\WINDOWS\system32\tcvdrdpx.dll
C:\WINDOWS\system32\tpqjibmr.dll
C:\WINDOWS\system32\txapsruv.ini
C:\WINDOWS\system32\vhklwgdn.dll
C:\WINDOWS\system32\vmsmqufr.ini
C:\WINDOWS\system32\vnlgtmpf.ini
C:\WINDOWS\system32\vohuoxjx.ini
C:\WINDOWS\system32\vrrcsaqh.dll
C:\WINDOWS\system32\wcbpxqtf.dll
C:\WINDOWS\system32\wfgshbab.dll
C:\WINDOWS\system32\WinCtrl32.dl_
C:\WINDOWS\system32\WinCtrl32.dll
C:\WINDOWS\system32\wkcjtiee.ini
C:\WINDOWS\system32\wvqmwtvf.dll
C:\WINDOWS\system32\xbseybmd.ini
C:\WINDOWS\system32\xhmykkak.dll
C:\WINDOWS\system32\xjloqimc.ini
C:\WINDOWS\system32\xjopecip.dll
C:\WINDOWS\system32\xobcehtm.ini
C:\WINDOWS\system32\xvfniflv.ini
C:\WINDOWS\system32\yalnerap.ini
C:\WINDOWS\system32\ybayuefa.dll
C:\WINDOWS\system32\yfdtfuug.ini
C:\WINDOWS\system32\ygdgjhtq.dll
C:\WINDOWS\system32\yskgiqgd.dll
C:\WINDOWS\system32\yymiaxjw.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WINHA23
-------\Service_Winha23

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))))))))
.

2008-08-17 23:49 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-08-17 23:01 . 2008-08-17 23:12 94,208 --a------ C:\WINDOWS\system32\10.tmp
2008-08-17 22:38 . 2008-08-17 23:12 32 --a-s---- C:\WINDOWS\system32\1618995047.dat
2008-08-17 22:00 . 2008-08-17 22:00 <REP> d--hs---- C:\FOUND.219
2008-08-15 19:22 . 2008-08-15 19:22 <REP> d-------- C:\Program Files\Axis Title
2008-08-15 12:13 . 2008-08-15 12:13 <REP> d--hs---- C:\FOUND.218
2008-08-15 12:04 . 2008-08-15 12:04 <REP> d--hs---- C:\FOUND.217
2008-08-11 14:23 . 2008-08-11 14:23 <REP> d--hs---- C:\FOUND.216
2008-08-06 18:09 . 2008-08-06 18:09 <REP> d--hs---- C:\FOUND.215
2008-08-04 17:30 . 2008-08-04 17:30 <REP> d--hs---- C:\FOUND.214
2008-08-03 12:41 . 2008-08-03 12:41 <REP> d--hs---- C:\FOUND.213
2008-07-28 14:58 . 2008-07-28 14:58 <REP> d-------- C:\WINDOWS\system32\Adobe
2008-07-23 12:37 . 2008-07-23 12:37 <REP> d--hs---- C:\FOUND.212
2008-07-21 22:27 . 2008-07-21 22:27 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-21 19:36 . 2008-07-21 19:36 <REP> d--hs---- C:\FOUND.211
2008-07-21 19:29 . 2008-07-21 19:29 <REP> d--hs---- C:\FOUND.210
2008-07-20 11:58 . 2008-07-20 11:58 <REP> d--hs---- C:\FOUND.209

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 08:28 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:59 272,768 ----a-w C:\WINDOWS\system32\dllcache\bthport.sys
2008-01-27 17:19 45,056 ----a-w C:\Documents and Settings\conforama\957123845.exe
2008-01-27 17:19 45,056 ----a-w C:\Documents and Settings\conforama\957123844.exe
2008-01-27 17:19 45,056 ----a-w C:\Documents and Settings\conforama\6.exe
2008-01-27 17:19 45,056 ----a-w C:\Documents and Settings\conforama\411.exe
2008-01-25 21:54 45,056 ----a-w C:\Documents and Settings\conforama\394.exe
2008-01-25 21:54 45,056 ----a-w C:\Documents and Settings\conforama\368.exe
2008-01-10 19:10 45,056 ----a-w C:\Documents and Settings\conforama\456.exe
2008-01-10 19:10 45,056 ----a-w C:\Documents and Settings\conforama\276.exe
.

------- Sigcheck -------

2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 12:45 360320 1cc09561e21a48a7f649a40f18235860 C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-10 20:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\backup\tcpip.sys
2007-10-30 17:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2004-08-10 20:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2007-10-30 18:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"thatatom"="C:\DOCUME~1\CONFOR~1\APPLIC~1\AXISTI~1\Beep Heck.exe" [2008-08-15 19:21 465408]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-29 19:45 68856]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2008-06-22 19:37 190024]
"msnmsgr"="C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 22:35 53248]
"ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 17:15 45056]
"Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 16:39 204800]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 20:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 20:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 20:00 455168]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 12:11 421888]
"Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59 602112]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 16:48 57344]
"USB Storage Toolbox"="C:\WINDOWS\UMStor\Res.EXE" [2005-09-14 20:44 65536]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2008-06-22 19:37 190024]
"Hold option boob bin"="C:\Documents and Settings\All Users\Application Data\ford does hold option\Help Mpeg.exe" [2008-08-18 01:14 1806336]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-10 20:00 110592 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 20:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\DivX\\DivX Player\\DivX Player.exe"=
"C:\\Program Files\\DivX\\DivX Codec\\DivX EKG.exe"=
"C:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\WINDOWS\\System32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\WINDOWS\system32\DRIVERS\fbxusb32.sys [2004-10-20 17:23]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys []
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys []
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 20:00]

*Newly Created Service* - ATIWINMGMT
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-08-17 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2006-07-07 17:26]

2007-03-05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]

2008-08-17 C:\WINDOWS\Tasks\AABACC8D918D7FC1.job
- c:\docume~1\confor~1\applic~1\axisti~1\Poll bows online.exe [2008-08-15 19:25]
.
- - - - ORPHANS REMOVED - - - -

BHO-{2E859500-C93B-4951-89B9-FB8D056306BA} - C:\WINDOWS\system32\mlljg.dll
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-UIWatcher - C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
HKLM-Run-RealTray - C:\Program Files\Real\RealPlayer\RealPlay.exe
HKLM-Run-f832f394 - C:\WINDOWS\system32\lccvpxsg.dll
HKLM-Run-sayaskq - c:\windows\system32\sayaskq.exe
HKLM-Run-SMrhcgkqj0e54t - C:\Program Files\rhcgkqj0e54t\rhcgkqj0e54t.exe
HKLM-Run-lphclkqj0e54t - C:\WINDOWS\system32\lphclkqj0e54t.exe
HKLM-Run-LaunchApp - (no file)
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
Notify-tuvtqrs - tuvtqrs.dll

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 01:12:00
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Atiwinmgmt]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtLmSspMessenger]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcLocatorehSched]
"ImagePath"="ð%€|x\[u]0[/u]1\[u]0[/u]9 srv"
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\SXS.DLL
-> ?:\WINDOWS\system32\SXS.DLL
-> ?:\WINDOWS\system32\SXS.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AOL Compagnon\companion.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-18 1:15:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-17 23:15:34

Pre-Run: 18,142,887,936 octets libres
Post-Run: 19,654,017,024 octets libres

385 --- E O F --- 2008-08-15 17:02:41

Même les meilleurs sont plus lent...
le pire c'est que je voulais te mp pour reprendre le poste
mais comme tu m'as si gentiment griller la politesse...j'espère seulement qu'il va répondre
Bien à toi, très chère ami
passe une douce et heureuse nuit
@+

Suis les procédures de chimay8 :
http://ww.commentcamarche.net/forum/affich 7948188 antivirus xp 2008#10

"Même les meilleurs sont plus lent...
le pire c'est que je voulais te mp pour reprendre le poste
mais comme tu m'as si gentiment griller la politesse...j'espère seulement qu'il va répondre
Bien à toi, très chère ami
passe une douce et heureuse nuit
@+ "

---> Heu, j'ai pas tout compris. Je t'explique, j'arrive sur ce topic. Je vois que tu lui dis que le rapport est infecté mais tu ne lui proposes rien alors pour aller plus vite, j'ai posté la procédure ComboFix pour débloquer la situation. Il n'y a aucun problème si tu veux t'en occuper, j'ai juste vu que ça n'avançait pas.

Ok, bonne nuit et j'espère que tu ne l'as pas pris mal.

voila pour Report SDfix :

[b]SDFix: Version 1.216 [/b]
Run by conforama on 18/08/2008 at 01:36

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\10.tmp - Deleted
C:\Documents and Settings\conforama\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk - Deleted
C:\WINDOWS\antiv.exe - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 01:44:03
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"C:\\Program Files\\DivX\\DivX Player\\DivX Player.exe"="C:\\Program Files\\DivX\\DivX Player\\DivX Player.exe:*:Enabled:DivX Player"
"C:\\Program Files\\DivX\\DivX Codec\\DivX EKG.exe"="C:\\Program Files\\DivX\\DivX Codec\\DivX EKG.exe:*:Enabled:DivX EKG"
"C:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe"="C:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe:*:Enabled:ABBYY FineReader 5.0 Sprint"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\\WINDOWS\\System32\\LEXPPS.EXE"="C:\\WINDOWS\\System32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 21 Jun 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Wed 21 Jun 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"
Wed 21 Jun 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Wed 21 Jun 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"
Wed 21 Jun 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll"
Tue 22 Jan 2008 11,534,336 ..SH. --- "C:\WINDOWS\system32\lnubfjcl.tmp"
Mon 3 Mar 2008 1,287,599 A.SH. --- "C:\WINDOWS\system32\lgjdpqcu.tmp"
Wed 23 Apr 2003 237,633 A..H. --- "C:\Program Files\AOL 8.0\waol.exe"
Wed 23 Apr 2003 49,221 A..H. --- "C:\Program Files\AOL 8.0\aolphx.exe"
Wed 23 Apr 2003 36,937 A..H. --- "C:\Program Files\AOL 8.0\aoltray.exe"
Wed 23 Apr 2003 40,960 A..H. --- "C:\Program Files\AOL 8.0\RBM.exe"
Wed 23 Apr 2003 49,223 A..H. --- "C:\Program Files\AOL 8.0\COMIT\cswitch.exe"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\71fa8e4b1f1c72b0e3a5d30a0a049f55\BIT1.tmp"
Sun 3 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\download\BITC.tmp"
Fri 4 Oct 2002 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"

[b]Finished![/b]

et pour hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:46:39, on 18/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\UMStor\Res.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\Program Files\AOL Compagnon\companion.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\conforama\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\WINDOWS\UMStor\Res.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Hold option boob bin] C:\Documents and Settings\All Users\Application Data\ford does hold option\Help Mpeg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [thatatom] C:\DOCUME~1\CONFOR~1\APPLIC~1\AXISTI~1\Beep Heck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: AOL 8.0 Icône AOL.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller Atiwinmgmt (Atiwinmgmt) - Unknown owner - C:\WINDOWS\
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Fournisseur de la prise en charge de sécurité LM NT NtLmSspMessenger (NtLmSspMessenger) - Unknown owner - C:\WINDOWS\
O23 - Service: Localisateur d'appels de procédure distante (RPC) RpcLocatorehSched (RpcLocatorehSched) - Unknown owner - C:\WINDOWS\
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

et voila Lop S&D :

--------------------\\ Lop S&D 4.2.3-0 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : conforama ] [ "C:\Lop SD" ] [ Selection : 1 ]
[ 18/08/2008 | 1:51:29 ] [ PC : ACER-3FAFADAADF (Proc:x86) ]
[ MAJ : 17-08-2008 | 01:58 ]

--------------------\\ Listing des dossiers dans APPLIC~1

[21/06/2006|12:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
[21/06/2006|11:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[21/06/2006|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[08/02/2008|18:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
[21/06/2006|11:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[21/06/2006|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[05/03/2007|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[17/08/2008|23:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ashampoo
[20/02/2007|19:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
[16/06/2007|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[27/12/2006|23:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[05/02/2007|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\deletemovethirdclock
[21/06/2006|11:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[03/08/2007|11:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
[11/06/2007|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[29/09/2007|14:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[03/08/2007|11:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\idle wma bin ford
[19/06/2008|15:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LauncherAccess.dt
[07/02/2007|14:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[21/06/2006|11:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[28/08/2007|00:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NannyMania
[27/08/2007|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Oberon Games
[15/06/2007|15:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[26/12/2007|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[24/07/2007|14:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[30/12/2006|14:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[01/06/2008|18:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[01/01/2007|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[21/06/2006|11:35] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[21/06/2006|11:35] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[21/06/2006|12:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
[21/06/2006|11:36] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[21/06/2006|11:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[21/06/2006|11:35] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[23/01/2007|20:08] C:\DOCUME~1\CONFOR~1\APPLIC~1\Adobe
[05/02/2007|19:48] C:\DOCUME~1\CONFOR~1\APPLIC~1\AdobeUM
[05/03/2007|18:10] C:\DOCUME~1\CONFOR~1\APPLIC~1\Apple Computer
[21/06/2006|12:01] C:\DOCUME~1\CONFOR~1\APPLIC~1\ATI
[05/02/2007|20:06] C:\DOCUME~1\CONFOR~1\APPLIC~1\Axis Title
[27/12/2006|23:47] C:\DOCUME~1\CONFOR~1\APPLIC~1\CyberLink
[21/06/2006|11:36] C:\DOCUME~1\CONFOR~1\APPLIC~1\desktop.ini
[24/07/2007|15:39] C:\DOCUME~1\CONFOR~1\APPLIC~1\DivX
[04/06/2007|21:54] C:\DOCUME~1\CONFOR~1\APPLIC~1\dvdcss
[27/03/2008|19:21] C:\DOCUME~1\CONFOR~1\APPLIC~1\FMZilla
[11/06/2007|22:44] C:\DOCUME~1\CONFOR~1\APPLIC~1\Google
[02/01/2007|13:12] C:\DOCUME~1\CONFOR~1\APPLIC~1\Help
[21/06/2006|11:51] C:\DOCUME~1\CONFOR~1\APPLIC~1\Identities
[29/09/2007|16:49] C:\DOCUME~1\CONFOR~1\APPLIC~1\Leadertech
[21/11/2006|15:35] C:\DOCUME~1\CONFOR~1\APPLIC~1\Macromedia
[21/06/2006|11:35] C:\DOCUME~1\CONFOR~1\APPLIC~1\Microsoft
[03/04/2007|20:01] C:\DOCUME~1\CONFOR~1\APPLIC~1\OpenOffice.org2
[16/04/2008|18:52] C:\DOCUME~1\CONFOR~1\APPLIC~1\PPMate
[04/07/2007|15:11] C:\DOCUME~1\CONFOR~1\APPLIC~1\Samsung
[16/04/2007|21:52] C:\DOCUME~1\CONFOR~1\APPLIC~1\Screenshot Sender
[31/10/2007|20:31] C:\DOCUME~1\CONFOR~1\APPLIC~1\SopCast
[03/04/2007|19:53] C:\DOCUME~1\CONFOR~1\APPLIC~1\Sun
[26/12/2007|16:15] C:\DOCUME~1\CONFOR~1\APPLIC~1\Viewpoint
[01/01/2007|14:35] C:\DOCUME~1\CONFOR~1\APPLIC~1\vlc

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[18/08/2008 01:00][--ah-----] C:\WINDOWS\tasks\AABACC8D918D7FC1.job
[18/08/2008 01:42][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/03/2007 18:09][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[18/08/2008 01:19][--a------] C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
[10/08/2004 20:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( AABACC8D918D7FC1.job )=( c:\docume~1\confor~1\applic~1\axisti~1\Pollbowsonline.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[29/02/2008|22:13] C:\Program Files\7-Zip
[16/10/2007|21:48] C:\Program Files\ABBYY FineReader 5.0 Sprint
[16/06/2007|12:48] C:\Program Files\ABBYY FineReader 6.0
[21/06/2006|12:08] C:\Program Files\Acer Inc
[21/06/2006|12:08] C:\Program Files\Adobe
[03/04/2007|18:52] C:\Program Files\adslTV
[05/02/2007|20:03] C:\Program Files\Adverts
[10/11/2007|23:32] C:\Program Files\Amor AVI MPEG WMV RM to MP3 Converter
[28/12/2006|19:13] C:\Program Files\AOL 8.0
[28/12/2006|19:14] C:\Program Files\AOL Compagnon
[05/03/2007|18:09] C:\Program Files\Apple Software Update
[21/06/2006|11:52] C:\Program Files\ATI Technologies
[15/08/2008|19:22] C:\Program Files\Axis Title
[21/06/2006|11:41] C:\Program Files\ComPlus Applications
[11/04/2007|16:17] C:\Program Files\Comptes et Budget Free V5.0
[21/06/2006|12:05] C:\Program Files\CONEXANT
[21/06/2006|12:10] C:\Program Files\CyberLink
[21/06/2006|12:51] C:\Program Files\DIFX
[24/07/2007|15:11] C:\Program Files\DivX
[16/06/2007|12:48] C:\Program Files\FaxTools
[21/06/2006|11:36] C:\Program Files\Fichiers communs
[01/04/2007|20:19] C:\Program Files\Free
[27/03/2008|19:20] C:\Program Files\Free Music Zilla
[01/01/2007|14:29] C:\Program Files\Free.fr
[15/06/2007|15:25] C:\Program Files\Gamenext
[21/06/2006|13:01] C:\Program Files\GemMasterFrench
[11/06/2007|22:44] C:\Program Files\Google
[21/06/2006|11:52] C:\Program Files\InstallShield Installation Information
[21/06/2006|11:43] C:\Program Files\Internet Explorer
[05/03/2007|19:07] C:\Program Files\iPod
[05/03/2007|19:07] C:\Program Files\iTunes
[20/02/2007|18:58] C:\Program Files\IVT Corporation
[03/04/2007|19:53] C:\Program Files\Java
[21/11/2006|15:42] C:\Program Files\Launch Manager
[16/10/2007|21:44] C:\Program Files\Lexmark X1100 Series
[13/06/2007|23:27] C:\Program Files\Maxis
[21/06/2006|11:40] C:\Program Files\Messenger
[05/02/2007|20:03] C:\Program Files\Messenger Plus! Live
[08/06/2008|18:32] C:\Program Files\MessengerPlus! 3
[21/06/2006|11:45] C:\Program Files\microsoft frontpage
[13/06/2007|15:26] C:\Program Files\Microsoft Games
[21/11/2006|19:17] C:\Program Files\Microsoft Office
[21/06/2006|11:41] C:\Program Files\Movie Maker
[21/06/2006|11:40] C:\Program Files\MSN
[21/06/2006|11:40] C:\Program Files\MSN Gaming Zone
[01/02/2008|20:01] C:\Program Files\MSXML 4.0
[21/06/2006|11:43] C:\Program Files\NetMeeting
[21/06/2006|12:16] C:\Program Files\NewTech Infosystems
[28/12/2006|19:14] C:\Program Files\Nullsoft
[21/06/2006|11:41] C:\Program Files\Online Services
[03/04/2007|19:54] C:\Program Files\OpenOffice.org 2.2
[21/06/2006|11:43] C:\Program Files\Outlook Express
[29/03/2008|16:59] C:\Program Files\Oxygen Interactive
[13/04/2008|00:14] C:\Program Files\QuickTime
[21/06/2006|12:01] C:\Program Files\Realtek
[04/07/2007|15:03] C:\Program Files\Samsung
[19/09/2007|18:49] C:\Program Files\Seagrand
[21/06/2006|11:43] C:\Program Files\Services en ligne
[31/10/2007|20:31] C:\Program Files\SopCast
[21/11/2006|15:41] C:\Program Files\Synaptics
[26/07/2007|14:57] C:\Program Files\TechSmith
[21/06/2006|11:51] C:\Program Files\Uninstall Information
[26/12/2007|13:51] C:\Program Files\USB Disk Win98 Driver
[01/01/2007|14:34] C:\Program Files\VideoLAN
[28/12/2006|19:14] C:\Program Files\Viewpoint
[12/04/2007|19:54] C:\Program Files\WebAnim Gif
[01/10/2007|21:10] C:\Program Files\Windows Live
[02/05/2007|10:37] C:\Program Files\Windows Live Safety Center
[30/12/2006|14:34] C:\Program Files\Windows Live Toolbar
[24/07/2007|14:58] C:\Program Files\Windows Media Connect 2
[21/06/2006|11:41] C:\Program Files\Windows Media Player
[21/06/2006|11:40] C:\Program Files\Windows NT
[21/06/2006|11:41] C:\Program Files\Windows Plus
[21/06/2006|11:43] C:\Program Files\WindowsUpdate
[30/09/2007|22:09] C:\Program Files\Wondershare
[21/06/2006|11:45] C:\Program Files\xerox
[01/01/2007|14:48] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[21/06/2006|12:08] C:\Program Files\Fichiers communs\Adobe
[28/12/2006|19:12] C:\Program Files\Fichiers communs\AOL
[28/12/2006|19:14] C:\Program Files\Fichiers communs\aolback
[28/12/2006|19:14] C:\Program Files\Fichiers communs\aolshare
[21/06/2006|11:56] C:\Program Files\Fichiers communs\ATI Technologies
[21/06/2006|11:52] C:\Program Files\Fichiers communs\InstallShield
[03/04/2007|19:53] C:\Program Files\Fichiers communs\Java
[21/06/2006|12:16] C:\Program Files\Fichiers communs\LightScribe
[21/06/2006|11:36] C:\Program Files\Fichiers communs\Microsoft Shared
[21/06/2006|11:43] C:\Program Files\Fichiers communs\MSSoap
[21/06/2006|12:16] C:\Program Files\Fichiers communs\muvee Technologies
[21/06/2006|12:16] C:\Program Files\Fichiers communs\NewTech Infosystems
[21/06/2006|11:36] C:\Program Files\Fichiers communs\ODBC
[28/12/2006|19:14] C:\Program Files\Fichiers communs\Real
[21/06/2006|11:43] C:\Program Files\Fichiers communs\Services
[21/06/2006|11:36] C:\Program Files\Fichiers communs\SpeechEngines
[16/04/2008|18:52] C:\Program Files\Fichiers communs\Synacast
[21/06/2006|11:43] C:\Program Files\Fichiers communs\System
[01/06/2008|18:22] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 68 Processus )

IEXPLORE.EXE ~ [PID:2224] ~ [Threads:8]
IEXPLORE.EXE ~ [PID:2800] ~ [Threads:5]
IEXPLORE.EXE ~ [PID:3764] ~ [Threads:23]
MsgPlus.exe ~ [PID:1804] ~ [Threads:1]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\dart warn.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\start flaw.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\Body Blue.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\ball option.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\delete idol.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\test balm.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\axis stop.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\64 1.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\Help Mpeg.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\idle wma bin ford
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\Beep Heck.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\zhfatvda.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\Datauploadcashkeep.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\Poll bows online.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\qgzwxgcl.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\thvjdyyj.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\xsdlhjzh.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\Poll gram upload.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\cntmpoqp.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\kcwajdaf.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\wfvzaism.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\ckcvjykk.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\sauptfmq.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\xsqmboqc.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\toabxfog.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\mnofbfvg.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\kqtludkh.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\yawncpcr.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\iczadnmk.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\xalowmmr.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\msjyxxva.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\pgglgmij.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\rddocpfl.exe
C:\DOCUME~1\CONFOR~1\APPLIC~1\axisti~1\dkdkcilw.exe
C:\Program Files\axisti~1
C:\Program Files\Adverts
C:\Program Files\Adverts\uninst.exe
C:\DOCUME~1\CONFOR~1\Cookies\conforama@advertstream[1].txt
C:\DOCUME~1\CONFOR~1\Cookies\conforama@advertising[1].txt
C:\WINDOWS\Tasks\AABACC8D918D7FC1.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"thatatom"="C:\\DOCUME~1\\CONFOR~1\\APPLIC~1\\AXISTI~1\\Beep Heck.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Hold option boob bin"="C:\\Documents and Settings\\All Users\\Application Data\\ford does hold option\\Help Mpeg.exe"

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 01:53:18
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\CONFOR~1\Mes documents\Mes images\ogcnice\crack.bmp
C:\DOCUME~1\CONFOR~1\Mes documents\Nouveau dossier\ogcnice\crack.bmp

[F:32][D:3]-> C:\DOCUME~1\CONFOR~1\LOCALS~1\Temp
[F:138][D:0]-> C:\DOCUME~1\CONFOR~1\Cookies
[F:215][D:4]-> C:\DOCUME~1\CONFOR~1\LOCALS~1\TEMPOR~1\content.IE5
[F:2][D:0]-> C:\Recycled

--------------------\\ Fin du rapport a 1:54:23,20