"Un Rootkit a été trouvé"

Salut,

Commence par ce-ci :

1- Avoir accès aux fichiers cachés :

Vas dans Menu Démarrer->Poste de travail->Outils->Options des dossiers...->Affichage
* "Afficher les fichiers et dossiers cachés" ---> coché
* "Masquer les extensions des fichiers dont le type est connu" ---> décoché
* "masquer les fichiers du système" ---> décoché
-> valides la modif ( "appliquer" puis "ok" ).
( tu remetteras les paramètres de départ une fois la désinfection terminée , pas avant ... )

2- Télécharges ToolBar S&D ( de Eric_71 ) :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

* double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
* Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
* Choisis l'option 1 ( "recherche") et tapes "entrée" .
* Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
de son contenu dans ta prochaine réponse ...
( le rapport est en outre sauvegardé ici -> C:\TB.txt )

Voici le rapport:

-----------\\ ToolBar S&D 1.1.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz )
BIOS : Default System BIOS
USER : Bastien ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080827-0] 4.8.1229 (Activated)

"D:\ToolBar SD" ( MAJ : 27-08-2008|23:35 )
Option : [1] ( 28/08/2008|12:40 )

-----------\\ Recherche de Fichiers / Dossiers ...

D:\Program Files\AskTBar
D:\Program Files\AskTBar\bar
D:\Program Files\AskTBar\PopSwatr
D:\Program Files\AskTBar\SrchAstt
D:\DOCUME~1\Bastien\Cookies\bastien@mysearch[1].txt
D:\DOCUME~1\Bastien\APPLIC~1\SmartShopper
D:\DOCUME~1\Bastien\APPLIC~1\SmartShopper\cs
D:\Program Files\SmartShopper
D:\Program Files\SmartShopper\Bin
D:\Program Files\SmartShopper\Uninst.exe
D:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\SmartShopper
D:\WINDOWS\iun6002.exe

-----------\\ Extensions

(Bastien) - {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} => flashgot
(Bastien) - {DDC359D1-844A-42a7-9AA1-88A850A938A8} => chrome

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="D:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.gettoggle.com/?q=hompag"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

D:\DOCUME~1\Bastien\Incomplete\T-430208085-Adobe Photoshop CS2 multilanguage [ENG][ITA][FR][DE][ESP][JPG] Funzionante Tested + serial + crack.rar

-----------\\ Fin du rapport a 12:41:17,00

Bien ...

1- Supprimes ce crack , il est infecté :
D:\DOCUME~1\Bastien\Incomplete\T-430208085-Adobe Photoshop CS2 multilanguage [ENG][ITA][FR][DE][ESP][JPG] Funzionante Tested + serial + crack.rar

--> directe à la poubelle et tu la vide ...

2- Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".
Note : ne touches à rien lors de la suppression !
Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse et attends la suite ...

( PS : Si ton Bureau ne réapparait pas, appuies simultanément sur "Ctrl+Alt+Supp"r pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tapes explorer puis valides ... )

Voici le rapport de ToolBar S&D:

-----------\\ ToolBar S&D 1.1.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz )
BIOS : Default System BIOS
USER : Bastien ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080827-0] 4.8.1229 (Activated)

"D:\ToolBar SD" ( MAJ : 27-08-2008|23:35 )
Option : [2] ( 28/08/2008|12:58 )

-----------\\ SUPPRESSION

Supprime! - D:\Program Files\AskTBar\bar
Supprime! - D:\Program Files\AskTBar\PopSwatr
Supprime! - D:\Program Files\AskTBar\SrchAstt
Supprime! - D:\DOCUME~1\Bastien\Cookies\bastien@mysearch[1].txt
Supprime! - D:\DOCUME~1\Bastien\APPLIC~1\SmartShopper\cs
Supprime! - D:\Program Files\SmartShopper\Bin
Supprime! - D:\Program Files\SmartShopper\Uninst.exe
Supprime! - D:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\SmartShopper
Supprime! - D:\WINDOWS\iun6002.exe
Supprime! - D:\Program Files\AskTBar
Supprime! - D:\DOCUME~1\Bastien\APPLIC~1\SmartShopper
Supprime! - D:\Program Files\SmartShopper

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(Bastien) - {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} => flashgot
(Bastien) - {DDC359D1-844A-42a7-9AA1-88A850A938A8} => chrome

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="D:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.gettoggle.com/?q=hompag"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

-----------\\ Fin du rapport a 13:00:10,77

Et voici celui de HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:04, on 28/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\WINDOWS\system32\VTTimer.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\eMule\emule.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\WINDOWS\system32\msiexec.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gettoggle.com/?q=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.onspeed.com/pac/?id=171a094db3fd991c99b8069d135128c7
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: G DATA WebFilter Class - {0124123d-61b4-456f-af86-78c53a0790c5} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [iTunes] D:\Program Files\iTunes\iTunes.exe
O4 - HKCU\..\Run: [Firefox] D:\Program Files\Mozilla Firefox\firefox.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MSN Pictures Displayer.lnk = D:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - D:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - D:\WINDOWS\System32\TuneUpDefragService.exe

Merci beaucoup de ton aide
--> de rien , on est là pour cela ... ^^

1- Télécharges : - CCleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ).

Un tuto ( aide ):
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

---> Utilisation:
! déconnectes toi et fermes toutes applications en cours !
* vas dans "nettoyeur" : fait analyse puis nettoyage
* vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

2- Voyons ce que va nous dire ce scan :

Télécharges GenProc (de Jean-Chretien1 et Narco4) sur ton bureau (et pas ailleur !) :
http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip

!!Déconnectes toi et fermes tes application en cours !!

Dézippes (extraire tout) le dossier : double-clique sur GenProc.bat et laisses faire...
Postes le contenu du rapport qui s'ouvre .

Aide en images ici : http://www.alt-shift-return.org/Info/GenProc-HowTo.html
IMPORTANT : postes le rapport et ne fait rien d'autre pour l'instant ( souvant il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement ) .

Voici le rapport de GenProc:

GenProc 2.020 [2] 28/08/2008 - Windows [XP] : Aucune infection caractéristique trouvée

Sinon j'ai fait comme tu as dit pour Ccleaner ;-)

ok ... Redémarres ton PC et dis moi si tu as encore des alertes sur ce rootkit ...

Puis fais ce-ci pour approfondir :

Télécharge DiagHelp.zip sur ton bureau :
( note : si ton anti-virus s'affolle lors du téléchargement ou de l'installe, c'est normal , ignore l'alerte ).

-> http://www.malekal.com/download/DiagHelp.zip

!! déconnectes toi et fermes toutes tes applications en cours !!

Fais un clic droit sur le fichier et extraire tout sur ton bureau .

--> Un nouveau dossier va être créé : "DiagHelp"
Ouvres le et double-clic sur go.cmd et pas sur autre chose ! (le .cmd peut ne pas apparaître )

--> Une fenêtre va s'ouvrir, choisis l'option 1
L'analyse va commencer, ce-ci peut durer quelques minutes, laisses faire et appuies sur une touche quand on te le demandera :
une page IE va s'ouvrir , fermes la .
Re-appuis sur une touche, le bloc-note s'ouvre :
Sauvegardes ce rapport de façon à le retrouver et postes tout son contenu dans ta prochaine réponse ...

Rien ne s'est passé du coté d'Avast après le redémarage, j'ai même fait analysé le dossier où ce trouvait ce fichier infecté par Spybot et Avast mais aucune alerte, donc j'ai effectué le scan du logiciel que tu m'a donné, et Avast m'a refait le "Un Rootkit a été trouvé" pendant le scan de go.cmd... (toujours le même fichier...)

Par contre, cela fait 2x que j'essai de poster le rapport complet de ton logicel, mais il est trop grand et le site ne doit pas l'accepter...

Avast m'a refait le "Un Rootkit a été trouvé" --> cela peut provenir de DiagHelp lui même ...

Par contre, cela fait 2x que j'essaie de poster le rapport complet de ton logicel, mais il est trop grand et le site ne doit pas l'accepter...
--> il y a des prb pour poster en ce momment sur le site ... je vais alerter la conciergerie ...

Retentes de le poster dans un petit momment ... A tout' =)

Voici la rapport

DiagHelp version v1.4 - http://www.malekal.com
excute le 28/08/2008 à 13:31:34,35

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch

D:\WINDOWS\System32\drivers\84036a5a.sys -->28/08/2008 13:31:34
D:\WINDOWS\System32\drivers\MiniIcpt.sys -->25/08/2008 13:29:17
D:\WINDOWS\System32\drivers\MS1000.sys -->20/08/2008 22:20:27
D:\WINDOWS\System32\drivers\mbamswissarmy.sys -->17/08/2008 15:01:18
D:\WINDOWS\System32\drivers\mbam.sys -->17/08/2008 15:01:14
D:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42
D:\WINDOWS\System32\drivers\aswmon2.sys -->19/07/2008 16:37:21

D:\WINDOWS\System32\Thumbs.db -->28/08/2008 13:28:00
D:\WINDOWS\System32\wpa.dbl -->28/08/2008 12:03:56
D:\WINDOWS\System32\CONFIG.NT -->26/08/2008 01:22:43
D:\WINDOWS\System32\bdod.bin -->26/08/2008 00:16:06
D:\WINDOWS\System32\zllictbl.dat -->25/08/2008 00:51:34
D:\WINDOWS\System32\TuneUpDefragService.exe -->21/08/2008 23:18:13
D:\WINDOWS\System32\FNTCACHE.DAT -->21/08/2008 17:40:36
D:\WINDOWS\System32\FLIQLO.scr -->20/08/2008 22:09:21
D:\WINDOWS\System32\winskfr.dll -->14/08/2008 23:40:31
D:\WINDOWS\System32\mswinsck.ocx -->14/08/2008 23:40:30
D:\WINDOWS\System32\TZLog.log -->06/08/2008 23:10:06
D:\WINDOWS\System32\perfh00C.dat -->06/08/2008 21:47:59
D:\WINDOWS\System32\perfh009.dat -->06/08/2008 21:47:59
D:\WINDOWS\System32\perfc00C.dat -->06/08/2008 21:47:59
D:\WINDOWS\System32\perfc009.dat -->06/08/2008 21:47:58
D:\WINDOWS\System32\PerfStringBackup.INI -->06/08/2008 21:47:56
D:\WINDOWS\System32\$winnt$.inf -->06/08/2008 21:29:55
D:\WINDOWS\System32\nscompat.tlb -->06/08/2008 21:26:37
D:\WINDOWS\System32\amcompat.tlb -->06/08/2008 21:26:37
D:\WINDOWS\System32\WindowsLogon.manifest -->06/08/2008 21:25:49
D:\WINDOWS\System32\logonui.exe.manifest -->06/08/2008 21:25:49
D:\WINDOWS\System32\wuaucpl.cpl.manifest -->06/08/2008 21:25:45
D:\WINDOWS\System32\sapi.cpl.manifest -->06/08/2008 21:25:45
D:\WINDOWS\System32\nwc.cpl.manifest -->06/08/2008 21:25:45
D:\WINDOWS\System32\ncpa.cpl.manifest -->06/08/2008 21:25:45

D:\WINDOWS\Thumbs.db -->28/08/2008 13:28:13
D:\WINDOWS\WindowsUpdate.log -->28/08/2008 13:27:17
D:\WINDOWS\0.log -->28/08/2008 13:26:08
D:\WINDOWS\wiadebug.log -->28/08/2008 13:26:06
D:\WINDOWS\wiaservc.log -->28/08/2008 13:26:05
D:\WINDOWS\bootstat.dat -->28/08/2008 13:25:57
D:\WINDOWS\SchedLgU.Txt -->28/08/2008 13:24:45
D:\WINDOWS\NeroDigital.ini -->27/08/2008 18:18:42
D:\WINDOWS\bdagent.INI -->26/08/2008 00:51:07
D:\WINDOWS\system.ini -->22/08/2008 15:24:04
D:\WINDOWS\tsc.ini -->21/08/2008 17:48:07
D:\WINDOWS\WMSysPr9.prx -->06/08/2008 21:26:38
D:\WINDOWS\ODBCINST.INI -->06/08/2008 21:26:28
D:\WINDOWS\win.ini -->06/08/2008 21:25:36
D:\WINDOWS\PhotoSnapViewer.INI -->05/08/2008 00:36:55

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1688
Command line: D:\WINDOWS\Explorer.EXE

Base Size Version Path
0x76f80000 0x7f000 2001.12.4414.0258 D:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 D:\WINDOWS\system32\COMRes.dll
0x55df0000 0xd000 17.01.0051.0000 D:\WINDOWS\system32\AcSignIcon.dll
0x782e0000 0x10f000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL
0x78130000 0x9b000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x5d360000 0xf000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80FRA.DLL
0x76ac0000 0x11000 3.05.2284.0000 D:\WINDOWS\system32\ATL.DLL
0x745e0000 0x2c6000 3.01.4000.2435 D:\WINDOWS\system32\msi.dll
0x01d50000 0x187000 1.06.0000.0012 D:\PROGRA~1\SPYBOT~1\SDHelper.dll
0x01220000 0x3d000 3.525.1117.0000 D:\WINDOWS\system32\ODBC32.dll
0x01260000 0x18000 3.525.1117.0000 D:\WINDOWS\system32\odbcint.dll
0x7c420000 0x87000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
0x55fe0000 0x52000 17.01.0051.0000 D:\Program Files\Fichiers communs\Autodesk Shared\AcSignCore16.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 652
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 \??\D:\WINDOWS\system32\winlogon.exe
0x74730000 0x3d000 3.525.1117.0000 D:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 D:\WINDOWS\system32\odbcint.dll
0x76ac0000 0x11000 3.05.2284.0000 D:\WINDOWS\system32\ATL.DLL
0x77000000 0xd4000 2001.12.4414.0258 D:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0258 D:\WINDOWS\system32\CLBCATQ.DLL

Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\WINDOWS\system32

05/08/2004 14:00 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 25 374 302 208 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\WINDOWS\Downloaded Program Files

26/08/2008 02:05 <REP> .
26/08/2008 02:05 <REP> ..
07/12/2004 17:07 32 bdcore.dll
25/05/2006 01:21 118 784 bdupd.dll
06/08/2008 21:25 65 desktop.ini
11/02/2007 23:10 302 184 IDrop.ocx
09/02/2007 16:55 114 768 IDropCHS.dll
14/02/2007 23:30 116 304 IDropCHT.dll
14/02/2007 00:40 116 304 IDropCSY.dll
14/02/2007 03:19 114 768 IDropDEU.dll
11/02/2007 23:24 114 792 IDropENU.dll
14/02/2007 09:09 114 768 IDropESP.dll
16/02/2007 04:15 114 768 IDropFRA.dll
14/02/2007 01:13 114 768 IDropHUN.dll
12/02/2007 07:20 114 768 IDropITA.dll
14/02/2007 00:43 114 768 IDropJPN.dll
15/02/2007 22:37 126 032 IDropKOR.dll
12/02/2007 03:42 114 768 IDropPLK.dll
11/03/2002 04:09 118 784 iDropPTB.dll
09/02/2007 06:00 116 816 IDropRUS.dll
25/05/2006 01:21 53 248 ipsupd.dll
16/03/2005 12:34 7 407 lang.ini
07/12/2004 17:07 32 libfn.dll
13/02/2008 17:55 130 live.ini
20/06/2006 16:44 379 704 MsnPUpld.dll
19/06/2006 15:40 393 MsnPUpld.inf
29/10/2007 16:45 1 244 oscan8.inf
25/10/2007 16:54 471 040 oscan8.ocx
20/06/2006 16:44 117 560 PURen-us.dll
14/03/2005 14:58 7 073 scanoptions.tsi
11/06/2007 12:21 5 021 swflash.inf
02/11/2005 18:01 1 777 xscan.inf
02/11/2005 18:07 435 712 xscan53.ocx
31 fichier(s) 3 528 582 octets

Total des fichiers listés :
31 fichier(s) 3 528 582 octets
2 Rép(s) 25 374 302 208 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\Freeplayer\\vlc\\vlc.exe"="D:\\Program Files\\Freeplayer\\vlc\\vlc.exe:*:Enabled:VLC media player"
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"="D:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe"="D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe:*:Enabled:Age of Empires II"
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe"="D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="D:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
127.0.0.1 activexupdate.com
127.0.0.1 www.activexupdate.com
127.0.0.1 www.antispywareupdates.net
127.0.0.1 antispywareupdates.net
127.0.0.1 avpcheckupdate.com
127.0.0.1 www.avpcheckupdate.com
127.0.0.1 client.exeupdate.com
127.0.0.1 www.eupdatepage.com
127.0.0.1 eupdatepage.com
127.0.0.1 www.exeupdate.com
127.0.0.1 exeupdate.com
127.0.0.1 www.flwupdate.com
127.0.0.1 flwupdate.com
127.0.0.1 www.hotwinupdates.com
127.0.0.1 hotwinupdates.com
127.0.0.1 www.lavasoftupdate.com
127.0.0.1 lavasoftupdate.com
127.0.0.1 www.malwarewipeupdate.com
127.0.0.1 malwarewipeupdate.com
127.0.0.1 www.movupdate.com
127.0.0.1 movupdate.com
127.0.0.1 www.mpegupdate.com
127.0.0.1 mpegupdate.com
127.0.0.1 www.msupdate.net
127.0.0.1 msupdate.net
127.0.0.1 www.msupdater.net
127.0.0.1 msupdater.net
127.0.0.1 necessaryupdates.com
127.0.0.1 www.necessaryupdates.com
127.0.0.1 newupdates.lzio.com
127.0.0.1 redirect.msupdate.net
127.0.0.1 www.registryupdate.org
127.0.0.1 registryupdate.org
127.0.0.1 search.keyword.exeupdate.com
127.0.0.1 securityupdatesite.com
127.0.0.1 www.securityupdatesite.com
127.0.0.1 settings.updatemysettings.com
127.0.0.1 www.spyaxeupdate.com
127.0.0.1 spyaxeupdate.com
127.0.0.1 spyfalconupdate.com
127.0.0.1 www.spyfalconupdate.com
127.0.0.1 www.systemupdates.net
127.0.0.1 systemupdates.net
127.0.0.1 trial.updates.winsoftware.com
127.0.0.1 update.680180.net
127.0.0.1 update.shareaza.com
127.0.0.1 www.updatemysettings.com
127.0.0.1 updatemysettings.com
127.0.0.1 updates.spywarequake.com
127.0.0.1 www.updatesantivirus.com
127.0.0.1 updatesantivirus.com
127.0.0.1 www.urgentsystemupdate.biz
127.0.0.1 urgentsystemupdate.biz
127.0.0.1 www.urgentsystemupdate.com
127.0.0.1 urgentsystemupdate.com
127.0.0.1 windupdates.com
127.0.0.1 www.aviupdate.com
127.0.0.1 aviupdate.com
127.0.0.1 www.xp-vista-update.net
127.0.0.1 xp-vista-update.net
127.0.0.1 pandaantivirus-2007.com
127.0.0.1 www.pandaantivirus-2007.com
127.0.0.1 pandadownload-now.com
127.0.0.1 www.pandadownload-now.com
127.0.0.1 www.panda-hq.com
127.0.0.1 panda-hq.com
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 13:32:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\84036a5a]
"ImagePath"="\SystemRoot\System32\drivers\84036a5a.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ef,f2,0a,12,26,ae,29,49,83,47,c6,46,ce,90,2a,a0,f4,74,81,d0,56,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\84036a5a]
"ImagePath"="\SystemRoot\System32\drivers\84036a5a.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="D345C33F4FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DC038D530D6EB34525D575E7D6A3B98083228A2B30E74383986422BD4C427BC79F33AA7BDCB3ABBCBB27BA1F323898F524B908FCE1D84A779C11D71149A8B7A33D81D865CC99779855B808DCD04BA1DEF80081BA62E6B061B547D7811B5229BD7BB3995CE90C1CF6F7EF491B059DB66C3686F44DF7133514175E3E776B822162295C94765D53FD076737086AF0BDEB38EDADB6BF39DDBACA31FFE4AC04A3908DB21BCEE41CF87309DD73DAAB20029F2A7F515D9AEEBD7DE0C0EB510C39585B0675C34465A3A0948F78B5C1EF52515B4F91A18B7B11A0E53DA46A18BA2489D73B78B86677B54231530B1016887EA7131036D169370E95998040D8F75D71686585635BF53C2622C3703339171CC467FC15559F16134A00AE18C6B02E73335BE8B5E251DEE24ACEB74C1BBAA86FC2FF563960945F51B88610692322E64D460355C00691204E3FD2135523C9BD824A3FDB8826EDC0D94EF187FC371FD4BB1564EBF0056C33C1F267B87AC6768FEA2A2B507E5C0B7C3E52657EC63008CE615D8E04CB6820E2A44F9201ADE37C7712AB2AE3A23F50D1D2782BF13C877AE601CAFBBBE904A7F4095CD29440A66258E455BF05DB04EC27F46DE64565F3668C839A49BF70E4AD8592A01227C64F520974D2974A31AC876B40318CAC327DF7212B007B6794267922FEB710DE1362A8D30732D2863FBAAF86CF190EE09B1D83C151D2A346CD5C856E49B83DE345C0A7363BB7B6E9509FDCDB7FC2E40F8A84B658CEDE2AF1E065983FC4A9D80D7C8638E1EFBAD9C590810AE0F61D8A10BC4264597E18CBAFBA248AB60DEAC4ED680C4CCB2625F7CEE53F0874AADFE695AD69B643A1186D79B100995DB149F9ADD9D03D2D4EC324D3ED876F9A9C713622541217F5BE43300B4C6523C1FF96AA83D4D36F89F70CA40CE1AB9D7CD690B4DCEFCF009461AF81EA1519ECCBEF104346A503B488E93D07AD0AE182C3F1EDEDADD930B27AA43429364D12E2BB33469677EFAB18285D3F1981540B1B266C68D357D262EB21CC5FEB49FFB046E59491A6535B7FC1A4880DD26128DEC5C939918737C65E3B9915C20C71C98E6DF711298C1F004C5B77F3CC9A56068F2CCF71D84284D9A747B66149C0AC482E27D20C06D0636F079363A7FED8D3FB630DC2AAFDC54879F6D71DBCDEFAA2AAC45FA6C5BA3AFACA2C5246916084810F3551AA402ADEEE665A2C19241984F0018233FC33ECB2FA2D4A1C6621F5733D82D59C3C417886448ED2ACB14F6190D9D5F53637716786A095243945E9022A14305F24ECFCA841330D0DC20C9CCF7F2002EEFB6B966C1B8737DA6B8FAAF30D61EB1A2E26947BACC443A5A0405"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000015d

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
136 - firefox.exe
208 - LVCOMSX.EXE
232 - VTTimer.exe
240 - realsched.exe
356 - iTunesHelper.ex
388 - ashDisp.exe
508 - AppleMobileDevi
520 - msnmsgr.exe
556 - iTunes.exe
596 - mDNSResponder.e
612 - WLanCfgG.exe
628 - csrss.exe
652 - winlogon.exe
696 - services.exe
708 - lsass.exe
780 - TeaTimer.exe
884 - svchost.exe
928 - svchost.exe
1024 - svchost.exe
1100 - emule.exe
1144 - svchost.exe
1276 - svchost.exe
1360 - svchost.exe
1480 - aawservice.exe
1552 - ashServ.exe
1688 - explorer.exe
2300 - ashMaiSv.exe
2476 - ashWebSv.exe
2884 - iPodService.exe
3160 - alg.exe
3460 - wuauclt.exe
3624 - cmd.exe
3672 - wuauclt.exe
3960 - usnsvc.exe

Total number of processes = 35
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\TUKERNEL.EXE
80724000 - \WINDOWS\system32\hal.dll
F7A6E000 - \WINDOWS\system32\KDCOM.DLL
F797E000 - \WINDOWS\system32\BOOTVID.dll
F751E000 - ACPI.sys
F7A70000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F74F8000 - d347bus.sys
F74E7000 - pci.sys
F756E000 - isapnp.sys
F73E7000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
F7B36000 - PCIIde.sys
F77EE000 - \WINDOWS\System32\Drivers\PCIIDEX.SYS
F7A72000 - ViaIde.sys
F757E000 - MountMgr.sys
F73C8000 - ftdisk.sys
F77F6000 - videX32.sys
F77FE000 - PartMgr.sys
F758E000 - VolSnap.sys
F73B0000 -
F7A74000 - d347prt.sys
F759E000 - disk.sys
F75AE000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F7391000 - fltMgr.sys
F737F000 - sr.sys
F7806000 - xfilt.sys
F75BE000 - PxHelp20.sys
F7368000 - KSecDD.sys
F72DB000 - Ntfs.sys
F72AE000 - NDIS.sys
F75CE000 - uagp35.sys
F7293000 - Mup.sys
F768E000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F6A0E000 - \SystemRoot\system32\DRIVERS\vtmini.sys
F69FA000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F769E000 - \SystemRoot\system32\DRIVERS\imapi.sys
F76AE000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F76BE000 - \SystemRoot\system32\DRIVERS\redbook.sys
F69D7000 - \SystemRoot\system32\DRIVERS\ks.sys
F7263000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F793E000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F69B4000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F7946000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F76CE000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F794E000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F7956000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F795E000 - \SystemRoot\system32\DRIVERS\fdc.sys
F69A0000 - \SystemRoot\system32\DRIVERS\parport.sys
F698F000 - \SystemRoot\system32\DRIVERS\serial.sys
F725B000 - \SystemRoot\system32\DRIVERS\serenum.sys
F65C7000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
F65A3000 - \SystemRoot\system32\drivers\portcls.sys
F76EE000 - \SystemRoot\system32\drivers\drmk.sys
F7C11000 - \SystemRoot\system32\DRIVERS\audstub.sys
F774E000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7257000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F658C000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F775E000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F776E000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F7966000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F657B000 - \SystemRoot\system32\DRIVERS\psched.sys
F777E000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F796E000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F7976000 - \SystemRoot\system32\DRIVERS\raspti.sys
F778E000 - \SystemRoot\system32\DRIVERS\termdd.sys
F7ABE000 - \SystemRoot\system32\DRIVERS\swenum.sys
F6547000 - \SystemRoot\system32\DRIVERS\update.sys
F6DE9000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F779E000 - \SystemRoot\system32\DRIVERS\cledx.sys
F77AE000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F77BE000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7AC2000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F784E000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
F7AC6000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7BB3000 - \SystemRoot\System32\Drivers\Null.SYS
F7AC8000 - \SystemRoot\System32\Drivers\Beep.SYS
F785E000 - \SystemRoot\System32\drivers\vga.sys
F7ACA000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7ACC000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F7866000 - \SystemRoot\System32\Drivers\Msfs.SYS
F786E000 - \SystemRoot\System32\Drivers\Npfs.SYS
F7A1A000 - \SystemRoot\system32\DRIVERS\rasacd.sys
F54EC000 - \SystemRoot\system32\DRIVERS\ipsec.sys
F5494000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F6ADA000 - \SystemRoot\System32\Drivers\aswtdi.SYS
F5473000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F6ACA000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F544B000 - \SystemRoot\system32\DRIVERS\netbt.sys
F5401000 - \SystemRoot\System32\drivers\afd.sys
F6ABA000 - \SystemRoot\system32\DRIVERS\netbios.sys
F53D5000 - \SystemRoot\system32\DRIVERS\rdbss.sys
F5366000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F6AAA000 - \SystemRoot\System32\Drivers\Fips.SYS
F52AF000 - \SystemRoot\System32\Drivers\aswsp.SYS
F787E000 - \SystemRoot\System32\Drivers\aavmker4.SYS
F6A9A000 - \SystemRoot\System32\drivers\84036a5a.sys
F525E000 - \SystemRoot\system32\DRIVERS\rt73.sys
F7886000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
F6A5A000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F5246000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7ADC000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F78C6000 - \SystemRoot\System32\watchdog.sys
F7267000 - \SystemRoot\System32\drivers\Dxapi.sys
BF9C1000 - \SystemRoot\System32\drivers\dxg.sys
F7B99000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D3000 - \SystemRoot\System32\vtdisp.dll
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
F78E6000 - \SystemRoot\system32\DRIVERS\aswFsBlk.sys
F7906000 - \SystemRoot\system32\DRIVERS\AegisP.sys
F0D0A000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
F0B68000 - \SystemRoot\System32\Drivers\aswmon2.SYS
F07F3000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
F7AEC000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F05E8000 - \SystemRoot\system32\DRIVERS\srv.sys
F050B000 - \SystemRoot\system32\drivers\wdmaud.sys
F04F3000 - \??\D:\WINDOWS\system32\drivers\tmcomm.sys
F08D0000 - \SystemRoot\system32\drivers\sysaudio.sys
F0456000 - \SystemRoot\system32\drivers\kmixer.sys
F0003000 - \SystemRoot\System32\Drivers\HTTP.sys
F04D3000 - \SystemRoot\System32\Drivers\aswrdr.SYS
F7C8E000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 121

Liste des programmes installes

avast! Antivirus
DAEMON Tools
HijackThis 2.0.2
MSN Pictures Displayer 4.5
Spybot - Search & Destroy

Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\Program Files

28/08/2008 12:59 <REP> .
28/08/2008 12:59 <REP> ..
12/03/2008 00:37 <REP> Adobe
31/03/2007 11:01 <REP> Alwil Software
25/08/2008 00:20 <REP> Anti Trojan Elite
18/02/2008 01:01 <REP> AOEMView 2008
17/04/2008 19:25 <REP> Apple Software Update
04/06/2008 17:55 <REP> ASIO4ALL v2
18/06/2008 22:35 <REP> Auralog
12/03/2008 00:37 <REP> Autodesk
16/06/2008 21:47 <REP> AviSynth 2.5
31/03/2007 10:49 <REP> AvRack
11/03/2008 23:59 <REP> Belkin
13/02/2008 16:13 <REP> Bonjour
04/04/2008 00:20 <REP> CamStudio
31/03/2007 11:16 <REP> CCleaner
06/08/2008 21:25 <REP> ComPlus Applications
17/03/2008 22:11 <REP> CVitae
05/03/2008 19:31 <REP> DivX
28/08/2008 12:39 <REP> D-Tools
18/02/2008 00:56 <REP> DWG TrueView 2007
13/08/2008 13:28 <REP> DynamicPhotoHDR
28/08/2008 13:26 <REP> eMule
25/08/2008 23:51 <REP> Fichiers communs
02/04/2007 10:50 <REP> Free
24/08/2008 20:04 <REP> Free Audio Pack
24/08/2008 20:07 <REP> Free Download Manager
12/01/2008 21:55 <REP> Free Easy Burner
05/03/2008 19:31 <REP> Freeplayer
09/09/2007 16:59 <REP> GrabIt
04/06/2008 17:59 <REP> GXTranscoderv5
24/08/2008 20:11 <REP> Image-Line
16/08/2008 11:13 <REP> Internet Explorer
16/08/2008 11:43 <REP> iPod
16/08/2008 11:43 <REP> iTunes
12/01/2008 01:40 <REP> Jasc Software Inc
31/07/2008 11:44 <REP> Java
16/08/2008 11:19 <REP> Konvertor
15/08/2008 23:39 <REP> Lavasoft
07/11/2007 20:56 <REP> Learning Essentials
24/08/2008 22:39 <REP> LeechGet 2007
05/04/2007 15:18 <REP> Logitech
22/08/2008 13:23 <REP> Malwarebytes' Anti-Malware
06/05/2007 10:34 <REP> Matroska Pack
16/08/2008 11:13 <REP> Messenger
30/03/2008 19:31 <REP> Messenger Plus! Live
06/02/2008 22:00 <REP> Microsoft CAPICOM 2.1.0.2
07/11/2007 21:00 <REP> Microsoft Etudes
31/03/2007 10:42 <REP> microsoft frontpage
18/02/2008 00:54 <REP> Microsoft Office
04/06/2008 20:09 <REP> Microsoft SQL Server
18/02/2008 01:00 <REP> Microsoft WSE
29/05/2007 16:28 <REP> MIKSOFT
16/08/2008 11:13 <REP> Movie Maker
28/08/2008 13:31 <REP> Mozilla Firefox
20/08/2008 22:17 <REP> MRU-Blaster
19/10/2007 19:08 <REP> MSN
31/03/2007 10:40 <REP> MSN Gaming Zone
30/03/2008 19:31 <REP> MSN Messenger
14/05/2008 23:40 <REP> MSN Pictures Displayer
06/02/2008 21:55 <REP> MSXML 4.0
06/02/2008 22:00 <REP> MSXML 6.0
12/01/2008 01:32 <REP> Nero
31/03/2007 10:41 <REP> NetMeeting
30/06/2007 14:01 <REP> Notepad++
31/03/2007 10:40 <REP> Online Services
16/08/2008 11:13 <REP> Outlook Express
04/06/2008 17:54 <REP> Outsim
14/08/2008 23:58 <REP> PhotomatixPro3
24/08/2008 20:31 <REP> Phun
17/08/2007 02:05 <REP> Pixoria
05/03/2008 19:31 <REP> QuickPar
13/07/2008 15:05 <REP> QuickTime
12/01/2008 01:42 <REP> RALINK
03/08/2008 23:16 <REP> Rapidown
31/03/2007 10:49 <REP> Realtek AC97
31/03/2007 10:49 <REP> Realtek Sound Manager
16/06/2008 21:47 <REP> Red Kawa
31/03/2007 11:16 <REP> RegCleaner
17/09/2007 20:13 <REP> Replay Converter
31/03/2007 10:50 <REP> S3
06/08/2008 21:25 <REP> Services en ligne
17/08/2008 21:24 <REP> Singular Inversions
12/06/2008 01:16 <REP> Sony
04/06/2008 20:06 <REP> Sony Setup
26/08/2008 01:36 <REP> Spybot - Search & Destroy
24/08/2007 23:24 <REP> Stardock
02/11/2007 00:57 <REP> Steinberg
05/03/2008 19:31 <REP> StuffPlug3
31/07/2008 11:44 <REP> Sun
09/08/2007 22:49 <REP> Syncrosoft
21/08/2008 18:05 <REP> TeaTimer (Spybot - Search & Destroy)
21/08/2008 17:46 <REP> The Cleaner Free
16/08/2008 01:31 <REP> Tiger System Preferences v2
20/08/2008 22:14 <REP> Trend Micro
21/08/2008 23:19 <REP> TuneUp Utilities 2008
24/08/2007 19:44 <REP> UxTheme Multipatcher Fr
31/03/2007 10:48 <REP> VIA
24/04/2007 15:03 <REP> VideoLAN
02/11/2007 00:56 <REP> VIRTUA~1
13/06/2008 00:32 <REP> VirtualDJ
29/05/2007 14:11 <REP> VSO
12/06/2008 01:16 <REP> VstPlugins
04/02/2008 19:48 <REP> Windows Live
18/08/2007 18:48 <REP> Windows Live Messenger
14/02/2008 18:47 <REP> Windows Live Safety Center
16/08/2008 11:13 <REP> Windows Media Player
16/08/2008 11:13 <REP> Windows NT
12/04/2007 19:32 <REP> WinOSX
16/08/2008 11:13 <REP> WinRAR
31/03/2007 10:42 <REP> xerox
23/01/2008 21:29 <REP> Yahoo!
25/08/2008 00:47 <REP> Zone Labs
0 fichier(s) 0 octets
113 Rép(s) 25 371 860 992 octets libres
Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\Program Files\fichiers communs

25/08/2008 23:51 <REP> .
25/08/2008 23:51 <REP> ..
10/02/2008 12:38 <REP> Adobe
19/04/2007 16:19 <REP> Adobe Systems Shared
12/01/2008 01:34 <REP> Ahead
24/12/2007 18:33 <REP> Apple
12/03/2008 00:37 <REP> Autodesk Shared
26/08/2008 00:51 <REP> BitDefender
18/02/2008 00:55 <REP> DESIGNER
01/04/2007 15:19 278 528 FDEUnInstaller.exe
05/04/2007 15:18 <REP> FotoWire
24/08/2008 20:02 <REP> GTK
05/04/2007 15:14 <REP> InstallShield
01/04/2007 16:43 <REP> Java
05/04/2007 15:17 <REP> Logitech
04/06/2008 19:44 <REP> Microsoft Shared
31/03/2007 10:41 <REP> MSSoap
31/03/2007 02:45 <REP> ODBC
09/06/2008 20:03 <REP> Real
31/03/2007 10:41 <REP> Services
31/03/2007 02:45 <REP> SpeechEngines
24/08/2007 23:24 <REP> Stardock
16/08/2008 11:13 <REP> System
15/08/2008 23:38 <REP> Wise Installation Wizard
09/06/2008 20:04 <REP> xing shared
1 fichier(s) 278 528 octets
24 Rép(s) 25 371 856 896 octets libres
Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\Program Files\fichiers communs\Microsoft Shared\Web Folders

17/04/2007 06:34 <REP> .
17/04/2007 06:34 <REP> ..
17/04/2007 06:34 <REP> 1033
17/04/2007 06:34 <REP> 1036
11/07/2003 10:15 1 292 872 MSONSEXT.DLL
15/07/2003 06:52 35 896 MSOSV.DLL
03/06/1999 12:09 122 937 MSOWS409.DLL
07/03/2001 07:00 127 033 MSOWS40c.DLL
11/07/2003 02:25 80 448 PKMWS.DLL
5 fichier(s) 1 659 186 octets
4 Rép(s) 25 371 856 896 octets libres

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_BASTIEN-4A08A9D.tar.gz a l'adresse http://upload.malekal.com

Voici le rapport SDfix:

[b]SDFix: Version 1.219 [/b]
Run by Bastien on 28/08/2008 at 14:28

Microsoft Windows XP [version 5.1.2600]
Running From: D:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 14:36:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\84036a5a]
"ImagePath"="\SystemRoot\System32\drivers\84036a5a.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ef,f2,0a,12,26,ae,29,49,83,47,c6,46,ce,90,2a,a0,f4,74,81,d0,56,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\84036a5a]
"ImagePath"="\SystemRoot\System32\drivers\84036a5a.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="D345C33F4FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DC038D530D6EB34525D575E7D6A3B98083228A2B30E74383986422BD4C427BC79F33AA7BDCB3ABBCBB27BA1F323898F524B908FCE1D84A779C11D71149A8B7A33D81D865CC99779855B808DCD04BA1DEF80081BA62E6B061B547D7811B5229BD7BB3995CE90C1CF6F7EF491B059DB66C3686F44DF7133514175E3E776B822162295C94765D53FD076737086AF0BDEB38EDADB6BF39DDBACA31FFE4AC04A3908DB21BCEE41CF87309DD73DAAB20029F2A7F515D9AEEBD7DE0C0EB510C39585B0675C34465A3A0948F78B5C1EF52515B4F91A18B7B11A0E53DA46A18BA2489D73B78B86677B54231530B1016887EA7131036D169370E95998040D8F75D71686585635BF53C2622C3703339171CC467FC15559F16134A00AE18C6B02E73335BE8B5E251DEE24ACEB74C1BBAA86FC2FF563960945F51B88610692322E64D460355C00691204E3FD2135523C9BD824A3FDB8826EDC0D94EF187FC371FD4BB1564EBF0056C33C1F267B87AC6768FEA2A2B507E5C0B7C3E52657EC63008CE615D8E04CB6820E2A44F9201ADE37C7712AB2AE3A23F50D1D2782BF13C877AE601CAFBBBE904A7F4095CD29440A66258E455BF05DB04EC27F46DE64565F3668C839A49BF70E4AD8592A01227C64F520974D2974A31AC876B40318CAC327DF7212B007B6794267922FEB710DE1362A8D30732D2863FBAAF86CF190EE09B1D83C151D2A346CD5C856E49B83DE345C0A7363BB7B6E9509FDCDB7FC2E40F8A84B658CEDE2AF1E065983FC4A9D80D7C8638E1EFBAD9C590810AE0F61D8A10BC4264597E18CBAFBA248AB60DEAC4ED680C4CCB2625F7CEE53F0874AADFE695AD69B643A1186D79B100995DB149F9ADD9D03D2D4EC324D3ED876F9A9C713622541217F5BE43300B4C6523C1FF96AA83D4D36F89F70CA40CE1AB9D7CD690B4DCEFCF009461AF81EA1519ECCBEF104346A503B488E93D07AD0AE182C3F1EDEDADD930B27AA43429364D12E2BB33469677EFAB18285D3F1981540B1B266C68D357D262EB21CC5FEB49FFB046E59491A6535B7FC1A4880DD26128DEC5C939918737C65E3B9915C20C71C98E6DF711298C1F004C5B77F3CC9A56068F2CCF71D84284D9A747B66149C0AC482E27D20C06D0636F079363A7FED8D3FB630DC2AAFDC54879F6D71DBCDEFAA2AAC45FA6C5BA3AFACA2C5246916084810F3551AA402ADEEE665A2C19241984F0018233FC33ECB2FA2D4A1C6621F5733D82D59C3C417886448ED2ACB14F6190D9D5F53637716786A095243945E9022A14305F24ECFCA841330D0DC20C9CCF7F2002EEFB6B966C1B8737DA6B8FAAF30D61EB1A2E26947BACC443A5A0405"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\Freeplayer\\vlc\\vlc.exe"="D:\\Program Files\\Freeplayer\\vlc\\vlc.exe:*:Enabled:VLC media player"
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"="D:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe"="D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe:*:Enabled:Age of Empires II"
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe"="D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="D:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Mon 7 Jul 2008 1,429,840 A.SHR --- "D:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 7 Jul 2008 4,891,472 A.SHR --- "D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 18 Aug 2008 1,832,272 A.SHR --- "D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Mon 18 Aug 2008 1,832,272 A.SHR --- "D:\Program Files\TeaTimer (Spybot - Search & Destroy)\TeaTimer.exe"
Fri 27 Apr 2007 4,348 ..SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 22 Jul 2002 418,816 A..HR --- "D:\WINDOWS\system32\Tools\All.exe"
Fri 19 Jul 2002 390,144 A..HR --- "D:\WINDOWS\system32\Tools\Change.exe"
Fri 19 Jul 2002 574,464 A..HR --- "D:\WINDOWS\system32\Tools\CheckPath.exe"
Tue 20 Aug 2002 430,592 A..HR --- "D:\WINDOWS\system32\Tools\Counter.exe"
Tue 23 Jul 2002 390,656 A..HR --- "D:\WINDOWS\system32\Tools\DelFolders.exe"
Fri 22 Nov 2002 399,872 A..HR --- "D:\WINDOWS\system32\Tools\DirectSetup.exe"
Fri 19 Jul 2002 388,096 A..HR --- "D:\WINDOWS\system32\Tools\RegClean.exe"
Fri 19 Jul 2002 388,608 A..HR --- "D:\WINDOWS\system32\Tools\Regexe.exe"
Mon 2 Dec 2002 431,616 A..HR --- "D:\WINDOWS\system32\Tools\Restart.exe"
Fri 19 Jul 2002 388,096 A..HR --- "D:\WINDOWS\system32\Tools\RunRegexe.exe"
Thu 7 Feb 2008 0 A..H. --- "D:\WINDOWS\SoftwareDistribution\Download\631bea423a2590540110f7e11fcbd692\BIT4.tmp"
Thu 28 Aug 2008 128,704,971 A..H. --- "D:\WINDOWS\SoftwareDistribution\Download\6ff23a5d87bf971de963d811b960e513\BIT212.tmp"
Thu 7 Aug 2008 0 A..H. --- "D:\WINDOWS\SoftwareDistribution\Download\8171d23d6d072d8b50d065ca55a754fb\BIT2.tmp"
Thu 7 Aug 2008 0 A..H. --- "D:\WINDOWS\SoftwareDistribution\Download\be077a0a5c65554c0fa221a5c8a0529b\BIT3.tmp"
Thu 7 Aug 2008 0 A..H. --- "D:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT1.tmp"
Mon 3 Mar 2008 19,968 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL0003.tmp"
Mon 3 Mar 2008 19,968 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL0005.tmp"
Thu 6 Mar 2008 20,480 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL0422.tmp"
Mon 10 Mar 2008 20,992 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL1070.tmp"
Mon 10 Mar 2008 22,016 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL1578.tmp"
Mon 3 Mar 2008 19,968 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL1867.tmp"
Thu 6 Mar 2008 20,480 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL2794.tmp"
Mon 3 Mar 2008 19,968 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\~WRL3037.tmp"
Mon 28 Jan 2008 19,968 A..H. --- "D:\Documents and Settings\Bastien\Mes documents\Divers\Tpe Romain - Bastien\Dossier TPE\4. D‚veloppement\~WRL0005.tmp"

[b]Finished![/b]

Et celui de HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:42, on 28/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\WINDOWS\system32\VTTimer.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\eMule\emule.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gettoggle.com/?q=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.onspeed.com/pac/?id=171a094db3fd991c99b8069d135128c7
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: G DATA WebFilter Class - {0124123d-61b4-456f-af86-78c53a0790c5} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [iTunes] D:\Program Files\iTunes\iTunes.exe
O4 - HKCU\..\Run: [Firefox] D:\Program Files\Mozilla Firefox\firefox.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MSN Pictures Displayer.lnk = D:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - D:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - D:\WINDOWS\System32\TuneUpDefragService.exe

Bon SDFix ne le supprime pas ... :-/

Fait ce-ci maintenant :

Télécharges MalwareByte's :
ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
ou ici : http://www.malwarebytes.org/mbam.php

Installes le ( choisis bien "francais" ; ne modifies pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

Potasses le tuto pour te familiariser avec le prg : https://forum.pcastuces.com/sujet.asp?f=31&s=3
( cela dis, il est très simple d'utilisation ).

Impératif : redémarres en mode sans échec :
Comment aller en Mode sans échec
1) Redémarres ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

Lances Malwarebyte's .

Fais un scan dit "complet" ( sélectionnes bien tous tes disks avant le scan ! ) et supprimes tout ce qu'il peut trouver, c'est à dire :
-->Laisses le scan se terminer,puis à la fin tu cliques sur "résultat" .
-->Vérifies que tous les objets infectés soient validés, puis cliques sur " suppression " .

Redémarres ton PC ( mode normal ).

Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...

Désolé de répondre que maintenant.

Voici le rapport de MalwareByte's :

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1092
Windows 5.1.2600 Service Pack 2

16:48:30 29/08/2008
mbam-log-08-29-2008 (16-48-30).txt

Type de recherche: Examen complet (D:\|)
Eléments examinés: 140001
Temps écoulé: 1 hour(s), 35 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
D:\System Volume Information\_restore{BEB54AA9-5B91-48A1-AE49-EC636F2B45EC}\RP84\A0020451.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

Et voici celui d'HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:42, on 29/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\WINDOWS\system32\VTTimer.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\iTunes\iTunes.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\eMule\emule.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\distnoted.exe
D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\TuneUp Utilities 2008\OneClick.exe
D:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
D:\WINDOWS\System32\TuneUpDefragService.exe
D:\Program Files\Windows Media Player\wmplayer.exe
D:\WINDOWS\system32\divxsm.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gettoggle.com/?q=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.onspeed.com/pac/?id=171a094db3fd991c99b8069d135128c7
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: G DATA WebFilter Class - {0124123d-61b4-456f-af86-78c53a0790c5} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [iTunes] D:\Program Files\iTunes\iTunes.exe
O4 - HKCU\..\Run: [Firefox] D:\Program Files\Mozilla Firefox\firefox.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [Uniblue SpyEraser] "D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MSN Pictures Displayer.lnk = D:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - D:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - D:\WINDOWS\System32\TuneUpDefragService.exe

Fais exactement ce qui suit :

Télécharges ComboFix (par sUBs) sur ton Bureau (et pas ailleur !):
http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnectes toi,fermes tes applications en cours et DESACTIVES TOUTES TES DEFENSES (anti-virus, guardes anti spy-ware, pare-feu) le temps de la manipe :
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :
double-cliques C-Fix.exe ( = combofix.exe ) .

Appuyes sur la touche Y (Yes) pour démarrer le scan .

Attention :
--> n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi .
--> Il se peut que le PC redémarre de lui même ( pour finaliser le nettoyage ) , laisses le faire .
--> si un message d'erreur windows apparait à un momment : clik sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

Le rapport sera crée dans: C:\Combofix.txt

Postes le rapport Combofix pour analyse ...

Voila j'ai fait exactement tout ce que tu m'avait dit, j'ai même coupé le pare-feu Windows, Avast etc... et rien touché durant l'analyse.

Voici le rapport:

ComboFix 08-08-28.06 - Bastien 2008-08-29 21:10:30.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.550 [GMT 2:00]
Endroit: D:\Documents and Settings\Bastien\Bureau\C-Fix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.

2008-08-29 21:07 . 2008-08-29 21:07 <REP> d-------- D:\Program Files\PSCS2Updater
2008-08-29 20:59 . 2008-08-29 20:59 <REP> d-------- D:\BRIDGE_INSTALL_LOCATION
2008-08-29 14:08 . 2008-08-29 14:08 <REP> d-------- D:\Program Files\Uniblue
2008-08-29 14:08 . 2008-08-29 21:03 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\Uniblue
2008-08-29 14:08 . 2008-08-29 21:03 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Uniblue
2008-08-29 11:23 . 2007-01-18 14:00 3,968 --a------ D:\WINDOWS\system32\drivers\AvgArCln.sys
2008-08-28 14:24 . 2008-08-28 14:25 <REP> d-------- D:\WINDOWS\ERUNT
2008-08-28 14:17 . 2008-08-28 14:40 <REP> d-------- D:\SDFix
2008-08-28 12:40 . 2008-08-28 12:59 2,446 --a------ D:\Documents and Settings\Orph.egd
2008-08-28 12:39 . 2008-08-28 13:00 <REP> d-------- D:\ToolBar SD
2008-08-28 12:39 . 2008-08-28 12:39 <REP> d-------- D:\Program Files\D-Tools
2008-08-26 02:05 . 2008-08-29 11:44 <REP> d-------- D:\WINDOWS\BDOSCAN8
2008-08-26 00:22 . 2008-08-26 00:51 121 --a------ D:\WINDOWS\bdagent.INI
2008-08-26 00:16 . 2008-08-26 00:16 81,984 --a------ D:\WINDOWS\system32\bdod.bin
2008-08-25 23:51 . 2008-08-26 00:51 <REP> d-------- D:\Program Files\Fichiers communs\BitDefender
2008-08-25 15:19 . 2008-08-25 15:19 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\ESET
2008-08-25 15:15 . 2008-08-25 15:15 <REP> d-------- D:\Documents and Settings\All Users\Application Data\ESET
2008-08-25 13:29 . 2008-08-25 13:29 47,184 --a------ D:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-08-25 00:49 . 2008-08-25 00:49 <REP> d-------- D:\Documents and Settings\All Users\Application Data\MailFrontier
2008-08-25 00:49 . 2008-08-25 00:51 4,212 ---h----- D:\WINDOWS\system32\zllictbl.dat
2008-08-25 00:48 . 2007-05-31 00:03 110,360 --a------ D:\WINDOWS\system32\drivers\kl1.sys
2008-08-25 00:48 . 2007-06-21 21:55 54,672 --a------ D:\WINDOWS\system32\vsutil_loc040c.dll
2008-08-25 00:48 . 2007-06-21 21:55 42,384 --a------ D:\WINDOWS\zllsputility_loc040c.dll
2008-08-25 00:48 . 2007-06-21 21:55 21,904 --a------ D:\WINDOWS\system32\imsinstall_loc040c.dll
2008-08-25 00:48 . 2007-06-21 21:55 17,808 --a------ D:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-08-25 00:48 . 2004-04-27 04:40 11,264 --a------ D:\WINDOWS\system32\SpOrder.dll
2008-08-25 00:47 . 2008-08-26 00:49 <REP> d-------- D:\WINDOWS\system32\ZoneLabs
2008-08-25 00:47 . 2008-08-26 01:33 <REP> d-------- D:\WINDOWS\Internet Logs
2008-08-25 00:47 . 2008-08-25 00:47 <REP> d-------- D:\Program Files\Zone Labs
2008-08-24 21:48 . 2008-08-25 00:20 <REP> d-------- D:\Program Files\Anti Trojan Elite
2008-08-22 13:23 . 2008-08-22 13:23 <REP> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-08-22 13:23 . 2008-08-22 13:23 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\Malwarebytes
2008-08-22 13:23 . 2008-08-22 13:23 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-22 13:23 . 2008-08-17 15:01 38,472 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-22 13:23 . 2008-08-17 15:01 17,144 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-08-21 23:18 . 2008-08-28 13:28 51,200 --ahs---- D:\WINDOWS\Thumbs.db
2008-08-21 23:18 . 2008-08-28 15:09 5,120 --ahs---- D:\WINDOWS\system32\Thumbs.db
2008-08-21 18:05 . 2008-08-21 18:05 <REP> d-------- D:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-21 01:31 . 2008-08-24 20:12 <REP> d-------- D:\WINDOWS\system32\KRINK screensaver dir
2008-08-20 22:52 . 2004-08-05 14:00 68,608 --a--c--- D:\WINDOWS\system32\dllcache\plugin.ocx
2008-08-20 22:20 . 2008-08-20 22:20 5,376 --a------ D:\WINDOWS\system32\drivers\MS1000.sys
2008-08-20 22:19 . 2008-08-21 17:46 <REP> d-------- D:\Program Files\The Cleaner Free
2008-08-20 22:17 . 2008-08-20 22:17 <REP> d-------- D:\Program Files\MRU-Blaster
2008-08-20 22:14 . 2008-08-20 22:14 <REP> d-------- D:\Program Files\Trend Micro
2008-08-20 22:09 . 2008-08-20 22:09 <REP> d-------- D:\WINDOWS\system32\FLIQLO dir
2008-08-20 03:27 . 2008-08-20 22:09 532,480 --a------ D:\WINDOWS\system32\FLIQLO.scr
2008-08-19 22:23 . 2008-08-19 23:44 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\DMCache
2008-08-19 21:30 . 2008-08-19 22:02 <REP> d-a------ D:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 21:30 . 2008-08-19 22:02 <REP> d-------- D:\Documents and Settings\All Users\Application Data\SpeedBit
2008-08-19 14:27 . 2008-08-19 14:27 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\AdobeUM
2008-08-19 02:20 . 2008-08-19 12:18 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\SlipStream
2008-08-18 13:46 . 2008-08-18 13:46 <REP> d-------- D:\Documents and Settings\Bastien\WINDOWS
2008-08-17 22:38 . 2008-08-24 22:39 <REP> d-------- D:\Program Files\LeechGet 2007
2008-08-17 21:24 . 2008-08-17 21:24 <REP> d-------- D:\Program Files\Singular Inversions
2008-08-16 11:43 . 2008-08-16 11:43 <REP> d-------- D:\Program Files\iPod
2008-08-16 00:09 . 2008-08-16 01:31 <REP> d-------- D:\Program Files\Tiger System Preferences v2
2008-08-16 00:04 . 2004-08-17 22:52 219,648 --a------ D:\WINDOWS\system32\uxtheme.backup
2008-08-15 23:39 . 2008-08-15 23:39 <REP> d-------- D:\Program Files\Lavasoft
2008-08-15 23:39 . 2008-08-15 23:53 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-14 23:40 . 2008-08-14 23:40 108,336 --------- D:\WINDOWS\system32\mswinsck.ocx
2008-08-14 23:40 . 2008-08-14 23:40 15,872 --------- D:\WINDOWS\system32\winskfr.dll
2008-08-13 13:29 . 2008-08-14 23:58 <REP> d-------- D:\Program Files\PhotomatixPro3
2008-08-13 13:18 . 2008-08-13 13:28 <REP> d-------- D:\Program Files\DynamicPhotoHDR
2008-08-06 23:12 . 2008-06-14 19:59 272,768 --------- D:\WINDOWS\system32\drivers\bthport.sys
2008-08-06 23:12 . 2008-06-14 19:59 272,768 --a--c--- D:\WINDOWS\system32\dllcache\bthport.sys
2008-08-06 22:24 . 2001-08-17 21:28 771,581 --a--c--- D:\WINDOWS\system32\dllcache\winacisa.sys
2008-08-06 22:23 . 2001-08-17 21:28 794,654 --a--c--- D:\WINDOWS\system32\dllcache\usr1801.sys
2008-08-06 22:22 . 2001-08-23 17:47 525,568 --a--c--- D:\WINDOWS\system32\dllcache\tridxp.dll
2008-08-06 22:21 . 2001-08-23 17:46 172,768 --a--c--- D:\WINDOWS\system32\dllcache\t2r4disp.dll
2008-08-06 22:20 . 2001-08-23 16:57 286,848 --a--c--- D:\WINDOWS\system32\dllcache\stlnata.sys
2008-08-06 22:19 . 2004-08-03 22:41 404,990 --a--c--- D:\WINDOWS\system32\dllcache\slntamr.sys
2008-08-06 22:18 . 2001-08-23 17:46 386,560 --a--c--- D:\WINDOWS\system32\dllcache\sgiul50.dll
2008-08-06 22:17 . 2001-08-23 17:47 495,616 --a--c--- D:\WINDOWS\system32\dllcache\sblfx.dll
2008-08-06 22:16 . 2001-08-23 17:18 899,914 --a--c--- D:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-08-06 22:15 . 2004-08-04 00:54 363,520 --a--c--- D:\WINDOWS\system32\dllcache\psisdecd.dll
2008-08-06 22:14 . 2001-08-17 22:05 351,616 --a--c--- D:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-08-06 22:13 . 2004-08-04 00:54 4,274,816 --a--c--- D:\WINDOWS\system32\dllcache\nv4_disp.dll
2008-08-06 22:12 . 2004-08-04 00:54 1,737,856 --a--c--- D:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-08-06 22:11 . 2001-08-17 21:28 802,683 --a--c--- D:\WINDOWS\system32\dllcache\ltsm.sys
2008-08-06 22:10 . 2001-08-23 17:47 242,688 --a--c--- D:\WINDOWS\system32\dllcache\kdsusd.dll
2008-08-06 22:09 . 2004-08-04 00:54 702,845 --a--c--- D:\WINDOWS\system32\dllcache\i81xdnt5.dll
2008-08-06 22:08 . 2004-08-03 22:41 1,041,536 --a--c--- D:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-08-06 22:07 . 2001-08-23 17:46 1,733,120 --a--c--- D:\WINDOWS\system32\dllcache\g400d.dll
2008-08-06 22:06 . 2001-08-23 17:16 596,319 --a--c--- D:\WINDOWS\system32\dllcache\es56cvmp.sys
2008-08-06 22:05 . 2001-08-17 20:14 952,007 --a--c--- D:\WINDOWS\system32\dllcache\diwan.sys
2008-08-06 22:04 . 2001-08-23 17:47 622,621 --a--c--- D:\WINDOWS\system32\dllcache\digiview.exe
2008-08-06 22:03 . 2001-08-23 17:04 980,034 --a--c--- D:\WINDOWS\system32\dllcache\cicap.sys
2008-08-06 22:02 . 2004-08-04 00:54 1,888,992 --a--c--- D:\WINDOWS\system32\dllcache\ati3duag.dll
2008-08-06 22:01 . 2004-08-04 00:49 2,183,040 --a--c--- D:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-06 21:27 . 2004-08-05 14:00 10,096,640 --a--c--- D:\WINDOWS\system32\dllcache\hwxcht.dll
2008-08-06 21:25 . 2008-08-06 21:25 <REP> d-------- D:\Program Files\Services en ligne
2008-08-06 21:25 . 2004-11-24 21:03 749 -rah----- D:\WINDOWS\WindowsShell.Manifest
2008-08-06 21:25 . 2008-08-06 21:25 749 -rah----- D:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-06 21:25 . 2008-08-06 21:25 749 -rah----- D:\WINDOWS\system32\sapi.cpl.manifest
2008-08-06 21:25 . 2008-08-06 21:25 749 -rah----- D:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-06 21:25 . 2008-08-06 21:25 488 -rah----- D:\WINDOWS\system32\logonui.exe.manifest
2008-08-05 00:36 . 2008-08-05 00:36 151 --a------ D:\WINDOWS\PhotoSnapViewer.INI
2008-07-31 11:44 . 2008-07-31 11:44 <REP> d-------- D:\Program Files\Sun

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 18:02 --------- d-----w D:\Program Files\eMule
2008-08-26 08:15 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-25 23:36 --------- d-----w D:\Program Files\Spybot - Search & Destroy
2008-08-25 11:24 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-08-24 20:05 --------- d-----w D:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-24 18:31 --------- d-----w D:\Program Files\Phun
2008-08-24 18:11 --------- d-----w D:\Program Files\Image-Line
2008-08-24 18:07 --------- d-----w D:\Program Files\Free Download Manager
2008-08-24 18:04 --------- d-----w D:\Program Files\Free Audio Pack
2008-08-24 18:02 --------- d-----w D:\Program Files\Fichiers communs\GTK
2008-08-21 21:19 --------- d-----w D:\Program Files\TuneUp Utilities 2008
2008-08-21 21:18 307,968 ----a-w D:\WINDOWS\system32\TuneUpDefragService.exe
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Notepad++
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\GrabIt
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Azureus
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Autodesk
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Apple Computer
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Address Book
2008-08-16 09:43 --------- d-----w D:\Program Files\iTunes
2008-08-16 09:19 --------- d-----w D:\Program Files\Konvertor
2008-08-15 21:38 --------- d-----w D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-03 21:16 --------- d-----w D:\Program Files\Rapidown
2008-07-31 09:44 --------- d-----w D:\Program Files\Java
2008-07-13 13:05 --------- d-----w D:\Program Files\QuickTime
2008-06-20 17:41 247,808 ----a-w D:\WINDOWS\system32\mswsock.dll
2007-05-29 12:11 87,608 ----a-w D:\Documents and Settings\Bastien\Application Data\ezpinst.exe
2007-05-29 12:11 47,360 ----a-w D:\Documents and Settings\Bastien\Application Data\pcouffin.sys
2007-04-01 13:19 278,528 ----a-w D:\Program Files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="D:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:55 5674352]
"updateMgr"="D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
"iTunes"="D:\Program Files\iTunes\iTunes.exe" [2008-07-30 10:47 20252968]
"Firefox"="D:\Program Files\Mozilla Firefox\firefox.exe" [2008-07-31 19:17 307712]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
"eMuleAutoStart"="D:\Program Files\eMule\emule.exe" [2008-08-01 19:41 5480448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"LVCOMSX"="D:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"TkBellExe"="D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-06-09 20:03 185896]
"AppleSyncNotifier"="D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"VTTimer"="VTTimer.exe" [2005-03-07 21:33 53248 D:\WINDOWS\system32\VTTimer.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 10:22 577536 D:\WINDOWS\soundman.exe]

D:\Documents and Settings\Bastien\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
MSN Pictures Displayer.lnk - D:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-04-16 00:29:07 4571136]

D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-04-05 15:16:35 450560]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"eMuleAutoStart"=D:\Program Files\eMule\emule.exe -AutoStart
"L07FXLRD_14486375"="D:\Program Files\Microsoft Etudes\Microsoft Encarta 2007 - Études DVD\EDICT.EXE" -m
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
"LogitechSoftwareUpdate"="D:\Program Files\Logitech\Video\ManifestEngine.exe" boot
"Outlook Express"=D:\Program Files\Outlook Express\msimn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LogitechVideoRepair"=D:\Program Files\Logitech\Video\ISStart.exe
"IMJPMIG8.1"="D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"LogitechVideoTray"=D:\Program Files\Logitech\Video\LogiTray.exe
"VTTrayp"=VTtrayp.exe
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=D:\WINDOWS\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\eMule\\emule.exe"=
"D:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe"=
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe"=
"D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16799:TCP"= 16799:TCP:BitComet 16799 TCP
"16799:UDP"= 16799:UDP:BitComet 16799 UDP
"8080:TCP"= 8080:TCP:freeplayer.freebox.fr
"57016:TCP"= 57016:TCP:Pando P2P TCP Listening Port
"57016:UDP"= 57016:UDP:Pando P2P UDP Listening Port

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 videX32;videX32;D:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;D:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
R1 aswsp;avast! Self Protection;D:\WINDOWS\system32\drivers\aswsp.sys [2008-07-19 16:35]
R2 aswfsblk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 UxTuneUp;TuneUp Extension de thème;D:\WINDOWS\System32\svchost.exe [2004-08-05 14:00]
R3 CLEDX;Team H2O CLEDX service;D:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;D:\WINDOWS\System32\TuneUpDefragService.exe [2008-08-21 23:18]
S1 84036a5a;84036a5a;D:\WINDOWS\system32\drivers\84036a5a.sys []
S3 ate_procmon;ATE_PROCMON;D:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-11-02 12:53]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-04-17 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-29 D:\WINDOWS\Tasks\Maintenance en 1 clic.job
- D:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-27 19:00]

2008-08-29 D:\WINDOWS\Tasks\Uniblue SpyEraser Nag.job
- D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe []

2008-08-29 D:\WINDOWS\Tasks\Uniblue SpyEraser.job
- D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe []
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - D:\Documents and Settings\Bastien\Application Data\Mozilla\Firefox\Profiles\u5opj8fc.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.magicmanu.com/
FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF -: plugin - D:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - D:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 21:12:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-29 21:13:05
ComboFix-quarantined-files.txt 2008-08-29 19:12:50

Pre-Run: 24,252,637,184 octets libres
Post-Run: 24,241,303,552 octets libres

254 --- E O F --- 2008-08-28 23:36:07

bien ....la suite :

1-Crées un doc texte sur ton bureau :
pointes ta souris sur ton bureau , cliques droit : vas dans "nouveau" et choisis "document texte" .

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer :

Driver::
84036a5a

File::
D:\Documents and Settings\Bastien\Application Data\ezpinst.exe
D:\WINDOWS\system32\drivers\84036a5a.sys

Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...

2-Nettoyage :

!! Déconnectes toi, fermes toutes tes applications et désactives TOUTES TES DEFENSES ( tu les réactiveras après ) !!

--->Sur ton bureau, fais un glissé avec ta souris le fichier CFScript sur l'icône de ComboFix.exe .

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tapes 1 puis valide.

Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

!! Ne touches à rien tant que le scan n'est pas terminé !!

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.

Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

Ok donc voici le rapport de ComboFix:

ComboFix 08-08-28.06 - Bastien 2008-08-29 23:04:12.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.562 [GMT 2:00]
Endroit: D:\Documents and Settings\Bastien\Bureau\C-Fix.exe
Command switches used :: D:\Documents and Settings\Bastien\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
D:\Documents and Settings\Bastien\Application Data\ezpinst.exe
D:\WINDOWS\system32\drivers\84036a5a.sys
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Documents and Settings\Bastien\Application Data\ezpinst.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_84036a5a

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))))))))
.

2008-08-29 21:07 . 2008-08-29 21:07 <REP> d-------- D:\Program Files\PSCS2Updater
2008-08-29 20:59 . 2008-08-29 20:59 <REP> d-------- D:\BRIDGE_INSTALL_LOCATION
2008-08-29 14:08 . 2008-08-29 14:08 <REP> d-------- D:\Program Files\Uniblue
2008-08-29 14:08 . 2008-08-29 21:03 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\Uniblue
2008-08-29 14:08 . 2008-08-29 21:03 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Uniblue
2008-08-29 11:23 . 2007-01-18 14:00 3,968 --a------ D:\WINDOWS\system32\drivers\AvgArCln.sys
2008-08-28 14:24 . 2008-08-28 14:25 <REP> d-------- D:\WINDOWS\ERUNT
2008-08-28 14:17 . 2008-08-28 14:40 <REP> d-------- D:\SDFix
2008-08-28 12:40 . 2008-08-28 12:59 2,446 --a------ D:\Documents and Settings\Orph.egd
2008-08-28 12:39 . 2008-08-28 13:00 <REP> d-------- D:\ToolBar SD
2008-08-28 12:39 . 2008-08-28 12:39 <REP> d-------- D:\Program Files\D-Tools
2008-08-26 02:05 . 2008-08-29 11:44 <REP> d-------- D:\WINDOWS\BDOSCAN8
2008-08-26 00:22 . 2008-08-26 00:51 121 --a------ D:\WINDOWS\bdagent.INI
2008-08-26 00:16 . 2008-08-26 00:16 81,984 --a------ D:\WINDOWS\system32\bdod.bin
2008-08-25 23:51 . 2008-08-26 00:51 <REP> d-------- D:\Program Files\Fichiers communs\BitDefender
2008-08-25 15:19 . 2008-08-25 15:19 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\ESET
2008-08-25 15:15 . 2008-08-25 15:15 <REP> d-------- D:\Documents and Settings\All Users\Application Data\ESET
2008-08-25 13:29 . 2008-08-25 13:29 47,184 --a------ D:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-08-25 00:49 . 2008-08-25 00:49 <REP> d-------- D:\Documents and Settings\All Users\Application Data\MailFrontier
2008-08-25 00:49 . 2008-08-25 00:51 4,212 ---h----- D:\WINDOWS\system32\zllictbl.dat
2008-08-25 00:48 . 2007-05-31 00:03 110,360 --a------ D:\WINDOWS\system32\drivers\kl1.sys
2008-08-25 00:48 . 2007-06-21 21:55 54,672 --a------ D:\WINDOWS\system32\vsutil_loc040c.dll
2008-08-25 00:48 . 2007-06-21 21:55 42,384 --a------ D:\WINDOWS\zllsputility_loc040c.dll
2008-08-25 00:48 . 2007-06-21 21:55 21,904 --a------ D:\WINDOWS\system32\imsinstall_loc040c.dll
2008-08-25 00:48 . 2007-06-21 21:55 17,808 --a------ D:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-08-25 00:48 . 2004-04-27 04:40 11,264 --a------ D:\WINDOWS\system32\SpOrder.dll
2008-08-25 00:47 . 2008-08-26 00:49 <REP> d-------- D:\WINDOWS\system32\ZoneLabs
2008-08-25 00:47 . 2008-08-26 01:33 <REP> d-------- D:\WINDOWS\Internet Logs
2008-08-25 00:47 . 2008-08-25 00:47 <REP> d-------- D:\Program Files\Zone Labs
2008-08-24 21:48 . 2008-08-25 00:20 <REP> d-------- D:\Program Files\Anti Trojan Elite
2008-08-22 13:23 . 2008-08-22 13:23 <REP> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-08-22 13:23 . 2008-08-22 13:23 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\Malwarebytes
2008-08-22 13:23 . 2008-08-22 13:23 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-22 13:23 . 2008-08-17 15:01 38,472 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-22 13:23 . 2008-08-17 15:01 17,144 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-08-21 23:18 . 2008-08-28 13:28 51,200 --ahs---- D:\WINDOWS\Thumbs.db
2008-08-21 23:18 . 2008-08-28 15:09 5,120 --ahs---- D:\WINDOWS\system32\Thumbs.db
2008-08-21 18:05 . 2008-08-21 18:05 <REP> d-------- D:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-21 01:31 . 2008-08-24 20:12 <REP> d-------- D:\WINDOWS\system32\KRINK screensaver dir
2008-08-20 22:52 . 2004-08-05 14:00 68,608 --a--c--- D:\WINDOWS\system32\dllcache\plugin.ocx
2008-08-20 22:20 . 2008-08-20 22:20 5,376 --a------ D:\WINDOWS\system32\drivers\MS1000.sys
2008-08-20 22:19 . 2008-08-21 17:46 <REP> d-------- D:\Program Files\The Cleaner Free
2008-08-20 22:17 . 2008-08-20 22:17 <REP> d-------- D:\Program Files\MRU-Blaster
2008-08-20 22:14 . 2008-08-20 22:14 <REP> d-------- D:\Program Files\Trend Micro
2008-08-20 22:09 . 2008-08-20 22:09 <REP> d-------- D:\WINDOWS\system32\FLIQLO dir
2008-08-20 03:27 . 2008-08-20 22:09 532,480 --a------ D:\WINDOWS\system32\FLIQLO.scr
2008-08-19 22:23 . 2008-08-19 23:44 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\DMCache
2008-08-19 21:30 . 2008-08-19 22:02 <REP> d-a------ D:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 21:30 . 2008-08-19 22:02 <REP> d-------- D:\Documents and Settings\All Users\Application Data\SpeedBit
2008-08-19 14:27 . 2008-08-19 14:27 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\AdobeUM
2008-08-19 02:20 . 2008-08-19 12:18 <REP> d-------- D:\Documents and Settings\Bastien\Application Data\SlipStream
2008-08-18 13:46 . 2008-08-18 13:46 <REP> d-------- D:\Documents and Settings\Bastien\WINDOWS
2008-08-17 22:38 . 2008-08-24 22:39 <REP> d-------- D:\Program Files\LeechGet 2007
2008-08-17 21:24 . 2008-08-17 21:24 <REP> d-------- D:\Program Files\Singular Inversions
2008-08-16 11:43 . 2008-08-16 11:43 <REP> d-------- D:\Program Files\iPod
2008-08-16 00:09 . 2008-08-16 01:31 <REP> d-------- D:\Program Files\Tiger System Preferences v2
2008-08-16 00:04 . 2004-08-17 22:52 219,648 --a------ D:\WINDOWS\system32\uxtheme.backup
2008-08-15 23:39 . 2008-08-15 23:39 <REP> d-------- D:\Program Files\Lavasoft
2008-08-15 23:39 . 2008-08-15 23:53 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-14 23:40 . 2008-08-14 23:40 108,336 --------- D:\WINDOWS\system32\mswinsck.ocx
2008-08-14 23:40 . 2008-08-14 23:40 15,872 --------- D:\WINDOWS\system32\winskfr.dll
2008-08-13 13:29 . 2008-08-14 23:58 <REP> d-------- D:\Program Files\PhotomatixPro3
2008-08-13 13:18 . 2008-08-13 13:28 <REP> d-------- D:\Program Files\DynamicPhotoHDR
2008-08-06 23:12 . 2008-06-14 19:59 272,768 --------- D:\WINDOWS\system32\drivers\bthport.sys
2008-08-06 23:12 . 2008-06-14 19:59 272,768 --a--c--- D:\WINDOWS\system32\dllcache\bthport.sys
2008-08-06 22:24 . 2001-08-17 21:28 771,581 --a--c--- D:\WINDOWS\system32\dllcache\winacisa.sys
2008-08-06 22:23 . 2001-08-17 21:28 794,654 --a--c--- D:\WINDOWS\system32\dllcache\usr1801.sys
2008-08-06 22:22 . 2001-08-23 17:47 525,568 --a--c--- D:\WINDOWS\system32\dllcache\tridxp.dll
2008-08-06 22:21 . 2001-08-23 17:46 172,768 --a--c--- D:\WINDOWS\system32\dllcache\t2r4disp.dll
2008-08-06 22:20 . 2001-08-23 16:57 286,848 --a--c--- D:\WINDOWS\system32\dllcache\stlnata.sys
2008-08-06 22:19 . 2004-08-03 22:41 404,990 --a--c--- D:\WINDOWS\system32\dllcache\slntamr.sys
2008-08-06 22:18 . 2001-08-23 17:46 386,560 --a--c--- D:\WINDOWS\system32\dllcache\sgiul50.dll
2008-08-06 22:17 . 2001-08-23 17:47 495,616 --a--c--- D:\WINDOWS\system32\dllcache\sblfx.dll
2008-08-06 22:16 . 2001-08-23 17:18 899,914 --a--c--- D:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-08-06 22:15 . 2004-08-04 00:54 363,520 --a--c--- D:\WINDOWS\system32\dllcache\psisdecd.dll
2008-08-06 22:14 . 2001-08-17 22:05 351,616 --a--c--- D:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-08-06 22:13 . 2004-08-04 00:54 4,274,816 --a--c--- D:\WINDOWS\system32\dllcache\nv4_disp.dll
2008-08-06 22:12 . 2004-08-04 00:54 1,737,856 --a--c--- D:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-08-06 22:11 . 2001-08-17 21:28 802,683 --a--c--- D:\WINDOWS\system32\dllcache\ltsm.sys
2008-08-06 22:10 . 2001-08-23 17:47 242,688 --a--c--- D:\WINDOWS\system32\dllcache\kdsusd.dll
2008-08-06 22:09 . 2004-08-04 00:54 702,845 --a--c--- D:\WINDOWS\system32\dllcache\i81xdnt5.dll
2008-08-06 22:08 . 2004-08-03 22:41 1,041,536 --a--c--- D:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-08-06 22:07 . 2001-08-23 17:46 1,733,120 --a--c--- D:\WINDOWS\system32\dllcache\g400d.dll
2008-08-06 22:06 . 2001-08-23 17:16 596,319 --a--c--- D:\WINDOWS\system32\dllcache\es56cvmp.sys
2008-08-06 22:05 . 2001-08-17 20:14 952,007 --a--c--- D:\WINDOWS\system32\dllcache\diwan.sys
2008-08-06 22:04 . 2001-08-23 17:47 622,621 --a--c--- D:\WINDOWS\system32\dllcache\digiview.exe
2008-08-06 22:03 . 2001-08-23 17:04 980,034 --a--c--- D:\WINDOWS\system32\dllcache\cicap.sys
2008-08-06 22:02 . 2004-08-04 00:54 1,888,992 --a--c--- D:\WINDOWS\system32\dllcache\ati3duag.dll
2008-08-06 22:01 . 2004-08-04 00:49 2,183,040 --a--c--- D:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-06 21:27 . 2004-08-05 14:00 10,096,640 --a--c--- D:\WINDOWS\system32\dllcache\hwxcht.dll
2008-08-06 21:25 . 2008-08-06 21:25 <REP> d-------- D:\Program Files\Services en ligne
2008-08-06 21:25 . 2004-11-24 21:03 749 -rah----- D:\WINDOWS\WindowsShell.Manifest
2008-08-06 21:25 . 2008-08-06 21:25 749 -rah----- D:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-06 21:25 . 2008-08-06 21:25 749 -rah----- D:\WINDOWS\system32\sapi.cpl.manifest
2008-08-06 21:25 . 2008-08-06 21:25 749 -rah----- D:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-06 21:25 . 2008-08-06 21:25 488 -rah----- D:\WINDOWS\system32\logonui.exe.manifest
2008-08-05 00:36 . 2008-08-05 00:36 151 --a------ D:\WINDOWS\PhotoSnapViewer.INI
2008-07-31 11:44 . 2008-07-31 11:44 <REP> d-------- D:\Program Files\Sun

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 21:09 --------- d-----w D:\Program Files\eMule
2008-08-26 08:15 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-25 23:36 --------- d-----w D:\Program Files\Spybot - Search & Destroy
2008-08-25 11:24 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-08-24 20:05 --------- d-----w D:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-24 18:31 --------- d-----w D:\Program Files\Phun
2008-08-24 18:11 --------- d-----w D:\Program Files\Image-Line
2008-08-24 18:07 --------- d-----w D:\Program Files\Free Download Manager
2008-08-24 18:04 --------- d-----w D:\Program Files\Free Audio Pack
2008-08-24 18:02 --------- d-----w D:\Program Files\Fichiers communs\GTK
2008-08-21 21:19 --------- d-----w D:\Program Files\TuneUp Utilities 2008
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Notepad++
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\GrabIt
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Azureus
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Autodesk
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Apple Computer
2008-08-19 10:18 --------- d-----w D:\Documents and Settings\Bastien\Application Data\Address Book
2008-08-16 09:43 --------- d-----w D:\Program Files\iTunes
2008-08-16 09:19 --------- d-----w D:\Program Files\Konvertor
2008-08-15 21:38 --------- d-----w D:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-03 21:16 --------- d-----w D:\Program Files\Rapidown
2008-07-31 09:44 --------- d-----w D:\Program Files\Java
2008-07-13 13:05 --------- d-----w D:\Program Files\QuickTime
2007-05-29 12:11 47,360 ----a-w D:\Documents and Settings\Bastien\Application Data\pcouffin.sys
2007-04-01 13:19 278,528 ----a-w D:\Program Files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-08-29_21.12.37.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w D:\WINDOWS\erdnt\subs\ERDNT.EXE
- 2008-08-21 15:40:36 1,674,744 ----a-w D:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-29 21:07:58 1,674,744 ----a-w D:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-29 21:08:02 16,384 ----atw D:\WINDOWS\Temp\Perflib_Perfdata_460.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="D:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:55 5674352]
"updateMgr"="D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
"iTunes"="D:\Program Files\iTunes\iTunes.exe" [2008-07-30 10:47 20252968]
"Firefox"="D:\Program Files\Mozilla Firefox\firefox.exe" [2008-07-31 19:17 307712]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
"eMuleAutoStart"="D:\Program Files\eMule\emule.exe" [2008-08-01 19:41 5480448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"LVCOMSX"="D:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"TkBellExe"="D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-06-09 20:03 185896]
"AppleSyncNotifier"="D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"VTTimer"="VTTimer.exe" [2005-03-07 21:33 53248 D:\WINDOWS\system32\VTTimer.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 10:22 577536 D:\WINDOWS\soundman.exe]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"eMuleAutoStart"=D:\Program Files\eMule\emule.exe -AutoStart
"L07FXLRD_14486375"="D:\Program Files\Microsoft Etudes\Microsoft Encarta 2007 - Études DVD\EDICT.EXE" -m
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
"LogitechSoftwareUpdate"="D:\Program Files\Logitech\Video\ManifestEngine.exe" boot
"Outlook Express"=D:\Program Files\Outlook Express\msimn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LogitechVideoRepair"=D:\Program Files\Logitech\Video\ISStart.exe
"IMJPMIG8.1"="D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"LogitechVideoTray"=D:\Program Files\Logitech\Video\LogiTray.exe
"VTTrayp"=VTtrayp.exe
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=D:\WINDOWS\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\eMule\\emule.exe"=
"D:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe"=
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe"=
"D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16799:TCP"= 16799:TCP:BitComet 16799 TCP
"16799:UDP"= 16799:UDP:BitComet 16799 UDP
"8080:TCP"= 8080:TCP:freeplayer.freebox.fr
"57016:TCP"= 57016:TCP:Pando P2P TCP Listening Port
"57016:UDP"= 57016:UDP:Pando P2P UDP Listening Port

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 videX32;videX32;D:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;D:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
R1 aswsp;avast! Self Protection;D:\WINDOWS\system32\drivers\aswsp.sys [2008-07-19 16:35]
R2 aswfsblk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 UxTuneUp;TuneUp Extension de thème;D:\WINDOWS\System32\svchost.exe [2004-08-05 14:00]
R3 CLEDX;Team H2O CLEDX service;D:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
S3 ate_procmon;ATE_PROCMON;D:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-11-02 12:53]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;D:\WINDOWS\System32\TuneUpDefragService.exe [2008-08-21 23:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-04-17 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-29 D:\WINDOWS\Tasks\Maintenance en 1 clic.job
- D:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-27 19:00]

2008-08-29 D:\WINDOWS\Tasks\Uniblue SpyEraser Nag.job
- D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe []

2008-08-29 D:\WINDOWS\Tasks\Uniblue SpyEraser.job
- D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe []
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 23:08:17
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

D:\Documents and Settings\Bastien\Application Data\Mozilla\Firefox\Profiles\u5opj8fc.default\flashgot.log.bak

Scan termin‚ avec succŠs
Les fichiers cach‚s: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-29 23:13:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 21:13:09
ComboFix2.txt 2008-08-29 19:13:06

Pre-Run: 24,259,137,536 octets libres
Post-Run: 24,152,453,120 octets libres

267 --- E O F --- 2008-08-28 23:36:07

Et le nouveau rapport d'HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:18, on 29/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
D:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\WINDOWS\system32\VTTimer.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\iTunes\iTunes.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\distnoted.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gettoggle.com/?q=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.onspeed.com/pac/?id=171a094db3fd991c99b8069d135128c7
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: G DATA WebFilter Class - {0124123d-61b4-456f-af86-78c53a0790c5} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [iTunes] D:\Program Files\iTunes\iTunes.exe
O4 - HKCU\..\Run: [Firefox] D:\Program Files\Mozilla Firefox\firefox.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MSN Pictures Displayer.lnk = D:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - D:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - D:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - D:\WINDOWS\System32\TuneUpDefragService.exe

Bien ...

Refais un coup de CCleaner ( registre compris ) . Redémarres ton PC et dis moi si il y a du mieux ... as tu encore des alertes d'Avast ?

Puis fais ce-ci pour approfondir :
Télécharge DiagHelp.zip sur ton bureau :
( note : si ton anti-virus s'affolle lors du téléchargement ou de l'installe, c'est normal , ignore l'alerte ).

-> http://www.malekal.com/download/DiagHelp.zip

!! déconnectes toi, fermes toutes tes applications en cours et désactives Avast le temps de la manipe !!

Fais un clic droit sur le fichier et extraire tout .

--> Un nouveau dossier va être créé : "DiagHelp"
Ouvres le et double-clic sur go.cmd et pas sur autre chose ! (le .cmd peut ne pas apparaître )

--> Une fenêtre va s'ouvrir, choisis l'option 1
L'analyse va commencer, ce-ci peut durer quelques minutes, laisses faire et appuies sur une touche quand on te le demandera :
une page IE va s'ouvrir , fermes la .
Re-appuis sur une touche, le bloc-note s'ouvre :
Sauvegardes ce rapport de façon à le retrouver et postes tout son contenu dans ta prochaine réponse ...

Voici le rapport de DiagHelp:

DiagHelp version v1.4 - http://www.malekal.com
excute le 29/08/2008 à 23:32:43,29

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
D:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->29/08/2008 23:32:41
D:\WINDOWS\prefetch\CMD.EXE-034B0549.pf -->29/08/2008 23:32:23
D:\WINDOWS\prefetch\FIREFOX.EXE-06188867.pf -->29/08/2008 23:32:22
D:\WINDOWS\prefetch\FLASHGOT.EXE-04354AA5.pf -->29/08/2008 23:32:19
D:\WINDOWS\prefetch\ADOBELM_CLEANUP.0001-3A3B97D2.pf -->29/08/2008 23:31:38
D:\WINDOWS\prefetch\ADOBELMSVC.EXE-1FC5ACB3.pf -->29/08/2008 23:31:27
D:\WINDOWS\prefetch\PHOTOSHOP.EXE-1E85154E.pf -->29/08/2008 23:31:08
D:\WINDOWS\prefetch\RUNDLL32.EXE-40628D8D.pf -->29/08/2008 23:31:05
D:\WINDOWS\prefetch\WINRAR.EXE-0AA31BB9.pf -->29/08/2008 23:30:13
D:\WINDOWS\prefetch\CCLEANER.EXE-09CFC2BC.pf -->29/08/2008 23:28:52

D:\WINDOWS\System32\drivers\MiniIcpt.sys -->25/08/2008 13:29:17
D:\WINDOWS\System32\drivers\MS1000.sys -->20/08/2008 22:20:27
D:\WINDOWS\System32\drivers\mbamswissarmy.sys -->17/08/2008 15:01:18
D:\WINDOWS\System32\drivers\mbam.sys -->17/08/2008 15:01:14
D:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42
D:\WINDOWS\System32\drivers\aswmon2.sys -->19/07/2008 16:37:21
D:\WINDOWS\System32\drivers\aswSP.sys -->19/07/2008 16:35:18

D:\WINDOWS\System32\wpa.dbl -->29/08/2008 23:07:59
D:\WINDOWS\System32\FNTCACHE.DAT -->29/08/2008 23:07:58
D:\WINDOWS\System32\Thumbs.db -->28/08/2008 15:09:57
D:\WINDOWS\System32\CONFIG.NT -->26/08/2008 01:22:43
D:\WINDOWS\System32\bdod.bin -->26/08/2008 00:16:06
D:\WINDOWS\System32\zllictbl.dat -->25/08/2008 00:51:34
D:\WINDOWS\System32\TuneUpDefragService.exe -->21/08/2008 23:18:13
D:\WINDOWS\System32\FLIQLO.scr -->20/08/2008 22:09:21
D:\WINDOWS\System32\winskfr.dll -->14/08/2008 23:40:31
D:\WINDOWS\System32\mswinsck.ocx -->14/08/2008 23:40:30
D:\WINDOWS\System32\TZLog.log -->06/08/2008 23:10:06
D:\WINDOWS\System32\perfh00C.dat -->06/08/2008 21:47:59
D:\WINDOWS\System32\perfh009.dat -->06/08/2008 21:47:59
D:\WINDOWS\System32\perfc00C.dat -->06/08/2008 21:47:59
D:\WINDOWS\System32\perfc009.dat -->06/08/2008 21:47:58
D:\WINDOWS\System32\PerfStringBackup.INI -->06/08/2008 21:47:56
D:\WINDOWS\System32\$winnt$.inf -->06/08/2008 21:29:55
D:\WINDOWS\System32\nscompat.tlb -->06/08/2008 21:26:37
D:\WINDOWS\System32\amcompat.tlb -->06/08/2008 21:26:37
D:\WINDOWS\System32\WindowsLogon.manifest -->06/08/2008 21:25:49
D:\WINDOWS\System32\logonui.exe.manifest -->06/08/2008 21:25:49
D:\WINDOWS\System32\wuaucpl.cpl.manifest -->06/08/2008 21:25:45
D:\WINDOWS\System32\sapi.cpl.manifest -->06/08/2008 21:25:45
D:\WINDOWS\System32\nwc.cpl.manifest -->06/08/2008 21:25:45
D:\WINDOWS\System32\ncpa.cpl.manifest -->06/08/2008 21:25:45

D:\WINDOWS\wiadebug.log -->29/08/2008 23:31:05
D:\WINDOWS\WindowsUpdate.log -->29/08/2008 23:14:39
D:\WINDOWS\system.ini -->29/08/2008 23:08:12
D:\WINDOWS\wiaservc.log -->29/08/2008 23:08:03
D:\WINDOWS\bootstat.dat -->29/08/2008 23:07:58
D:\WINDOWS\SchedLgU.Txt -->29/08/2008 23:06:37
D:\WINDOWS\Thumbs.db -->28/08/2008 13:28:13
D:\WINDOWS\NeroDigital.ini -->27/08/2008 18:18:42
D:\WINDOWS\bdagent.INI -->26/08/2008 00:51:07
D:\WINDOWS\tsc.ini -->21/08/2008 17:48:07
D:\WINDOWS\WMSysPr9.prx -->06/08/2008 21:26:38
D:\WINDOWS\ODBCINST.INI -->06/08/2008 21:26:28
D:\WINDOWS\win.ini -->06/08/2008 21:25:36
D:\WINDOWS\PhotoSnapViewer.INI -->05/08/2008 00:36:55
D:\WINDOWS\setupapi.old -->05/08/2008 00:02:51

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 344
Command line: D:\WINDOWS\explorer.exe

Base Size Version Path
0x76f80000 0x7f000 2001.12.4414.0258 D:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 D:\WINDOWS\system32\COMRes.dll
0x55df0000 0xd000 17.01.0051.0000 D:\WINDOWS\system32\AcSignIcon.dll
0x782e0000 0x10f000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL
0x78130000 0x9b000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x5d360000 0xf000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80FRA.DLL
0x76ac0000 0x11000 3.05.2284.0000 D:\WINDOWS\system32\ATL.DLL
0x745e0000 0x2c6000 3.01.4000.2435 D:\WINDOWS\system32\msi.dll
0x55fe0000 0x52000 17.01.0051.0000 D:\Program Files\Fichiers communs\Autodesk Shared\AcSignCore16.dll
0x7c420000 0x87000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
0x10000000 0x1b9000 2.00.0000.0008 D:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll
0x7c140000 0x103000 7.10.3077.0000 D:\Program Files\Fichiers communs\Ahead\Lib\MFC71.DLL
0x7c340000 0x56000 7.10.3052.0004 D:\Program Files\Fichiers communs\Ahead\Lib\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 D:\Program Files\Fichiers communs\Ahead\Lib\MSVCP71.dll
0x00e20000 0xf000 7.10.3077.0000 D:\WINDOWS\system32\MFC71FRA.DLL
0x55ee0000 0x1b000 17.01.0051.0000 D:\Program Files\Fichiers communs\Autodesk Shared\AcShellEx\AcShellExtension.dll
0x7c630000 0x1b000 8.00.50727.0762 D:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x00e70000 0x1c000 7.00.0000.0000 D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
0x01580000 0x2c000 D:\Program Files\WinRAR\rarext.dll
0x016a0000 0x14000 2.00.0000.0006 D:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
0x01ae0000 0x102000 7.10.3077.0000 D:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL
0x02580000 0x187000 1.06.0000.0012 D:\PROGRA~1\SPYBOT~1\SDHelper.dll
0x01bf0000 0x12000 1.01.0000.0000 D:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x011b0000 0x9000 2.00.0000.0004 D:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll
0x1c000000 0x6000 1.02.0001.0000 D:\Program Files\Notepad++\nppcm.dll
0x64f00000 0x12000 4.08.1227.0000 D:\Program Files\Alwil Software\Avast4\ashShell.dll
0x325c0000 0x12000 11.00.5510.0000 D:\Program Files\Microsoft Office\OFFICE11\msohev.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 484
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 \??\D:\WINDOWS\system32\winlogon.exe
0x74730000 0x3d000 3.525.1117.0000 D:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 D:\WINDOWS\system32\odbcint.dll
0x76ac0000 0x11000 3.05.2284.0000 D:\WINDOWS\system32\ATL.DLL
0x77000000 0xd4000 2001.12.4414.0258 D:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0258 D:\WINDOWS\system32\CLBCATQ.DLL

Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\WINDOWS\system32

05/08/2004 14:00 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 23 430 590 464 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\WINDOWS\Downloaded Program Files

26/08/2008 02:05 <REP> .
26/08/2008 02:05 <REP> ..
07/12/2004 17:07 32 bdcore.dll
25/05/2006 01:21 118 784 bdupd.dll
06/08/2008 21:25 65 desktop.ini
11/02/2007 23:10 302 184 IDrop.ocx
09/02/2007 16:55 114 768 IDropCHS.dll
14/02/2007 23:30 116 304 IDropCHT.dll
14/02/2007 00:40 116 304 IDropCSY.dll
14/02/2007 03:19 114 768 IDropDEU.dll
11/02/2007 23:24 114 792 IDropENU.dll
14/02/2007 09:09 114 768 IDropESP.dll
16/02/2007 04:15 114 768 IDropFRA.dll
14/02/2007 01:13 114 768 IDropHUN.dll
12/02/2007 07:20 114 768 IDropITA.dll
14/02/2007 00:43 114 768 IDropJPN.dll
15/02/2007 22:37 126 032 IDropKOR.dll
12/02/2007 03:42 114 768 IDropPLK.dll
11/03/2002 04:09 118 784 iDropPTB.dll
09/02/2007 06:00 116 816 IDropRUS.dll
25/05/2006 01:21 53 248 ipsupd.dll
16/03/2005 12:34 7 407 lang.ini
07/12/2004 17:07 32 libfn.dll
13/02/2008 17:55 130 live.ini
20/06/2006 16:44 379 704 MsnPUpld.dll
19/06/2006 15:40 393 MsnPUpld.inf
29/10/2007 16:45 1 244 oscan8.inf
25/10/2007 16:54 471 040 oscan8.ocx
20/06/2006 16:44 117 560 PURen-us.dll
14/03/2005 14:58 7 073 scanoptions.tsi
11/06/2007 12:21 5 021 swflash.inf
02/11/2005 18:01 1 777 xscan.inf
02/11/2005 18:07 435 712 xscan53.ocx
31 fichier(s) 3 528 582 octets

Total des fichiers listés :
31 fichier(s) 3 528 582 octets
2 Rép(s) 23 430 582 272 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\Freeplayer\\vlc\\vlc.exe"="D:\\Program Files\\Freeplayer\\vlc\\vlc.exe:*:Enabled:VLC media player"
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"="D:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe"="D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\empires2.exe:*:Enabled:Age of Empires II"
"D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe"="D:\\Documents and Settings\\Bastien\\Mes documents\\Age Of Empires 2\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="D:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="D:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000
"DisableRegistryTools"=dword:00000000

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 23:33:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
"khjeh"=hex:20,02,00,00,1d,47,8b,60,15,d2,27,b9,54,4f,ef,25,67,df,ed,69,0e,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ef,f2,0a,12,26,ae,29,49,83,47,c6,46,ce,90,2a,a0,f4,74,81,d0,56,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3b,49,51,ea,05,1e,d1,95,5b,10,e0,09,ed,f9,33,32,1e,e7,3b,4a,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,df,30,da,0b,64,5e,86,ac,b3,62,4b,0c,61,0d,4b,0b,01,..
"khjeh"=hex:45,56,e9,ed,67,df,83,3c,e9,5c,b4,3d,c5,69,b3,57,b8,e7,f0,57,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a6,3f,a0,33,9e,33,c8,cc,f6,b5,1e,63,c0,52,22,e9,86,ce,31,a1,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0e,1b,d6,a9,e0,38,8f,5c,7b,2d,2b,ff,69,f1,94,18,90,a5,8e,58,5d,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="D345C33F4FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DC038D530D6EB34525D575E7D6A3B98083228A2B30E74383986422BD4C427BC79F33AA7BDCB3ABBCBB27BA1F323898F524B908FCE1D84A779C11D71149A8B7A33D81D865CC99779855B808DCD04BA1DEF80081BA62E6B061B547D7811B5229BD7BB3995CE90C1CF6F7EF491B059DB66C3686F44DF7133514175E3E776B822162295C94765D53FD076737086AF0BDEB38EDADB6BF39DDBACA31FFE4AC04A3908DB21BCEE41CF87309DD73DAAB20029F2A7F515D9AEEBD7DE0C0EB510C39585B0675C34465A3A0948F78B5C1EF52515B4F91A18B7B11A0E53DA46A18BA2489D73B78B86677B54231530B1016887EA7131036D169370E95998040D8F75D71686585635BF53C2622C3703339171CC467FC15559F16134A00AE18C6B02E73335BE8B5E251DEE24ACEB74C1BBAA86FC2FF563960945F51B88610692322E64D460355C00691204E3FD2135523C9BD824A3FDB8826EDC0D94EF187FC371FD4BB1564EBF0056C33C1F267B87AC6768FEA2A2B507E5C0B7C3E52657EC63008CE615D8E04CB6820E2A44F9201ADE37C7712AB2AE3A23F50D1D2782BF13C877AE601CAFBBBE904A7F4095CD29440A66258E455BF05DB04EC27F46DE64565F3668C839A49BF70E4AD8592A01227C64F520974D2974A31AC876B40318CAC327DF7212B007B6794267922FEB710DE1362A8D30732D2863FBAAF86CF190EE09B1D83C151D2A346CD5C856E49B83DE345C0A7363BB7B6E9509FDCDB7FC2E40F8A84B658CEDE2AF1E065983FC4A9D80D7C8638E1EFBAD9C590810AE0F61D8A10BC4264597E18CBAFBA248AB60DEAC4ED680C4CCB2625F7CEE53F0874AADFE695AD69B643A1186D79B100995DB149F9ADD9D03D2D4EC324D3ED876F9A9C713622541217F5BE43300B4C6523C1FF96AA83D4D36F89F70CA40CE1AB9D7CD690B4DCEFCF009461AF81EA1519ECCBEF104346A503B488E93D07AD0AE182C3F1EDEDADD930B27AA43429364D12E2BB33469677EFAB18285D3F1981540B1B266C68D357D262EB21CC5FEB49FFB046E59491A6535B7FC1A4880DD26128DEC5C939918737C65E3B9915C20C71C98E6DF711298C1F004C5B77F3CC9A56068F2CCF71D84284D9A747B66149C0AC482E27D20C06D0636F079363A7FED8D3FB630DC2AAFDC54879F6D71DBCDEFAA2AAC45FA6C5BA3AFACA2C5246916084810F3551AA402ADEEE665A2C19241984F0018233FC33ECB2FA2D4A1C6621F5733D82D59C3C417886448ED2ACB14F6190D9D5F53637716786A095243945E9022A14305F24ECFCA841330D0DC20C9CCF7F2002EEFB6B966C1B8737DA6B8FAAF30D61EB1A2E26947BACC443A5A0405"

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
344 - explorer.exe
436 - ashMaiSv.exe
460 - csrss.exe
484 - winlogon.exe
528 - services.exe
540 - lsass.exe
592 - ashWebSv.exe
700 - svchost.exe
768 - svchost.exe
808 - svchost.exe
876 - svchost.exe
968 - svchost.exe
1004 - aawservice.exe
1060 - alg.exe
1120 - ashServ.exe
1216 - cmd.exe
1688 - AppleMobileDevi
1724 - WLanCfgG.exe
1732 - mDNSResponder.e
2520 - LVCOMSX.EXE
2536 - VTTimer.exe
2552 - realsched.exe
2608 - soundman.exe
2624 - iTunesHelper.ex
2768 - TeaTimer.exe
3168 - iPodService.exe
3628 - emule.exe
3656 - wscntfy.exe

Total number of processes = 29
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\TUKERNEL.EXE
80724000 - \WINDOWS\system32\hal.dll
F7A6E000 - \WINDOWS\system32\KDCOM.DLL
F797E000 - \WINDOWS\system32\BOOTVID.dll
F751E000 - ACPI.sys
F7A70000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F74F8000 - d347bus.sys
F74E7000 - pci.sys
F756E000 - isapnp.sys
F73E7000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
F7A72000 - avgarkt.sys
F7B36000 - PCIIde.sys
F77EE000 - \WINDOWS\System32\Drivers\PCIIDEX.SYS
F7A74000 - ViaIde.sys
F757E000 - MountMgr.sys
F73C8000 - ftdisk.sys
F77F6000 - videX32.sys
F77FE000 - PartMgr.sys
F758E000 - VolSnap.sys
F73B0000 -
F7A76000 - d347prt.sys
F759E000 - disk.sys
F75AE000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F7391000 - fltMgr.sys
F737F000 - sr.sys
F7806000 - xfilt.sys
F75BE000 - PxHelp20.sys
F7368000 - KSecDD.sys
F72DB000 - Ntfs.sys
F72AE000 - NDIS.sys
F75CE000 - Combo-Fix.sys
F75DE000 - uagp35.sys
F7293000 - Mup.sys
F766E000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F6B7C000 - \SystemRoot\system32\DRIVERS\vtmini.sys
F6B68000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F767E000 - \SystemRoot\system32\DRIVERS\imapi.sys
F768E000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F769E000 - \SystemRoot\system32\DRIVERS\redbook.sys
F6B45000 - \SystemRoot\system32\DRIVERS\ks.sys
F7A52000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F790E000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F6B22000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F7916000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F6C48000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F791E000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F7926000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F792E000 - \SystemRoot\system32\DRIVERS\fdc.sys
F6B0E000 - \SystemRoot\system32\DRIVERS\parport.sys
F6AFD000 - \SystemRoot\system32\DRIVERS\serial.sys
F7A5A000 - \SystemRoot\system32\DRIVERS\serenum.sys
F6735000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
F6711000 - \SystemRoot\system32\drivers\portcls.sys
F6C28000 - \SystemRoot\system32\drivers\drmk.sys
F7BAB000 - \SystemRoot\system32\DRIVERS\audstub.sys
F6BC8000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7A5E000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F66FA000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F6BB8000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F76AE000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F7936000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F66E9000 - \SystemRoot\system32\DRIVERS\psched.sys
F76BE000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F793E000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F7946000 - \SystemRoot\system32\DRIVERS\raspti.sys
F76CE000 - \SystemRoot\system32\DRIVERS\termdd.sys
F7AAE000 - \SystemRoot\system32\DRIVERS\swenum.sys
F668D000 - \SystemRoot\system32\DRIVERS\update.sys
F726B000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F76DE000 - \SystemRoot\system32\DRIVERS\cledx.sys
F76EE000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F76FE000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7AB4000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F795E000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
F7AB6000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7CC4000 - \SystemRoot\System32\Drivers\Null.SYS
F7AB8000 - \SystemRoot\System32\Drivers\Beep.SYS
F7CC5000 - \SystemRoot\System32\DRIVERS\AvgArCln.sys
F796E000 - \SystemRoot\System32\drivers\vga.sys
F7ABA000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7ABC000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F7976000 - \SystemRoot\System32\Drivers\Msfs.SYS
F7816000 - \SystemRoot\System32\Drivers\Npfs.SYS
F7A1A000 - \SystemRoot\system32\DRIVERS\rasacd.sys
F55F8000 - \SystemRoot\system32\DRIVERS\ipsec.sys
F55A0000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F771E000 - \SystemRoot\System32\Drivers\aswtdi.SYS
F557F000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F772E000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F552F000 - \SystemRoot\system32\DRIVERS\netbt.sys
F550D000 - \SystemRoot\System32\drivers\afd.sys
F773E000 - \SystemRoot\system32\DRIVERS\netbios.sys
F54E1000 - \SystemRoot\system32\DRIVERS\rdbss.sys
F5472000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F774E000 - \SystemRoot\System32\Drivers\Fips.SYS
F53BB000 - \SystemRoot\System32\Drivers\aswsp.SYS
F7856000 - \SystemRoot\System32\Drivers\aavmker4.SYS
F785E000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
F5398000 - \SystemRoot\System32\Drivers\Fastfat.SYS
F5380000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7AC8000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F788E000 - \SystemRoot\System32\watchdog.sys
F66D1000 - \SystemRoot\System32\drivers\Dxapi.sys
BF9C1000 - \SystemRoot\System32\drivers\dxg.sys
F7C90000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D3000 - \SystemRoot\System32\vtdisp.dll
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
F78E6000 - \SystemRoot\system32\DRIVERS\aswFsBlk.sys
F78FE000 - \SystemRoot\system32\DRIVERS\AegisP.sys
F0E60000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
F0CCA000 - \SystemRoot\System32\Drivers\aswmon2.SYS
F0A45000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
F7B12000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F09B8000 - \SystemRoot\system32\drivers\wdmaud.sys
F0C4A000 - \SystemRoot\system32\drivers\sysaudio.sys
F089D000 - \SystemRoot\system32\DRIVERS\srv.sys
F0885000 - \??\D:\WINDOWS\system32\drivers\tmcomm.sys
F0662000 - \SystemRoot\System32\Drivers\aswrdr.SYS
F03BD000 - \SystemRoot\System32\Drivers\HTTP.sys
F07C0000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F060E000 - \??\D:\C-Fix\catchme.sys
F7B16000 - \??\D:\WINDOWS\system32\Drivers\PROCEXP90.SYS
EFF22000 - \SystemRoot\system32\DRIVERS\rt73.sys
F7C98000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 125

Liste des programmes installes

Adobe Common File Installer
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Photoshop CS2
Adobe Stock Photos 1.0
avast! Antivirus
AVG Anti-Rootkit Free
HijackThis 2.0.2
MSN Pictures Displayer 4.5
Spybot - Search & Destroy

Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\Program Files

29/08/2008 21:07 <REP> .
29/08/2008 21:07 <REP> ..
12/03/2008 00:37 <REP> Adobe
31/03/2007 11:01 <REP> Alwil Software
25/08/2008 00:20 <REP> Anti Trojan Elite
18/02/2008 01:01 <REP> AOEMView 2008
17/04/2008 19:25 <REP> Apple Software Update
04/06/2008 17:55 <REP> ASIO4ALL v2
18/06/2008 22:35 <REP> Auralog
12/03/2008 00:37 <REP> Autodesk
16/06/2008 21:47 <REP> AviSynth 2.5
31/03/2007 10:49 <REP> AvRack
11/03/2008 23:59 <REP> Belkin
13/02/2008 16:13 <REP> Bonjour
04/04/2008 00:20 <REP> CamStudio
31/03/2007 11:16 <REP> CCleaner
06/08/2008 21:25 <REP> ComPlus Applications
17/03/2008 22:11 <REP> CVitae
05/03/2008 19:31 <REP> DivX
28/08/2008 12:39 <REP> D-Tools
18/02/2008 00:56 <REP> DWG TrueView 2007
13/08/2008 13:28 <REP> DynamicPhotoHDR
29/08/2008 23:24 <REP> eMule
29/08/2008 23:05 <REP> Fichiers communs
02/04/2007 10:50 <REP> Free
24/08/2008 20:04 <REP> Free Audio Pack
24/08/2008 20:07 <REP> Free Download Manager
12/01/2008 21:55 <REP> Free Easy Burner
05/03/2008 19:31 <REP> Freeplayer
09/09/2007 16:59 <REP> GrabIt
29/08/2008 11:23 <REP> GRISOFT
04/06/2008 17:59 <REP> GXTranscoderv5
24/08/2008 20:11 <REP> Image-Line
16/08/2008 11:13 <REP> Internet Explorer
16/08/2008 11:43 <REP> iPod
16/08/2008 11:43 <REP> iTunes
12/01/2008 01:40 <REP> Jasc Software Inc
31/07/2008 11:44 <REP> Java
16/08/2008 11:19 <REP> Konvertor
15/08/2008 23:39 <REP> Lavasoft
07/11/2007 20:56 <REP> Learning Essentials
24/08/2008 22:39 <REP> LeechGet 2007
05/04/2007 15:18 <REP> Logitech
22/08/2008 13:23 <REP> Malwarebytes' Anti-Malware
06/05/2007 10:34 <REP> Matroska Pack
16/08/2008 11:13 <REP> Messenger
30/03/2008 19:31 <REP> Messenger Plus! Live
06/02/2008 22:00 <REP> Microsoft CAPICOM 2.1.0.2
07/11/2007 21:00 <REP> Microsoft Etudes
31/03/2007 10:42 <REP> microsoft frontpage
18/02/2008 00:54 <REP> Microsoft Office
04/06/2008 20:09 <REP> Microsoft SQL Server
18/02/2008 01:00 <REP> Microsoft WSE
29/05/2007 16:28 <REP> MIKSOFT
16/08/2008 11:13 <REP> Movie Maker
29/08/2008 23:32 <REP> Mozilla Firefox
20/08/2008 22:17 <REP> MRU-Blaster
19/10/2007 19:08 <REP> MSN
31/03/2007 10:40 <REP> MSN Gaming Zone
30/03/2008 19:31 <REP> MSN Messenger
14/05/2008 23:40 <REP> MSN Pictures Displayer
06/02/2008 21:55 <REP> MSXML 4.0
06/02/2008 22:00 <REP> MSXML 6.0
12/01/2008 01:32 <REP> Nero
31/03/2007 10:41 <REP> NetMeeting
30/06/2007 14:01 <REP> Notepad++
31/03/2007 10:40 <REP> Online Services
16/08/2008 11:13 <REP> Outlook Express
04/06/2008 17:54 <REP> Outsim
14/08/2008 23:58 <REP> PhotomatixPro3
24/08/2008 20:31 <REP> Phun
17/08/2007 02:05 <REP> Pixoria
29/08/2008 21:07 <REP> PSCS2Updater
05/03/2008 19:31 <REP> QuickPar
13/07/2008 15:05 <REP> QuickTime
12/01/2008 01:42 <REP> RALINK
03/08/2008 23:16 <REP> Rapidown
31/03/2007 10:49 <REP> Realtek AC97
31/03/2007 10:49 <REP> Realtek Sound Manager
16/06/2008 21:47 <REP> Red Kawa
31/03/2007 11:16 <REP> RegCleaner
17/09/2007 20:13 <REP> Replay Converter
31/03/2007 10:50 <REP> S3
06/08/2008 21:25 <REP> Services en ligne
17/08/2008 21:24 <REP> Singular Inversions
12/06/2008 01:16 <REP> Sony
04/06/2008 20:06 <REP> Sony Setup
26/08/2008 01:36 <REP> Spybot - Search & Destroy
24/08/2007 23:24 <REP> Stardock
02/11/2007 00:57 <REP> Steinberg
05/03/2008 19:31 <REP> StuffPlug3
31/07/2008 11:44 <REP> Sun
09/08/2007 22:49 <REP> Syncrosoft
21/08/2008 18:05 <REP> TeaTimer (Spybot - Search & Destroy)
21/08/2008 17:46 <REP> The Cleaner Free
16/08/2008 01:31 <REP> Tiger System Preferences v2
20/08/2008 22:14 <REP> Trend Micro
21/08/2008 23:19 <REP> TuneUp Utilities 2008
29/08/2008 14:08 <REP> Uniblue
24/08/2007 19:44 <REP> UxTheme Multipatcher Fr
31/03/2007 10:48 <REP> VIA
24/04/2007 15:03 <REP> VideoLAN
02/11/2007 00:56 <REP> VIRTUA~1
13/06/2008 00:32 <REP> VirtualDJ
29/05/2007 14:11 <REP> VSO
12/06/2008 01:16 <REP> VstPlugins
04/02/2008 19:48 <REP> Windows Live
18/08/2007 18:48 <REP> Windows Live Messenger
14/02/2008 18:47 <REP> Windows Live Safety Center
16/08/2008 11:13 <REP> Windows Media Player
16/08/2008 11:13 <REP> Windows NT
12/04/2007 19:32 <REP> WinOSX
16/08/2008 11:13 <REP> WinRAR
31/03/2007 10:42 <REP> xerox
23/01/2008 21:29 <REP> Yahoo!
25/08/2008 00:47 <REP> Zone Labs
0 fichier(s) 0 octets
116 Rép(s) 23 430 000 640 octets libres
Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\Program Files\fichiers communs

29/08/2008 23:05 <REP> .
29/08/2008 23:05 <REP> ..
10/02/2008 12:38 <REP> Adobe
19/04/2007 16:19 <REP> Adobe Systems Shared
12/01/2008 01:34 <REP> Ahead
24/12/2007 18:33 <REP> Apple
12/03/2008 00:37 <REP> Autodesk Shared
26/08/2008 00:51 <REP> BitDefender
18/02/2008 00:55 <REP> DESIGNER
01/04/2007 15:19 278 528 FDEUnInstaller.exe
05/04/2007 15:18 <REP> FotoWire
24/08/2008 20:02 <REP> GTK
05/04/2007 15:14 <REP> InstallShield
01/04/2007 16:43 <REP> Java
05/04/2007 15:17 <REP> Logitech
04/06/2008 19:44 <REP> Microsoft Shared
31/03/2007 10:41 <REP> MSSoap
31/03/2007 02:45 <REP> ODBC
09/06/2008 20:03 <REP> Real
31/03/2007 10:41 <REP> Services
31/03/2007 02:45 <REP> SpeechEngines
24/08/2007 23:24 <REP> Stardock
16/08/2008 11:13 <REP> System
15/08/2008 23:38 <REP> Wise Installation Wizard
09/06/2008 20:04 <REP> xing shared
1 fichier(s) 278 528 octets
24 Rép(s) 23 429 996 544 octets libres
Le volume dans le lecteur D s'appelle WindowsXP
Le numéro de série du volume est 54C7-45E9

Répertoire de D:\Program Files\fichiers communs\Microsoft Shared\Web Folders

17/04/2007 06:34 <REP> .
17/04/2007 06:34 <REP> ..
17/04/2007 06:34 <REP> 1033
17/04/2007 06:34 <REP> 1036
11/07/2003 10:15 1 292 872 MSONSEXT.DLL
15/07/2003 06:52 35 896 MSOSV.DLL
03/06/1999 12:09 122 937 MSOWS409.DLL
07/03/2001 07:00 127 033 MSOWS40c.DLL
11/07/2003 02:25 80 448 PKMWS.DLL
5 fichier(s) 1 659 186 octets
4 Rép(s) 23 429 996 544 octets libres

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_BASTIEN-4A08A9D.tar.gz a l'adresse http://upload.malekal.com

bien ...

Rends toi sur ce site :

https://www.virustotal.com/gui/

Copies ce qui suit et colles le dans l'espace pour la recherche :
D:\Documents and Settings\Bastien\Application Data\Mozilla\Firefox\Profiles\u5opj8fc.default\flashgot.log.bak

Cliques sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends bien la fin ... Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copies le dans ta prochaine réponse ...

( Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant )

Fais de même pour :
D:\WINDOWS\System32\FLIQLO.scr
D:\WINDOWS\System32\winskfr.dll
D:\WINDOWS\setupapi.old

postes moi donc ces 4 rapports ( surtout le début avec le listing des AV , et en précisant bien au début de chacuns à quel fichier ils correspondent ) et attends la suite ...