Trojan resistant

salem la famille telecharge tous sa effectue tous sa a la lettre.

avant tous tu vas dans demarrer, panneau de configuration,systeme,et desactive la restauration systeme sur tous les lecteur.

ensuite on verra le llog apres parce qu il est gros la mdr telecharge sa.
celui la tu installe et scan en mode normal.

https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/12884.html

suit ce tuto si tu trouve des trucs merci a malékal

http://www.malekal.com/tutorial_TrojanRemover.php
============================================================­­=

pour ces logiciels la tu les installe et tu scan en mode sans echec pour c cleaner installe pas la yahoo toolbar et coches toutes les case avant de scaner tu scanera au moins 2 fois avec chaque logiciel

pour celui la tu l installe et tu scannera en mode sans echec.

https://www.01net.com/telecharger/windows/Securite/anti-spam/fiches/44096.html

------------------------------------------------------------­­-------------------------------------------
https://www.01net.com/404/­­/fiches/8351.html

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

https://www.01net.com/telecharger/windows/Utilitaire/systeme/­­fiches/29399.html

pour ces logiciels la tu les installe et tu scan en mode sans echec pour c cleaner installe pas la yahoo toolbar et coches toutes les case avant de scaner tu scanera au moins 2 fois avec chaque logiciel

pour le mode sans echec tu redemare ton pc et tu ta pote sur f8 (des fois f5)des qu il s allume jusqua qu a apparaisse le menu
et choisis mode sans echec.

ensuite fais un scan en ligne ici

https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

et

http://www.bitdefender.fr/scan_fr/scan8/ie.html

si il ne trouve rien ceux la reactive ta restauration systeme et remets un log. les 2 scan au dessus ne marche qu avec internet explorer

merci d'etre la pour moi mr propre
sinon pour ces 2 liens quel logiciel telecharger dans la liste??
(https://www.01net.com/404/­­­/fiches/8351.html
https://www.01net.com/telecharger/windows/Utilitaire/systeme/­­­fiches/29399.html )

sa c est regseeker

https://www.01net.com/telecharger/windows/Utilitaire/systeme/fiches/29399.html

et l autres ce n est pas grave tu as ccleaner normalement?

ok désole j'ai pas eu le temps de faire ça hier soir alors je m'y suis mis vite fait avant de devoir
repartir et un grand bonsoir au passage.
sinon voici les rapports sauf celui de regseeker qui ne m'en n'a pas généré et comme je ne savais pas trop quoi
faire avec lui j'ai juste nettoyé le registre.
enfin voici les autres rapports

trojan remover:

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.2.2541. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 19:39:25 02 sept. 2008
Using Database v7121
Operating System: Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System: NTFS
Data directory: C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\drikceline\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
[AV Warnings are suppressed]
Avast! Antivirus

************************************************************

************************************************************
19:39:26: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
19:39:26: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
19:39:26: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
19:39:26: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 29/08/2002
Modified: 13/06/2007
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: DAEMON Tools-1033
Value Data: "C:\Program Files\D-Tools\daemon.exe" -lang 1033
C:\Program Files\D-Tools\daemon.exe
81920 bytes
Created: 15/12/2003
Modified: 15/12/2003
Company: DAEMON'S HOME
--------------------
Value Name: ATIPTA
Value Data: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
344064 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company: ATI Technologies, Inc.
--------------------
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 77824 bytes
Created: 22/03/2006
Modified: 14/06/2005
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 27/03/2006
Modified: 9/07/2001
Company: Ahead Software Gmbh
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
79224 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 27/05/2008
Modified: 27/05/2008
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created: 11/01/2008
Modified: 11/01/2008
Company: Adobe Systems Incorporated
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
916560 bytes
Created: 2/09/2008
Modified: 30/08/2008
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: CTFMON.EXE
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
--------------------
Value Name: CursorXP
Value Data: C:\themeGold55\CursorXP\CursorXP.exe -s
C:\themeGold55\CursorXP\CursorXP.exe
100864 bytes
Created: 22/03/2006
Modified: 13/12/2001
Company:
--------------------
Value Name: CTSyncU.exe
Value Data: "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
692224 bytes
Created: 14/10/2006
Modified: 28/04/2006
Company:
--------------------
Value Name: MtdAcqu
Value Data: "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
278528 bytes
Created: 14/10/2006
Modified: 8/03/2006
Company: Creative Technology Ltd
--------------------
Value Name: PowerArchiver Tray
Value Data: C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\PowerArchiver\PASTARTER.EXE
141352 bytes
Created: 20/03/2007
Modified: 20/03/2007
Company: ConeXware, Inc.
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe
1694208 bytes
Created: 19/08/2004
Modified: 13/10/2004
Company: Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
19:39:28: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8}
Value: AVG Anti-Spyware 7.5
File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
79408 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------

************************************************************
19:39:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
19:39:28: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
19:39:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 3/11/2006
Modified: 3/11/2006
Company:
----------

************************************************************
19:39:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
19:39:30: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 4166FEB2
ImagePath: C:\WINDOWS\System32\F1DCCBDD.EXE -a
C:\WINDOWS\System32\F1DCCBDD.EXE [file not found to scan]
----------
Key: Adobe LM Service
ImagePath: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
68096 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
----------
Key: aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created: 15/07/2004
Modified: 15/07/2004
Company: Microsoft Corporation
----------
Key: aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created: 7/07/2008
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
17272 bytes
Created: 30/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ATI Smart
ImagePath: C:\WINDOWS\system32\ati2sgag.exe
C:\WINDOWS\system32\ati2sgag.exe
516096 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company:
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
144760 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
247160 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
349560 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: AVG Anti-Spyware Driver
ImagePath: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
11000 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company:
----------
Key: AVG Anti-Spyware Guard
ImagePath: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
312880 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------
Key: AvgAsCln
ImagePath: System32\DRIVERS\AvgAsCln.sys
C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys
3968 bytes
Created: 5/03/2007
Modified: 5/09/2006
Company: GRISOFT, s.r.o.
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created: 24/07/2007
Modified: 24/07/2007
Company: Apple Inc.
----------
Key: Boonty Games
ImagePath: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
69120 bytes
Created: 16/02/2007
Modified: 16/02/2007
Company: BOONTY
----------
Key: d343bus
ImagePath: System32\DRIVERS\d343bus.sys
C:\WINDOWS\System32\DRIVERS\d343bus.sys
136704 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: d343port
ImagePath: System32\DRIVERS\d343port.sys
C:\WINDOWS\System32\DRIVERS\d343port.sys
5632 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: D8D496F5
ImagePath: C:\WINDOWS\System32\86271EFE.EXE -d
C:\WINDOWS\System32\86271EFE.EXE [file not found to scan]
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created: 20/03/2008
Modified: 2/09/2008
Company: Google
----------
Key: IDriverT
ImagePath: C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created: 14/11/2005
Modified: 14/11/2005
Company: Macrovision Corporation
----------
Key: IKFileSec
ImagePath: \SystemRoot\system32\drivers\ikfilesec.sys
C:\WINDOWS\system32\drivers\ikfilesec.sys
42376 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysFlt
ImagePath: system32\drivers\iksysflt.sys
C:\WINDOWS\system32\drivers\iksysflt.sys
66952 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysSec
ImagePath: system32\drivers\iksyssec.sys
C:\WINDOWS\system32\drivers\iksyssec.sys
81288 bytes
Created: 2/09/2008
Modified: 10/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created: 22/03/2006
Modified: 17/08/2001
Company: Microsoft Corporation
----------
Key: nvatabus
ImagePath: System32\DRIVERS\nvatabus.sys
C:\WINDOWS\System32\DRIVERS\nvatabus.sys
-R- 79360 bytes
Created: 22/03/2006
Modified: 3/06/2004
Company: NVIDIA Corporation
----------
Key: NVENETFD
ImagePath: System32\DRIVERS\NVENETFD.sys
C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
-R- 33024 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: System32\DRIVERS\nvnetbus.sys
C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
-R- 12928 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: NVSvc
ImagePath: %SystemRoot%\System32\nvsvc32.exe
C:\WINDOWS\System32\nvsvc32.exe [file not found to scan]
----------
Key: nv_agp
ImagePath: System32\DRIVERS\nv_agp.sys
C:\WINDOWS\System32\DRIVERS\nv_agp.sys
-R- 21120 bytes
Created: 22/03/2006
Modified: 29/10/2003
Company: NVIDIA Corporation
----------
Key: PCAMPR5
ImagePath: \??\C:\WINDOWS\System32\PCAMPR5.SYS
C:\WINDOWS\System32\PCAMPR5.SYS [file not found to scan]
----------
Key: PCANDIS5
ImagePath: \??\C:\WINDOWS\System32\PCANDIS5.SYS
C:\WINDOWS\System32\PCANDIS5.SYS
16128 bytes
Created: 29/01/2007
Modified: 4/08/2003
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: sdAuxService
ImagePath: C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
356920 bytes
Created: 2/09/2008
Modified: 13/06/2008
Company: PC Tools
----------
Key: sdCoreService
ImagePath: C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
1073544 bytes
Created: 2/09/2008
Modified: 7/08/2008
Company: PC Tools
----------
Key: Secdrv
ImagePath: System32\DRIVERS\secdrv.sys
C:\WINDOWS\System32\DRIVERS\secdrv.sys
12464 bytes
Created: 25/03/2002
Modified: 29/12/2007
Company: Macrovision Europe Ltd
----------
Key: SIS163u
ImagePath: System32\DRIVERS\sis163u.sys
C:\WINDOWS\System32\DRIVERS\sis163u.sys [file not found to scan]
----------
Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73600 bytes
Created: 22/03/2006
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{51E7EF02-4C7B-4914-8243-03E90A0AD280}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 28/08/2001
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: USBAAPL
ImagePath: System32\Drivers\usbaapl.sys
C:\WINDOWS\System32\Drivers\usbaapl.sys
32000 bytes
Created: 28/12/2007
Modified: 10/07/2008
Company: Apple, Inc.
----------
Key: WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
10144 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
21280 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
5600 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
44064 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 11/10/2004
Modified: 18/10/2006
Company: Microsoft Corporation
----------
Key: xmasbus
ImagePath: System32\DRIVERS\xmasbus.sys
C:\WINDOWS\System32\DRIVERS\xmasbus.sys
140800 bytes
Created: 22/03/2006
Modified: 21/12/2003
Company:
----------
Key: xmasscsi
ImagePath: System32\Drivers\xmasscsi.sys
C:\WINDOWS\System32\Drivers\xmasscsi.sys
5504 bytes
Created: 22/03/2006
Modified: 20/12/2003
Company:
----------

************************************************************
19:39:37: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created: 22/03/2006
Modified: 28/02/2003
Company:
VxD Key = JAVASUP
----------
----------

************************************************************
19:39:37: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
19:39:37: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
75128 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
19:39:38: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
372736 bytes
Created: 10/05/2007
Modified: 10/05/2007
Company: Adobe Systems, Inc.
----------

************************************************************
19:39:38: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {02478D38-C3F9-4EFB-9B51-7695ECA05670}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
440384 bytes
Created: 6/03/2007
Modified: 26/10/2006
Company: Yahoo! Inc.
----------
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created: 22/10/2006
Modified: 22/10/2006
Company: Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
1562448 bytes
Created: 29/07/2008
Modified: 7/07/2008
Company: Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2436160 bytes
Created: 20/03/2008
Modified: 20/03/2008
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
651248 bytes
Created: 2/09/2008
Modified: 2/09/2008
Company: Google Inc.
----------

************************************************************
19:39:38: Scanning ----- SHELLSERVICEOBJECTS -----
Key: WebCheck
CLSID: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Path: %SystemRoot%\System32\webcheck.dll
C:\WINDOWS\System32\webcheck.dll
281600 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path: C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created: 18/10/2006
Modified: 18/10/2006
Company: Microsoft Corporation
----------

************************************************************
19:39:38: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
19:39:38: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
19:39:38: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank

************************************************************
19:39:38: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
19:39:38: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
113664 bytes
Created: 22/03/2006
Modified: 4/11/1999
Company: Adobe Systems, Inc.
Adobe Gamma Loader.lnk - links to C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
155715 bytes
Created: 24/04/2006
Modified: 12/04/2002
Company:
NaturalColorLoad.lnk - links to C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
19:39:39: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 29/08/2007
Modified: 11/04/2008
Company: Apple Inc.
Parameters: -task
Next Run Time: 8/09/2008 9:36:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: [blank]
----------

************************************************************
19:39:39: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
19:39:39: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Checking for specific malicious files:
C:\WINDOWS\system32\WS2Fix.exe - Trojan.FakeAlert
C:\WINDOWS\system32\WS2Fix.exe - process is either not running or could not be terminated
C:\WINDOWS\system32\WS2Fix.exe - file renamed to: C:\WINDOWS\system32\WS2Fix.exe.vir
----------
Desktop Wallpaper: C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Additional checks completed

************************************************************
19:40:08: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[56 loaded modules in total]
--------------------
C:\WINDOWS\System32\Ati2evxx.exe
[12 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[47 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[146 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[29 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[43 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
[52 loaded modules in total]
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
[17 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE
[100 loaded modules in total]
--------------------
C:\Program Files\D-Tools\daemon.exe
[30 loaded modules in total]
--------------------
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\SOUNDMAN.EXE
[21 loaded modules in total]
--------------------
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[47 loaded modules in total]
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[18 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe
[22 loaded modules in total]
--------------------
C:\themeGold55\CursorXP\CursorXP.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
[72 loaded modules in total]
--------------------
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
[50 loaded modules in total]
--------------------
C:\Program Files\PowerArchiver\PASTARTER.EXE
[15 loaded modules in total]
--------------------
C:\Program Files\Messenger\msmsgs.exe
[38 loaded modules in total]
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
[19 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[48 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
[25 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\System32\CTsvcCDA.exe
[9 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[14 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[31 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\msiexec.exe
[54 loaded modules in total]
--------------------
C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\jky8B.exe
FileSize: 2548288
[This is a Trojan Remover component]
[22 loaded modules in total]
--------------------

************************************************************
19:40:34: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
19:40:34: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
19:40:34: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
19:40:34: Scanning ------ %TEMP% DIRECTORY ------
d:\temp\JET22D.tmp appears to be in-use/locked
************************************************************
19:40:34: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
19:40:34: Scanning ------ ROOT DIRECTORY ------

************************************************************
19:40:35: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://neufportail.fr/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 19:40:35 02 sept. 2008
************************************************************

puis malwarebit:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

14:38:27 3/09/2008
mbam-log-09-03-2008 (14-38-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 92692
Temps écoulé: 32 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

puis ccleaner:

NETTOYAGE COMPLET - (2,177 secs)
------------------------------------------------------------------------------------------
7,98MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 236) 3,30MB
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Cookies\index.dat
Poubelle vidée (1 fichiers) 3,38MB
C:\WINDOWS\TEMP\{AC76BA86-7AD7-1036-7B44-A81200000003}.ini 678 bytes
d:\temp\jusched.log 173 bytes
d:\temp\wmplog00.sqm 1,45KB
d:\temp\wmplog01.sqm 1,49KB
d:\temp\wmplog02.sqm 1,75KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 1,61KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 327 bytes
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 49 bytes
C:\WINDOWS\WindowsUpdate.log 1,10MB
C:\WINDOWS\wmsetup.log 940 bytes
C:\WINDOWS\ntbtlog.txt 0,19MB
C:\WINDOWS\Debug\UserMode\userenv.log 1,63KB
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\soundData.sol 58 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\videostats.sol 199 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 377 bytes
------------------------------------------------------------------------------------------

les logs de kapersky:

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 3:43:34 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Zones critiques
C:\WINDOWS
d:\temp\

Statistiques de l'analyse
Total d'objets analysés 16848
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:13:06

Nom de l'objet infecté Nom du virus Dernière action
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

d:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 4:38:35 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\
G:\

Statistiques de l'analyse
Total d'objets analysés 58627
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:53:36

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.dpm L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.ldb L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\MSHist012008090320080904\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\FXZ0ANP1\Teasing_728x90_20080822[1].swf L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\k2kYxpr7kVMId2KDlr&related=1&related=1&autoplay=1[1] L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

D:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

et enfin celui de bitdefender:

BitDefender Online Scanner

Rapport d'analyse généré à: Wed, Sep 03, 2008 - 16:56:51

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;

Statistiques

Temps
00:15:44

Fichiers
69276

Directoires
5441

Secteurs de boot
0

Archives
1020

Paquets programmes
6286

Résultats

Virus identifiés
0

Fichiers infectés
0

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
0

Info sur les moteurs

Définition virus
1710163

Version des moteurs
AVCORE v1.7 (build 8314.19) (i386) (Aug 11 2008 17:31:32)

Analyse des plugins
16

Archive des plugins
43

Unpack des plugins
7

E-mail plugins
6

Système plugins
4

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

Aucun virus trouvé.

voila j'espère avoir bien travaillé mais après avoir refait une verif avec spyware doctor il m'a
retrouvé le trojan zlob.gen et je sais pas si il l'a bien enlevé

ok désole j'ai pas eu le temps de faire ça hier soir alors je m'y suis mis vite fait avant de devoir
repartir et un grand bonsoir au passage.
sinon voici les rapports sauf celui de regseeker qui ne m'en n'a pas généré et comme je ne savais pas trop quoi
faire avec lui j'ai juste nettoyé le registre.
enfin voici les autres rapports

trojan remover:

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.2.2541. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 19:39:25 02 sept. 2008
Using Database v7121
Operating System: Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System: NTFS
Data directory: C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\drikceline\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
[AV Warnings are suppressed]
Avast! Antivirus

************************************************************

************************************************************
19:39:26: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
19:39:26: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
19:39:26: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
19:39:26: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 29/08/2002
Modified: 13/06/2007
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: DAEMON Tools-1033
Value Data: "C:\Program Files\D-Tools\daemon.exe" -lang 1033
C:\Program Files\D-Tools\daemon.exe
81920 bytes
Created: 15/12/2003
Modified: 15/12/2003
Company: DAEMON'S HOME
--------------------
Value Name: ATIPTA
Value Data: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
344064 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company: ATI Technologies, Inc.
--------------------
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 77824 bytes
Created: 22/03/2006
Modified: 14/06/2005
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 27/03/2006
Modified: 9/07/2001
Company: Ahead Software Gmbh
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
79224 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 27/05/2008
Modified: 27/05/2008
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created: 11/01/2008
Modified: 11/01/2008
Company: Adobe Systems Incorporated
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
916560 bytes
Created: 2/09/2008
Modified: 30/08/2008
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: CTFMON.EXE
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
--------------------
Value Name: CursorXP
Value Data: C:\themeGold55\CursorXP\CursorXP.exe -s
C:\themeGold55\CursorXP\CursorXP.exe
100864 bytes
Created: 22/03/2006
Modified: 13/12/2001
Company:
--------------------
Value Name: CTSyncU.exe
Value Data: "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
692224 bytes
Created: 14/10/2006
Modified: 28/04/2006
Company:
--------------------
Value Name: MtdAcqu
Value Data: "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
278528 bytes
Created: 14/10/2006
Modified: 8/03/2006
Company: Creative Technology Ltd
--------------------
Value Name: PowerArchiver Tray
Value Data: C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\PowerArchiver\PASTARTER.EXE
141352 bytes
Created: 20/03/2007
Modified: 20/03/2007
Company: ConeXware, Inc.
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe
1694208 bytes
Created: 19/08/2004
Modified: 13/10/2004
Company: Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
19:39:28: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8}
Value: AVG Anti-Spyware 7.5
File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
79408 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------

************************************************************
19:39:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
19:39:28: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
19:39:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 3/11/2006
Modified: 3/11/2006
Company:
----------

************************************************************
19:39:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
19:39:30: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 4166FEB2
ImagePath: C:\WINDOWS\System32\F1DCCBDD.EXE -a
C:\WINDOWS\System32\F1DCCBDD.EXE [file not found to scan]
----------
Key: Adobe LM Service
ImagePath: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
68096 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
----------
Key: aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created: 15/07/2004
Modified: 15/07/2004
Company: Microsoft Corporation
----------
Key: aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created: 7/07/2008
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
17272 bytes
Created: 30/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ATI Smart
ImagePath: C:\WINDOWS\system32\ati2sgag.exe
C:\WINDOWS\system32\ati2sgag.exe
516096 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company:
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
144760 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
247160 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
349560 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: AVG Anti-Spyware Driver
ImagePath: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
11000 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company:
----------
Key: AVG Anti-Spyware Guard
ImagePath: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
312880 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------
Key: AvgAsCln
ImagePath: System32\DRIVERS\AvgAsCln.sys
C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys
3968 bytes
Created: 5/03/2007
Modified: 5/09/2006
Company: GRISOFT, s.r.o.
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created: 24/07/2007
Modified: 24/07/2007
Company: Apple Inc.
----------
Key: Boonty Games
ImagePath: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
69120 bytes
Created: 16/02/2007
Modified: 16/02/2007
Company: BOONTY
----------
Key: d343bus
ImagePath: System32\DRIVERS\d343bus.sys
C:\WINDOWS\System32\DRIVERS\d343bus.sys
136704 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: d343port
ImagePath: System32\DRIVERS\d343port.sys
C:\WINDOWS\System32\DRIVERS\d343port.sys
5632 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: D8D496F5
ImagePath: C:\WINDOWS\System32\86271EFE.EXE -d
C:\WINDOWS\System32\86271EFE.EXE [file not found to scan]
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created: 20/03/2008
Modified: 2/09/2008
Company: Google
----------
Key: IDriverT
ImagePath: C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created: 14/11/2005
Modified: 14/11/2005
Company: Macrovision Corporation
----------
Key: IKFileSec
ImagePath: \SystemRoot\system32\drivers\ikfilesec.sys
C:\WINDOWS\system32\drivers\ikfilesec.sys
42376 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysFlt
ImagePath: system32\drivers\iksysflt.sys
C:\WINDOWS\system32\drivers\iksysflt.sys
66952 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysSec
ImagePath: system32\drivers\iksyssec.sys
C:\WINDOWS\system32\drivers\iksyssec.sys
81288 bytes
Created: 2/09/2008
Modified: 10/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created: 22/03/2006
Modified: 17/08/2001
Company: Microsoft Corporation
----------
Key: nvatabus
ImagePath: System32\DRIVERS\nvatabus.sys
C:\WINDOWS\System32\DRIVERS\nvatabus.sys
-R- 79360 bytes
Created: 22/03/2006
Modified: 3/06/2004
Company: NVIDIA Corporation
----------
Key: NVENETFD
ImagePath: System32\DRIVERS\NVENETFD.sys
C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
-R- 33024 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: System32\DRIVERS\nvnetbus.sys
C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
-R- 12928 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: NVSvc
ImagePath: %SystemRoot%\System32\nvsvc32.exe
C:\WINDOWS\System32\nvsvc32.exe [file not found to scan]
----------
Key: nv_agp
ImagePath: System32\DRIVERS\nv_agp.sys
C:\WINDOWS\System32\DRIVERS\nv_agp.sys
-R- 21120 bytes
Created: 22/03/2006
Modified: 29/10/2003
Company: NVIDIA Corporation
----------
Key: PCAMPR5
ImagePath: \??\C:\WINDOWS\System32\PCAMPR5.SYS
C:\WINDOWS\System32\PCAMPR5.SYS [file not found to scan]
----------
Key: PCANDIS5
ImagePath: \??\C:\WINDOWS\System32\PCANDIS5.SYS
C:\WINDOWS\System32\PCANDIS5.SYS
16128 bytes
Created: 29/01/2007
Modified: 4/08/2003
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: sdAuxService
ImagePath: C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
356920 bytes
Created: 2/09/2008
Modified: 13/06/2008
Company: PC Tools
----------
Key: sdCoreService
ImagePath: C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
1073544 bytes
Created: 2/09/2008
Modified: 7/08/2008
Company: PC Tools
----------
Key: Secdrv
ImagePath: System32\DRIVERS\secdrv.sys
C:\WINDOWS\System32\DRIVERS\secdrv.sys
12464 bytes
Created: 25/03/2002
Modified: 29/12/2007
Company: Macrovision Europe Ltd
----------
Key: SIS163u
ImagePath: System32\DRIVERS\sis163u.sys
C:\WINDOWS\System32\DRIVERS\sis163u.sys [file not found to scan]
----------
Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73600 bytes
Created: 22/03/2006
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{51E7EF02-4C7B-4914-8243-03E90A0AD280}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 28/08/2001
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: USBAAPL
ImagePath: System32\Drivers\usbaapl.sys
C:\WINDOWS\System32\Drivers\usbaapl.sys
32000 bytes
Created: 28/12/2007
Modified: 10/07/2008
Company: Apple, Inc.
----------
Key: WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
10144 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
21280 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
5600 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
44064 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 11/10/2004
Modified: 18/10/2006
Company: Microsoft Corporation
----------
Key: xmasbus
ImagePath: System32\DRIVERS\xmasbus.sys
C:\WINDOWS\System32\DRIVERS\xmasbus.sys
140800 bytes
Created: 22/03/2006
Modified: 21/12/2003
Company:
----------
Key: xmasscsi
ImagePath: System32\Drivers\xmasscsi.sys
C:\WINDOWS\System32\Drivers\xmasscsi.sys
5504 bytes
Created: 22/03/2006
Modified: 20/12/2003
Company:
----------

************************************************************
19:39:37: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created: 22/03/2006
Modified: 28/02/2003
Company:
VxD Key = JAVASUP
----------
----------

************************************************************
19:39:37: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
19:39:37: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
75128 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
19:39:38: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
372736 bytes
Created: 10/05/2007
Modified: 10/05/2007
Company: Adobe Systems, Inc.
----------

************************************************************
19:39:38: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {02478D38-C3F9-4EFB-9B51-7695ECA05670}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
440384 bytes
Created: 6/03/2007
Modified: 26/10/2006
Company: Yahoo! Inc.
----------
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created: 22/10/2006
Modified: 22/10/2006
Company: Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
1562448 bytes
Created: 29/07/2008
Modified: 7/07/2008
Company: Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2436160 bytes
Created: 20/03/2008
Modified: 20/03/2008
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
651248 bytes
Created: 2/09/2008
Modified: 2/09/2008
Company: Google Inc.
----------

************************************************************
19:39:38: Scanning ----- SHELLSERVICEOBJECTS -----
Key: WebCheck
CLSID: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Path: %SystemRoot%\System32\webcheck.dll
C:\WINDOWS\System32\webcheck.dll
281600 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path: C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created: 18/10/2006
Modified: 18/10/2006
Company: Microsoft Corporation
----------

************************************************************
19:39:38: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
19:39:38: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
19:39:38: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank

************************************************************
19:39:38: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
19:39:38: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
113664 bytes
Created: 22/03/2006
Modified: 4/11/1999
Company: Adobe Systems, Inc.
Adobe Gamma Loader.lnk - links to C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
155715 bytes
Created: 24/04/2006
Modified: 12/04/2002
Company:
NaturalColorLoad.lnk - links to C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
19:39:39: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 29/08/2007
Modified: 11/04/2008
Company: Apple Inc.
Parameters: -task
Next Run Time: 8/09/2008 9:36:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: [blank]
----------

************************************************************
19:39:39: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
19:39:39: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Checking for specific malicious files:
C:\WINDOWS\system32\WS2Fix.exe - Trojan.FakeAlert
C:\WINDOWS\system32\WS2Fix.exe - process is either not running or could not be terminated
C:\WINDOWS\system32\WS2Fix.exe - file renamed to: C:\WINDOWS\system32\WS2Fix.exe.vir
----------
Desktop Wallpaper: C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Additional checks completed

************************************************************
19:40:08: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[56 loaded modules in total]
--------------------
C:\WINDOWS\System32\Ati2evxx.exe
[12 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[47 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[146 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[29 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[43 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
[52 loaded modules in total]
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
[17 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE
[100 loaded modules in total]
--------------------
C:\Program Files\D-Tools\daemon.exe
[30 loaded modules in total]
--------------------
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\SOUNDMAN.EXE
[21 loaded modules in total]
--------------------
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[47 loaded modules in total]
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[18 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe
[22 loaded modules in total]
--------------------
C:\themeGold55\CursorXP\CursorXP.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
[72 loaded modules in total]
--------------------
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
[50 loaded modules in total]
--------------------
C:\Program Files\PowerArchiver\PASTARTER.EXE
[15 loaded modules in total]
--------------------
C:\Program Files\Messenger\msmsgs.exe
[38 loaded modules in total]
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
[19 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[48 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
[25 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\System32\CTsvcCDA.exe
[9 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[14 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[31 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\msiexec.exe
[54 loaded modules in total]
--------------------
C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\jky8B.exe
FileSize: 2548288
[This is a Trojan Remover component]
[22 loaded modules in total]
--------------------

************************************************************
19:40:34: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
19:40:34: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
19:40:34: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
19:40:34: Scanning ------ %TEMP% DIRECTORY ------
d:\temp\JET22D.tmp appears to be in-use/locked
************************************************************
19:40:34: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
19:40:34: Scanning ------ ROOT DIRECTORY ------

************************************************************
19:40:35: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://neufportail.fr/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 19:40:35 02 sept. 2008
************************************************************

puis malwarebit:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

14:38:27 3/09/2008
mbam-log-09-03-2008 (14-38-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 92692
Temps écoulé: 32 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

puis ccleaner:

NETTOYAGE COMPLET - (2,177 secs)
------------------------------------------------------------------------------------------
7,98MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 236) 3,30MB
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Cookies\index.dat
Poubelle vidée (1 fichiers) 3,38MB
C:\WINDOWS\TEMP\{AC76BA86-7AD7-1036-7B44-A81200000003}.ini 678 bytes
d:\temp\jusched.log 173 bytes
d:\temp\wmplog00.sqm 1,45KB
d:\temp\wmplog01.sqm 1,49KB
d:\temp\wmplog02.sqm 1,75KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 1,61KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 327 bytes
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 49 bytes
C:\WINDOWS\WindowsUpdate.log 1,10MB
C:\WINDOWS\wmsetup.log 940 bytes
C:\WINDOWS\ntbtlog.txt 0,19MB
C:\WINDOWS\Debug\UserMode\userenv.log 1,63KB
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\soundData.sol 58 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\videostats.sol 199 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 377 bytes
------------------------------------------------------------------------------------------

les logs de kapersky:

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 3:43:34 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Zones critiques
C:\WINDOWS
d:\temp\

Statistiques de l'analyse
Total d'objets analysés 16848
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:13:06

Nom de l'objet infecté Nom du virus Dernière action
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

d:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 4:38:35 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\
G:\

Statistiques de l'analyse
Total d'objets analysés 58627
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:53:36

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.dpm L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.ldb L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\MSHist012008090320080904\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\FXZ0ANP1\Teasing_728x90_20080822[1].swf L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\k2kYxpr7kVMId2KDlr&related=1&related=1&autoplay=1[1] L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

D:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

et enfin celui de bitdefender:

BitDefender Online Scanner

Rapport d'analyse généré à: Wed, Sep 03, 2008 - 16:56:51

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;

Statistiques

Temps
00:15:44

Fichiers
69276

Directoires
5441

Secteurs de boot
0

Archives
1020

Paquets programmes
6286

Résultats

Virus identifiés
0

Fichiers infectés
0

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
0

Info sur les moteurs

Définition virus
1710163

Version des moteurs
AVCORE v1.7 (build 8314.19) (i386) (Aug 11 2008 17:31:32)

Analyse des plugins
16

Archive des plugins
43

Unpack des plugins
7

E-mail plugins
6

Système plugins
4

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

Aucun virus trouvé.

voila j'espère avoir bien travaillé mais après avoir refait une verif avec spyware doctor il m'a
retrouvé le trojan zlob.gen et je sais pas si il l'a bien enlevé

ok désole j'ai pas eu le temps de faire ça hier soir alors je m'y suis mis vite fait avant de devoir
repartir et un grand bonsoir au passage.
sinon voici les rapports sauf celui de regseeker qui ne m'en n'a pas généré et comme je ne savais pas trop quoi
faire avec lui j'ai juste nettoyé le registre.
enfin voici les autres rapports

trojan remover:

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.2.2541. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 19:39:25 02 sept. 2008
Using Database v7121
Operating System: Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System: NTFS
Data directory: C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\drikceline\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
[AV Warnings are suppressed]
Avast! Antivirus

************************************************************

************************************************************
19:39:26: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
19:39:26: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
19:39:26: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
19:39:26: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 29/08/2002
Modified: 13/06/2007
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: DAEMON Tools-1033
Value Data: "C:\Program Files\D-Tools\daemon.exe" -lang 1033
C:\Program Files\D-Tools\daemon.exe
81920 bytes
Created: 15/12/2003
Modified: 15/12/2003
Company: DAEMON'S HOME
--------------------
Value Name: ATIPTA
Value Data: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
344064 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company: ATI Technologies, Inc.
--------------------
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 77824 bytes
Created: 22/03/2006
Modified: 14/06/2005
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 27/03/2006
Modified: 9/07/2001
Company: Ahead Software Gmbh
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
79224 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 27/05/2008
Modified: 27/05/2008
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created: 11/01/2008
Modified: 11/01/2008
Company: Adobe Systems Incorporated
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
916560 bytes
Created: 2/09/2008
Modified: 30/08/2008
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: CTFMON.EXE
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
--------------------
Value Name: CursorXP
Value Data: C:\themeGold55\CursorXP\CursorXP.exe -s
C:\themeGold55\CursorXP\CursorXP.exe
100864 bytes
Created: 22/03/2006
Modified: 13/12/2001
Company:
--------------------
Value Name: CTSyncU.exe
Value Data: "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
692224 bytes
Created: 14/10/2006
Modified: 28/04/2006
Company:
--------------------
Value Name: MtdAcqu
Value Data: "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
278528 bytes
Created: 14/10/2006
Modified: 8/03/2006
Company: Creative Technology Ltd
--------------------
Value Name: PowerArchiver Tray
Value Data: C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\PowerArchiver\PASTARTER.EXE
141352 bytes
Created: 20/03/2007
Modified: 20/03/2007
Company: ConeXware, Inc.
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe
1694208 bytes
Created: 19/08/2004
Modified: 13/10/2004
Company: Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
19:39:28: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8}
Value: AVG Anti-Spyware 7.5
File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
79408 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------

************************************************************
19:39:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
19:39:28: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
19:39:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 3/11/2006
Modified: 3/11/2006
Company:
----------

************************************************************
19:39:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
19:39:30: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 4166FEB2
ImagePath: C:\WINDOWS\System32\F1DCCBDD.EXE -a
C:\WINDOWS\System32\F1DCCBDD.EXE [file not found to scan]
----------
Key: Adobe LM Service
ImagePath: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
68096 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
----------
Key: aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created: 15/07/2004
Modified: 15/07/2004
Company: Microsoft Corporation
----------
Key: aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created: 7/07/2008
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
17272 bytes
Created: 30/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ATI Smart
ImagePath: C:\WINDOWS\system32\ati2sgag.exe
C:\WINDOWS\system32\ati2sgag.exe
516096 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company:
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
144760 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
247160 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
349560 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: AVG Anti-Spyware Driver
ImagePath: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
11000 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company:
----------
Key: AVG Anti-Spyware Guard
ImagePath: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
312880 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------
Key: AvgAsCln
ImagePath: System32\DRIVERS\AvgAsCln.sys
C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys
3968 bytes
Created: 5/03/2007
Modified: 5/09/2006
Company: GRISOFT, s.r.o.
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created: 24/07/2007
Modified: 24/07/2007
Company: Apple Inc.
----------
Key: Boonty Games
ImagePath: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
69120 bytes
Created: 16/02/2007
Modified: 16/02/2007
Company: BOONTY
----------
Key: d343bus
ImagePath: System32\DRIVERS\d343bus.sys
C:\WINDOWS\System32\DRIVERS\d343bus.sys
136704 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: d343port
ImagePath: System32\DRIVERS\d343port.sys
C:\WINDOWS\System32\DRIVERS\d343port.sys
5632 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: D8D496F5
ImagePath: C:\WINDOWS\System32\86271EFE.EXE -d
C:\WINDOWS\System32\86271EFE.EXE [file not found to scan]
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created: 20/03/2008
Modified: 2/09/2008
Company: Google
----------
Key: IDriverT
ImagePath: C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created: 14/11/2005
Modified: 14/11/2005
Company: Macrovision Corporation
----------
Key: IKFileSec
ImagePath: \SystemRoot\system32\drivers\ikfilesec.sys
C:\WINDOWS\system32\drivers\ikfilesec.sys
42376 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysFlt
ImagePath: system32\drivers\iksysflt.sys
C:\WINDOWS\system32\drivers\iksysflt.sys
66952 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysSec
ImagePath: system32\drivers\iksyssec.sys
C:\WINDOWS\system32\drivers\iksyssec.sys
81288 bytes
Created: 2/09/2008
Modified: 10/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created: 22/03/2006
Modified: 17/08/2001
Company: Microsoft Corporation
----------
Key: nvatabus
ImagePath: System32\DRIVERS\nvatabus.sys
C:\WINDOWS\System32\DRIVERS\nvatabus.sys
-R- 79360 bytes
Created: 22/03/2006
Modified: 3/06/2004
Company: NVIDIA Corporation
----------
Key: NVENETFD
ImagePath: System32\DRIVERS\NVENETFD.sys
C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
-R- 33024 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: System32\DRIVERS\nvnetbus.sys
C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
-R- 12928 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: NVSvc
ImagePath: %SystemRoot%\System32\nvsvc32.exe
C:\WINDOWS\System32\nvsvc32.exe [file not found to scan]
----------
Key: nv_agp
ImagePath: System32\DRIVERS\nv_agp.sys
C:\WINDOWS\System32\DRIVERS\nv_agp.sys
-R- 21120 bytes
Created: 22/03/2006
Modified: 29/10/2003
Company: NVIDIA Corporation
----------
Key: PCAMPR5
ImagePath: \??\C:\WINDOWS\System32\PCAMPR5.SYS
C:\WINDOWS\System32\PCAMPR5.SYS [file not found to scan]
----------
Key: PCANDIS5
ImagePath: \??\C:\WINDOWS\System32\PCANDIS5.SYS
C:\WINDOWS\System32\PCANDIS5.SYS
16128 bytes
Created: 29/01/2007
Modified: 4/08/2003
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: sdAuxService
ImagePath: C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
356920 bytes
Created: 2/09/2008
Modified: 13/06/2008
Company: PC Tools
----------
Key: sdCoreService
ImagePath: C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
1073544 bytes
Created: 2/09/2008
Modified: 7/08/2008
Company: PC Tools
----------
Key: Secdrv
ImagePath: System32\DRIVERS\secdrv.sys
C:\WINDOWS\System32\DRIVERS\secdrv.sys
12464 bytes
Created: 25/03/2002
Modified: 29/12/2007
Company: Macrovision Europe Ltd
----------
Key: SIS163u
ImagePath: System32\DRIVERS\sis163u.sys
C:\WINDOWS\System32\DRIVERS\sis163u.sys [file not found to scan]
----------
Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73600 bytes
Created: 22/03/2006
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{51E7EF02-4C7B-4914-8243-03E90A0AD280}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 28/08/2001
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: USBAAPL
ImagePath: System32\Drivers\usbaapl.sys
C:\WINDOWS\System32\Drivers\usbaapl.sys
32000 bytes
Created: 28/12/2007
Modified: 10/07/2008
Company: Apple, Inc.
----------
Key: WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
10144 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
21280 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
5600 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
44064 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 11/10/2004
Modified: 18/10/2006
Company: Microsoft Corporation
----------
Key: xmasbus
ImagePath: System32\DRIVERS\xmasbus.sys
C:\WINDOWS\System32\DRIVERS\xmasbus.sys
140800 bytes
Created: 22/03/2006
Modified: 21/12/2003
Company:
----------
Key: xmasscsi
ImagePath: System32\Drivers\xmasscsi.sys
C:\WINDOWS\System32\Drivers\xmasscsi.sys
5504 bytes
Created: 22/03/2006
Modified: 20/12/2003
Company:
----------

************************************************************
19:39:37: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created: 22/03/2006
Modified: 28/02/2003
Company:
VxD Key = JAVASUP
----------
----------

************************************************************
19:39:37: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
19:39:37: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
75128 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
19:39:38: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
372736 bytes
Created: 10/05/2007
Modified: 10/05/2007
Company: Adobe Systems, Inc.
----------

************************************************************
19:39:38: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {02478D38-C3F9-4EFB-9B51-7695ECA05670}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
440384 bytes
Created: 6/03/2007
Modified: 26/10/2006
Company: Yahoo! Inc.
----------
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created: 22/10/2006
Modified: 22/10/2006
Company: Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
1562448 bytes
Created: 29/07/2008
Modified: 7/07/2008
Company: Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2436160 bytes
Created: 20/03/2008
Modified: 20/03/2008
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
651248 bytes
Created: 2/09/2008
Modified: 2/09/2008
Company: Google Inc.
----------

************************************************************
19:39:38: Scanning ----- SHELLSERVICEOBJECTS -----
Key: WebCheck
CLSID: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Path: %SystemRoot%\System32\webcheck.dll
C:\WINDOWS\System32\webcheck.dll
281600 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path: C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created: 18/10/2006
Modified: 18/10/2006
Company: Microsoft Corporation
----------

************************************************************
19:39:38: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
19:39:38: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
19:39:38: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank

************************************************************
19:39:38: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
19:39:38: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
113664 bytes
Created: 22/03/2006
Modified: 4/11/1999
Company: Adobe Systems, Inc.
Adobe Gamma Loader.lnk - links to C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
155715 bytes
Created: 24/04/2006
Modified: 12/04/2002
Company:
NaturalColorLoad.lnk - links to C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
19:39:39: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 29/08/2007
Modified: 11/04/2008
Company: Apple Inc.
Parameters: -task
Next Run Time: 8/09/2008 9:36:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: [blank]
----------

************************************************************
19:39:39: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
19:39:39: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Checking for specific malicious files:
C:\WINDOWS\system32\WS2Fix.exe - Trojan.FakeAlert
C:\WINDOWS\system32\WS2Fix.exe - process is either not running or could not be terminated
C:\WINDOWS\system32\WS2Fix.exe - file renamed to: C:\WINDOWS\system32\WS2Fix.exe.vir
----------
Desktop Wallpaper: C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Additional checks completed

************************************************************
19:40:08: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[56 loaded modules in total]
--------------------
C:\WINDOWS\System32\Ati2evxx.exe
[12 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[47 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[146 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[29 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[43 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
[52 loaded modules in total]
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
[17 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE
[100 loaded modules in total]
--------------------
C:\Program Files\D-Tools\daemon.exe
[30 loaded modules in total]
--------------------
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\SOUNDMAN.EXE
[21 loaded modules in total]
--------------------
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[47 loaded modules in total]
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[18 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe
[22 loaded modules in total]
--------------------
C:\themeGold55\CursorXP\CursorXP.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
[72 loaded modules in total]
--------------------
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
[50 loaded modules in total]
--------------------
C:\Program Files\PowerArchiver\PASTARTER.EXE
[15 loaded modules in total]
--------------------
C:\Program Files\Messenger\msmsgs.exe
[38 loaded modules in total]
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
[19 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[48 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
[25 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\System32\CTsvcCDA.exe
[9 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[14 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[31 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\msiexec.exe
[54 loaded modules in total]
--------------------
C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\jky8B.exe
FileSize: 2548288
[This is a Trojan Remover component]
[22 loaded modules in total]
--------------------

************************************************************
19:40:34: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
19:40:34: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
19:40:34: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
19:40:34: Scanning ------ %TEMP% DIRECTORY ------
d:\temp\JET22D.tmp appears to be in-use/locked
************************************************************
19:40:34: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
19:40:34: Scanning ------ ROOT DIRECTORY ------

************************************************************
19:40:35: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://neufportail.fr/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 19:40:35 02 sept. 2008
************************************************************

puis malwarebit:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

14:38:27 3/09/2008
mbam-log-09-03-2008 (14-38-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 92692
Temps écoulé: 32 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

puis ccleaner:

NETTOYAGE COMPLET - (2,177 secs)
------------------------------------------------------------------------------------------
7,98MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 236) 3,30MB
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Cookies\index.dat
Poubelle vidée (1 fichiers) 3,38MB
C:\WINDOWS\TEMP\{AC76BA86-7AD7-1036-7B44-A81200000003}.ini 678 bytes
d:\temp\jusched.log 173 bytes
d:\temp\wmplog00.sqm 1,45KB
d:\temp\wmplog01.sqm 1,49KB
d:\temp\wmplog02.sqm 1,75KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 1,61KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 327 bytes
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 49 bytes
C:\WINDOWS\WindowsUpdate.log 1,10MB
C:\WINDOWS\wmsetup.log 940 bytes
C:\WINDOWS\ntbtlog.txt 0,19MB
C:\WINDOWS\Debug\UserMode\userenv.log 1,63KB
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\soundData.sol 58 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\videostats.sol 199 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 377 bytes
------------------------------------------------------------------------------------------

les logs de kapersky:

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 3:43:34 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Zones critiques
C:\WINDOWS
d:\temp\

Statistiques de l'analyse
Total d'objets analysés 16848
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:13:06

Nom de l'objet infecté Nom du virus Dernière action
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

d:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 4:38:35 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\
G:\

Statistiques de l'analyse
Total d'objets analysés 58627
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:53:36

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.dpm L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.ldb L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\MSHist012008090320080904\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\FXZ0ANP1\Teasing_728x90_20080822[1].swf L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\k2kYxpr7kVMId2KDlr&related=1&related=1&autoplay=1[1] L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

D:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

et enfin celui de bitdefender:

BitDefender Online Scanner

Rapport d'analyse généré à: Wed, Sep 03, 2008 - 16:56:51

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;

Statistiques

Temps
00:15:44

Fichiers
69276

Directoires
5441

Secteurs de boot
0

Archives
1020

Paquets programmes
6286

Résultats

Virus identifiés
0

Fichiers infectés
0

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
0

Info sur les moteurs

Définition virus
1710163

Version des moteurs
AVCORE v1.7 (build 8314.19) (i386) (Aug 11 2008 17:31:32)

Analyse des plugins
16

Archive des plugins
43

Unpack des plugins
7

E-mail plugins
6

Système plugins
4

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

Aucun virus trouvé.

voila j'espère avoir bien travaillé mais après avoir refait une verif avec spyware doctor il m'a
retrouvé le trojan zlob.gen et je sais pas si il l'a bien enlevé

ok désole j'ai pas eu le temps de faire ça hier soir alors je m'y suis mis vite fait avant de devoir
repartir et un grand bonsoir au passage.
sinon voici les rapports sauf celui de regseeker qui ne m'en n'a pas généré et comme je ne savais pas trop quoi
faire avec lui j'ai juste nettoyé le registre.
enfin voici les autres rapports

trojan remover:

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.2.2541. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 19:39:25 02 sept. 2008
Using Database v7121
Operating System: Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System: NTFS
Data directory: C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\drikceline\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
[AV Warnings are suppressed]
Avast! Antivirus

************************************************************

************************************************************
19:39:26: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
19:39:26: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
19:39:26: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
19:39:26: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 29/08/2002
Modified: 13/06/2007
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: DAEMON Tools-1033
Value Data: "C:\Program Files\D-Tools\daemon.exe" -lang 1033
C:\Program Files\D-Tools\daemon.exe
81920 bytes
Created: 15/12/2003
Modified: 15/12/2003
Company: DAEMON'S HOME
--------------------
Value Name: ATIPTA
Value Data: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
344064 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company: ATI Technologies, Inc.
--------------------
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 77824 bytes
Created: 22/03/2006
Modified: 14/06/2005
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 27/03/2006
Modified: 9/07/2001
Company: Ahead Software Gmbh
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
79224 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 27/05/2008
Modified: 27/05/2008
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created: 11/01/2008
Modified: 11/01/2008
Company: Adobe Systems Incorporated
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
916560 bytes
Created: 2/09/2008
Modified: 30/08/2008
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: CTFMON.EXE
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
--------------------
Value Name: CursorXP
Value Data: C:\themeGold55\CursorXP\CursorXP.exe -s
C:\themeGold55\CursorXP\CursorXP.exe
100864 bytes
Created: 22/03/2006
Modified: 13/12/2001
Company:
--------------------
Value Name: CTSyncU.exe
Value Data: "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
692224 bytes
Created: 14/10/2006
Modified: 28/04/2006
Company:
--------------------
Value Name: MtdAcqu
Value Data: "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
278528 bytes
Created: 14/10/2006
Modified: 8/03/2006
Company: Creative Technology Ltd
--------------------
Value Name: PowerArchiver Tray
Value Data: C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\PowerArchiver\PASTARTER.EXE
141352 bytes
Created: 20/03/2007
Modified: 20/03/2007
Company: ConeXware, Inc.
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe
1694208 bytes
Created: 19/08/2004
Modified: 13/10/2004
Company: Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
19:39:28: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8}
Value: AVG Anti-Spyware 7.5
File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
79408 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------

************************************************************
19:39:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
19:39:28: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
19:39:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 3/11/2006
Modified: 3/11/2006
Company:
----------

************************************************************
19:39:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
19:39:30: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 4166FEB2
ImagePath: C:\WINDOWS\System32\F1DCCBDD.EXE -a
C:\WINDOWS\System32\F1DCCBDD.EXE [file not found to scan]
----------
Key: Adobe LM Service
ImagePath: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
68096 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
----------
Key: aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created: 15/07/2004
Modified: 15/07/2004
Company: Microsoft Corporation
----------
Key: aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created: 7/07/2008
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
17272 bytes
Created: 30/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ATI Smart
ImagePath: C:\WINDOWS\system32\ati2sgag.exe
C:\WINDOWS\system32\ati2sgag.exe
516096 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company:
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
144760 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
247160 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
349560 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: AVG Anti-Spyware Driver
ImagePath: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
11000 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company:
----------
Key: AVG Anti-Spyware Guard
ImagePath: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
312880 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------
Key: AvgAsCln
ImagePath: System32\DRIVERS\AvgAsCln.sys
C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys
3968 bytes
Created: 5/03/2007
Modified: 5/09/2006
Company: GRISOFT, s.r.o.
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created: 24/07/2007
Modified: 24/07/2007
Company: Apple Inc.
----------
Key: Boonty Games
ImagePath: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
69120 bytes
Created: 16/02/2007
Modified: 16/02/2007
Company: BOONTY
----------
Key: d343bus
ImagePath: System32\DRIVERS\d343bus.sys
C:\WINDOWS\System32\DRIVERS\d343bus.sys
136704 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: d343port
ImagePath: System32\DRIVERS\d343port.sys
C:\WINDOWS\System32\DRIVERS\d343port.sys
5632 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: D8D496F5
ImagePath: C:\WINDOWS\System32\86271EFE.EXE -d
C:\WINDOWS\System32\86271EFE.EXE [file not found to scan]
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created: 20/03/2008
Modified: 2/09/2008
Company: Google
----------
Key: IDriverT
ImagePath: C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created: 14/11/2005
Modified: 14/11/2005
Company: Macrovision Corporation
----------
Key: IKFileSec
ImagePath: \SystemRoot\system32\drivers\ikfilesec.sys
C:\WINDOWS\system32\drivers\ikfilesec.sys
42376 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysFlt
ImagePath: system32\drivers\iksysflt.sys
C:\WINDOWS\system32\drivers\iksysflt.sys
66952 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysSec
ImagePath: system32\drivers\iksyssec.sys
C:\WINDOWS\system32\drivers\iksyssec.sys
81288 bytes
Created: 2/09/2008
Modified: 10/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created: 22/03/2006
Modified: 17/08/2001
Company: Microsoft Corporation
----------
Key: nvatabus
ImagePath: System32\DRIVERS\nvatabus.sys
C:\WINDOWS\System32\DRIVERS\nvatabus.sys
-R- 79360 bytes
Created: 22/03/2006
Modified: 3/06/2004
Company: NVIDIA Corporation
----------
Key: NVENETFD
ImagePath: System32\DRIVERS\NVENETFD.sys
C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
-R- 33024 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: System32\DRIVERS\nvnetbus.sys
C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
-R- 12928 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: NVSvc
ImagePath: %SystemRoot%\System32\nvsvc32.exe
C:\WINDOWS\System32\nvsvc32.exe [file not found to scan]
----------
Key: nv_agp
ImagePath: System32\DRIVERS\nv_agp.sys
C:\WINDOWS\System32\DRIVERS\nv_agp.sys
-R- 21120 bytes
Created: 22/03/2006
Modified: 29/10/2003
Company: NVIDIA Corporation
----------
Key: PCAMPR5
ImagePath: \??\C:\WINDOWS\System32\PCAMPR5.SYS
C:\WINDOWS\System32\PCAMPR5.SYS [file not found to scan]
----------
Key: PCANDIS5
ImagePath: \??\C:\WINDOWS\System32\PCANDIS5.SYS
C:\WINDOWS\System32\PCANDIS5.SYS
16128 bytes
Created: 29/01/2007
Modified: 4/08/2003
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: sdAuxService
ImagePath: C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
356920 bytes
Created: 2/09/2008
Modified: 13/06/2008
Company: PC Tools
----------
Key: sdCoreService
ImagePath: C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
1073544 bytes
Created: 2/09/2008
Modified: 7/08/2008
Company: PC Tools
----------
Key: Secdrv
ImagePath: System32\DRIVERS\secdrv.sys
C:\WINDOWS\System32\DRIVERS\secdrv.sys
12464 bytes
Created: 25/03/2002
Modified: 29/12/2007
Company: Macrovision Europe Ltd
----------
Key: SIS163u
ImagePath: System32\DRIVERS\sis163u.sys
C:\WINDOWS\System32\DRIVERS\sis163u.sys [file not found to scan]
----------
Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73600 bytes
Created: 22/03/2006
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{51E7EF02-4C7B-4914-8243-03E90A0AD280}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 28/08/2001
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: USBAAPL
ImagePath: System32\Drivers\usbaapl.sys
C:\WINDOWS\System32\Drivers\usbaapl.sys
32000 bytes
Created: 28/12/2007
Modified: 10/07/2008
Company: Apple, Inc.
----------
Key: WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
10144 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
21280 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
5600 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
44064 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 11/10/2004
Modified: 18/10/2006
Company: Microsoft Corporation
----------
Key: xmasbus
ImagePath: System32\DRIVERS\xmasbus.sys
C:\WINDOWS\System32\DRIVERS\xmasbus.sys
140800 bytes
Created: 22/03/2006
Modified: 21/12/2003
Company:
----------
Key: xmasscsi
ImagePath: System32\Drivers\xmasscsi.sys
C:\WINDOWS\System32\Drivers\xmasscsi.sys
5504 bytes
Created: 22/03/2006
Modified: 20/12/2003
Company:
----------

************************************************************
19:39:37: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created: 22/03/2006
Modified: 28/02/2003
Company:
VxD Key = JAVASUP
----------
----------

************************************************************
19:39:37: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
19:39:37: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
75128 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
19:39:38: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
372736 bytes
Created: 10/05/2007
Modified: 10/05/2007
Company: Adobe Systems, Inc.
----------

************************************************************
19:39:38: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {02478D38-C3F9-4EFB-9B51-7695ECA05670}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
440384 bytes
Created: 6/03/2007
Modified: 26/10/2006
Company: Yahoo! Inc.
----------
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created: 22/10/2006
Modified: 22/10/2006
Company: Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
1562448 bytes
Created: 29/07/2008
Modified: 7/07/2008
Company: Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2436160 bytes
Created: 20/03/2008
Modified: 20/03/2008
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
651248 bytes
Created: 2/09/2008
Modified: 2/09/2008
Company: Google Inc.
----------

************************************************************
19:39:38: Scanning ----- SHELLSERVICEOBJECTS -----
Key: WebCheck
CLSID: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Path: %SystemRoot%\System32\webcheck.dll
C:\WINDOWS\System32\webcheck.dll
281600 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path: C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created: 18/10/2006
Modified: 18/10/2006
Company: Microsoft Corporation
----------

************************************************************
19:39:38: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
19:39:38: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
19:39:38: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank

************************************************************
19:39:38: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
19:39:38: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
113664 bytes
Created: 22/03/2006
Modified: 4/11/1999
Company: Adobe Systems, Inc.
Adobe Gamma Loader.lnk - links to C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
155715 bytes
Created: 24/04/2006
Modified: 12/04/2002
Company:
NaturalColorLoad.lnk - links to C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
19:39:39: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 29/08/2007
Modified: 11/04/2008
Company: Apple Inc.
Parameters: -task
Next Run Time: 8/09/2008 9:36:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: [blank]
----------

************************************************************
19:39:39: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
19:39:39: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Checking for specific malicious files:
C:\WINDOWS\system32\WS2Fix.exe - Trojan.FakeAlert
C:\WINDOWS\system32\WS2Fix.exe - process is either not running or could not be terminated
C:\WINDOWS\system32\WS2Fix.exe - file renamed to: C:\WINDOWS\system32\WS2Fix.exe.vir
----------
Desktop Wallpaper: C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Additional checks completed

************************************************************
19:40:08: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[56 loaded modules in total]
--------------------
C:\WINDOWS\System32\Ati2evxx.exe
[12 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[47 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[146 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[29 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[43 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
[52 loaded modules in total]
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
[17 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE
[100 loaded modules in total]
--------------------
C:\Program Files\D-Tools\daemon.exe
[30 loaded modules in total]
--------------------
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\SOUNDMAN.EXE
[21 loaded modules in total]
--------------------
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[47 loaded modules in total]
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[18 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe
[22 loaded modules in total]
--------------------
C:\themeGold55\CursorXP\CursorXP.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
[72 loaded modules in total]
--------------------
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
[50 loaded modules in total]
--------------------
C:\Program Files\PowerArchiver\PASTARTER.EXE
[15 loaded modules in total]
--------------------
C:\Program Files\Messenger\msmsgs.exe
[38 loaded modules in total]
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
[19 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[48 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
[25 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\System32\CTsvcCDA.exe
[9 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[14 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[31 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\msiexec.exe
[54 loaded modules in total]
--------------------
C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\jky8B.exe
FileSize: 2548288
[This is a Trojan Remover component]
[22 loaded modules in total]
--------------------

************************************************************
19:40:34: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
19:40:34: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
19:40:34: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
19:40:34: Scanning ------ %TEMP% DIRECTORY ------
d:\temp\JET22D.tmp appears to be in-use/locked
************************************************************
19:40:34: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
19:40:34: Scanning ------ ROOT DIRECTORY ------

************************************************************
19:40:35: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://neufportail.fr/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 19:40:35 02 sept. 2008
************************************************************

puis malwarebit:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

14:38:27 3/09/2008
mbam-log-09-03-2008 (14-38-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 92692
Temps écoulé: 32 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

puis ccleaner:

NETTOYAGE COMPLET - (2,177 secs)
------------------------------------------------------------------------------------------
7,98MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 236) 3,30MB
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Cookies\index.dat
Poubelle vidée (1 fichiers) 3,38MB
C:\WINDOWS\TEMP\{AC76BA86-7AD7-1036-7B44-A81200000003}.ini 678 bytes
d:\temp\jusched.log 173 bytes
d:\temp\wmplog00.sqm 1,45KB
d:\temp\wmplog01.sqm 1,49KB
d:\temp\wmplog02.sqm 1,75KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 1,61KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 327 bytes
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 49 bytes
C:\WINDOWS\WindowsUpdate.log 1,10MB
C:\WINDOWS\wmsetup.log 940 bytes
C:\WINDOWS\ntbtlog.txt 0,19MB
C:\WINDOWS\Debug\UserMode\userenv.log 1,63KB
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\soundData.sol 58 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\videostats.sol 199 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 377 bytes
------------------------------------------------------------------------------------------

les logs de kapersky:

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 3:43:34 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Zones critiques
C:\WINDOWS
d:\temp\

Statistiques de l'analyse
Total d'objets analysés 16848
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:13:06

Nom de l'objet infecté Nom du virus Dernière action
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

d:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 4:38:35 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\
G:\

Statistiques de l'analyse
Total d'objets analysés 58627
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:53:36

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.dpm L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.ldb L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\MSHist012008090320080904\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\FXZ0ANP1\Teasing_728x90_20080822[1].swf L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\k2kYxpr7kVMId2KDlr&related=1&related=1&autoplay=1[1] L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

D:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

et enfin celui de bitdefender:

BitDefender Online Scanner

Rapport d'analyse généré à: Wed, Sep 03, 2008 - 16:56:51

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;

Statistiques

Temps
00:15:44

Fichiers
69276

Directoires
5441

Secteurs de boot
0

Archives
1020

Paquets programmes
6286

Résultats

Virus identifiés
0

Fichiers infectés
0

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
0

Info sur les moteurs

Définition virus
1710163

Version des moteurs
AVCORE v1.7 (build 8314.19) (i386) (Aug 11 2008 17:31:32)

Analyse des plugins
16

Archive des plugins
43

Unpack des plugins
7

E-mail plugins
6

Système plugins
4

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

Aucun virus trouvé.

voila j'espère avoir bien travaillé mais après avoir refait une verif avec spyware doctor il m'a
retrouvé le trojan zlob.gen et je sais pas si il l'a bien enlevé

ok désole j'ai pas eu le temps de faire ça hier soir alors je m'y suis mis vite fait avant de devoir
repartir et un grand bonsoir au passage.
sinon voici les rapports sauf celui de regseeker qui ne m'en n'a pas généré et comme je ne savais pas trop quoi
faire avec lui j'ai juste nettoyé le registre.
enfin voici les autres rapports

trojan remover:

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.2.2541. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 19:39:25 02 sept. 2008
Using Database v7121
Operating System: Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System: NTFS
Data directory: C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\drikceline\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
[AV Warnings are suppressed]
Avast! Antivirus

************************************************************

************************************************************
19:39:26: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
19:39:26: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
19:39:26: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
19:39:26: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 29/08/2002
Modified: 13/06/2007
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: DAEMON Tools-1033
Value Data: "C:\Program Files\D-Tools\daemon.exe" -lang 1033
C:\Program Files\D-Tools\daemon.exe
81920 bytes
Created: 15/12/2003
Modified: 15/12/2003
Company: DAEMON'S HOME
--------------------
Value Name: ATIPTA
Value Data: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
344064 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company: ATI Technologies, Inc.
--------------------
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 77824 bytes
Created: 22/03/2006
Modified: 14/06/2005
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 27/03/2006
Modified: 9/07/2001
Company: Ahead Software Gmbh
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
79224 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 27/05/2008
Modified: 27/05/2008
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created: 11/01/2008
Modified: 11/01/2008
Company: Adobe Systems Incorporated
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
916560 bytes
Created: 2/09/2008
Modified: 30/08/2008
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: CTFMON.EXE
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
--------------------
Value Name: CursorXP
Value Data: C:\themeGold55\CursorXP\CursorXP.exe -s
C:\themeGold55\CursorXP\CursorXP.exe
100864 bytes
Created: 22/03/2006
Modified: 13/12/2001
Company:
--------------------
Value Name: CTSyncU.exe
Value Data: "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
692224 bytes
Created: 14/10/2006
Modified: 28/04/2006
Company:
--------------------
Value Name: MtdAcqu
Value Data: "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
278528 bytes
Created: 14/10/2006
Modified: 8/03/2006
Company: Creative Technology Ltd
--------------------
Value Name: PowerArchiver Tray
Value Data: C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\PowerArchiver\PASTARTER.EXE
141352 bytes
Created: 20/03/2007
Modified: 20/03/2007
Company: ConeXware, Inc.
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe
1694208 bytes
Created: 19/08/2004
Modified: 13/10/2004
Company: Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
19:39:28: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8}
Value: AVG Anti-Spyware 7.5
File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
79408 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------

************************************************************
19:39:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
19:39:28: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
19:39:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 3/11/2006
Modified: 3/11/2006
Company:
----------

************************************************************
19:39:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
19:39:30: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 4166FEB2
ImagePath: C:\WINDOWS\System32\F1DCCBDD.EXE -a
C:\WINDOWS\System32\F1DCCBDD.EXE [file not found to scan]
----------
Key: Adobe LM Service
ImagePath: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
68096 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
----------
Key: aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created: 15/07/2004
Modified: 15/07/2004
Company: Microsoft Corporation
----------
Key: aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created: 7/07/2008
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
17272 bytes
Created: 30/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ATI Smart
ImagePath: C:\WINDOWS\system32\ati2sgag.exe
C:\WINDOWS\system32\ati2sgag.exe
516096 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company:
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
144760 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
247160 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
349560 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: AVG Anti-Spyware Driver
ImagePath: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
11000 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company:
----------
Key: AVG Anti-Spyware Guard
ImagePath: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
312880 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------
Key: AvgAsCln
ImagePath: System32\DRIVERS\AvgAsCln.sys
C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys
3968 bytes
Created: 5/03/2007
Modified: 5/09/2006
Company: GRISOFT, s.r.o.
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created: 24/07/2007
Modified: 24/07/2007
Company: Apple Inc.
----------
Key: Boonty Games
ImagePath: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
69120 bytes
Created: 16/02/2007
Modified: 16/02/2007
Company: BOONTY
----------
Key: d343bus
ImagePath: System32\DRIVERS\d343bus.sys
C:\WINDOWS\System32\DRIVERS\d343bus.sys
136704 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: d343port
ImagePath: System32\DRIVERS\d343port.sys
C:\WINDOWS\System32\DRIVERS\d343port.sys
5632 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: D8D496F5
ImagePath: C:\WINDOWS\System32\86271EFE.EXE -d
C:\WINDOWS\System32\86271EFE.EXE [file not found to scan]
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created: 20/03/2008
Modified: 2/09/2008
Company: Google
----------
Key: IDriverT
ImagePath: C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created: 14/11/2005
Modified: 14/11/2005
Company: Macrovision Corporation
----------
Key: IKFileSec
ImagePath: \SystemRoot\system32\drivers\ikfilesec.sys
C:\WINDOWS\system32\drivers\ikfilesec.sys
42376 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysFlt
ImagePath: system32\drivers\iksysflt.sys
C:\WINDOWS\system32\drivers\iksysflt.sys
66952 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysSec
ImagePath: system32\drivers\iksyssec.sys
C:\WINDOWS\system32\drivers\iksyssec.sys
81288 bytes
Created: 2/09/2008
Modified: 10/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created: 22/03/2006
Modified: 17/08/2001
Company: Microsoft Corporation
----------
Key: nvatabus
ImagePath: System32\DRIVERS\nvatabus.sys
C:\WINDOWS\System32\DRIVERS\nvatabus.sys
-R- 79360 bytes
Created: 22/03/2006
Modified: 3/06/2004
Company: NVIDIA Corporation
----------
Key: NVENETFD
ImagePath: System32\DRIVERS\NVENETFD.sys
C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
-R- 33024 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: System32\DRIVERS\nvnetbus.sys
C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
-R- 12928 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: NVSvc
ImagePath: %SystemRoot%\System32\nvsvc32.exe
C:\WINDOWS\System32\nvsvc32.exe [file not found to scan]
----------
Key: nv_agp
ImagePath: System32\DRIVERS\nv_agp.sys
C:\WINDOWS\System32\DRIVERS\nv_agp.sys
-R- 21120 bytes
Created: 22/03/2006
Modified: 29/10/2003
Company: NVIDIA Corporation
----------
Key: PCAMPR5
ImagePath: \??\C:\WINDOWS\System32\PCAMPR5.SYS
C:\WINDOWS\System32\PCAMPR5.SYS [file not found to scan]
----------
Key: PCANDIS5
ImagePath: \??\C:\WINDOWS\System32\PCANDIS5.SYS
C:\WINDOWS\System32\PCANDIS5.SYS
16128 bytes
Created: 29/01/2007
Modified: 4/08/2003
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: sdAuxService
ImagePath: C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
356920 bytes
Created: 2/09/2008
Modified: 13/06/2008
Company: PC Tools
----------
Key: sdCoreService
ImagePath: C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
1073544 bytes
Created: 2/09/2008
Modified: 7/08/2008
Company: PC Tools
----------
Key: Secdrv
ImagePath: System32\DRIVERS\secdrv.sys
C:\WINDOWS\System32\DRIVERS\secdrv.sys
12464 bytes
Created: 25/03/2002
Modified: 29/12/2007
Company: Macrovision Europe Ltd
----------
Key: SIS163u
ImagePath: System32\DRIVERS\sis163u.sys
C:\WINDOWS\System32\DRIVERS\sis163u.sys [file not found to scan]
----------
Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73600 bytes
Created: 22/03/2006
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{51E7EF02-4C7B-4914-8243-03E90A0AD280}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 28/08/2001
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: USBAAPL
ImagePath: System32\Drivers\usbaapl.sys
C:\WINDOWS\System32\Drivers\usbaapl.sys
32000 bytes
Created: 28/12/2007
Modified: 10/07/2008
Company: Apple, Inc.
----------
Key: WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
10144 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
21280 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
5600 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
44064 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 11/10/2004
Modified: 18/10/2006
Company: Microsoft Corporation
----------
Key: xmasbus
ImagePath: System32\DRIVERS\xmasbus.sys
C:\WINDOWS\System32\DRIVERS\xmasbus.sys
140800 bytes
Created: 22/03/2006
Modified: 21/12/2003
Company:
----------
Key: xmasscsi
ImagePath: System32\Drivers\xmasscsi.sys
C:\WINDOWS\System32\Drivers\xmasscsi.sys
5504 bytes
Created: 22/03/2006
Modified: 20/12/2003
Company:
----------

************************************************************
19:39:37: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created: 22/03/2006
Modified: 28/02/2003
Company:
VxD Key = JAVASUP
----------
----------

************************************************************
19:39:37: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
19:39:37: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
75128 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
19:39:38: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
372736 bytes
Created: 10/05/2007
Modified: 10/05/2007
Company: Adobe Systems, Inc.
----------

************************************************************
19:39:38: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {02478D38-C3F9-4EFB-9B51-7695ECA05670}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
440384 bytes
Created: 6/03/2007
Modified: 26/10/2006
Company: Yahoo! Inc.
----------
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created: 22/10/2006
Modified: 22/10/2006
Company: Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
1562448 bytes
Created: 29/07/2008
Modified: 7/07/2008
Company: Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2436160 bytes
Created: 20/03/2008
Modified: 20/03/2008
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
651248 bytes
Created: 2/09/2008
Modified: 2/09/2008
Company: Google Inc.
----------

************************************************************
19:39:38: Scanning ----- SHELLSERVICEOBJECTS -----
Key: WebCheck
CLSID: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Path: %SystemRoot%\System32\webcheck.dll
C:\WINDOWS\System32\webcheck.dll
281600 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path: C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created: 18/10/2006
Modified: 18/10/2006
Company: Microsoft Corporation
----------

************************************************************
19:39:38: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
19:39:38: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
19:39:38: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank

************************************************************
19:39:38: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
19:39:38: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
113664 bytes
Created: 22/03/2006
Modified: 4/11/1999
Company: Adobe Systems, Inc.
Adobe Gamma Loader.lnk - links to C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
155715 bytes
Created: 24/04/2006
Modified: 12/04/2002
Company:
NaturalColorLoad.lnk - links to C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
19:39:39: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 29/08/2007
Modified: 11/04/2008
Company: Apple Inc.
Parameters: -task
Next Run Time: 8/09/2008 9:36:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: [blank]
----------

************************************************************
19:39:39: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
19:39:39: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Checking for specific malicious files:
C:\WINDOWS\system32\WS2Fix.exe - Trojan.FakeAlert
C:\WINDOWS\system32\WS2Fix.exe - process is either not running or could not be terminated
C:\WINDOWS\system32\WS2Fix.exe - file renamed to: C:\WINDOWS\system32\WS2Fix.exe.vir
----------
Desktop Wallpaper: C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Additional checks completed

************************************************************
19:40:08: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[56 loaded modules in total]
--------------------
C:\WINDOWS\System32\Ati2evxx.exe
[12 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[47 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[146 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[29 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[43 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
[52 loaded modules in total]
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
[17 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE
[100 loaded modules in total]
--------------------
C:\Program Files\D-Tools\daemon.exe
[30 loaded modules in total]
--------------------
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\SOUNDMAN.EXE
[21 loaded modules in total]
--------------------
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[47 loaded modules in total]
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[18 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe
[22 loaded modules in total]
--------------------
C:\themeGold55\CursorXP\CursorXP.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
[72 loaded modules in total]
--------------------
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
[50 loaded modules in total]
--------------------
C:\Program Files\PowerArchiver\PASTARTER.EXE
[15 loaded modules in total]
--------------------
C:\Program Files\Messenger\msmsgs.exe
[38 loaded modules in total]
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
[19 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[48 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
[25 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\System32\CTsvcCDA.exe
[9 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[14 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[31 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\msiexec.exe
[54 loaded modules in total]
--------------------
C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\jky8B.exe
FileSize: 2548288
[This is a Trojan Remover component]
[22 loaded modules in total]
--------------------

************************************************************
19:40:34: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
19:40:34: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
19:40:34: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
19:40:34: Scanning ------ %TEMP% DIRECTORY ------
d:\temp\JET22D.tmp appears to be in-use/locked
************************************************************
19:40:34: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
19:40:34: Scanning ------ ROOT DIRECTORY ------

************************************************************
19:40:35: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://neufportail.fr/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 19:40:35 02 sept. 2008
************************************************************

puis malwarebit:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

14:38:27 3/09/2008
mbam-log-09-03-2008 (14-38-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 92692
Temps écoulé: 32 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

puis ccleaner:

NETTOYAGE COMPLET - (2,177 secs)
------------------------------------------------------------------------------------------
7,98MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 236) 3,30MB
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Cookies\index.dat
Poubelle vidée (1 fichiers) 3,38MB
C:\WINDOWS\TEMP\{AC76BA86-7AD7-1036-7B44-A81200000003}.ini 678 bytes
d:\temp\jusched.log 173 bytes
d:\temp\wmplog00.sqm 1,45KB
d:\temp\wmplog01.sqm 1,49KB
d:\temp\wmplog02.sqm 1,75KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 1,61KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 327 bytes
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 49 bytes
C:\WINDOWS\WindowsUpdate.log 1,10MB
C:\WINDOWS\wmsetup.log 940 bytes
C:\WINDOWS\ntbtlog.txt 0,19MB
C:\WINDOWS\Debug\UserMode\userenv.log 1,63KB
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\soundData.sol 58 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\videostats.sol 199 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 377 bytes
------------------------------------------------------------------------------------------

les logs de kapersky:

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 3:43:34 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Zones critiques
C:\WINDOWS
d:\temp\

Statistiques de l'analyse
Total d'objets analysés 16848
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:13:06

Nom de l'objet infecté Nom du virus Dernière action
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

d:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 4:38:35 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\
G:\

Statistiques de l'analyse
Total d'objets analysés 58627
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:53:36

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.dpm L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.ldb L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\MSHist012008090320080904\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\FXZ0ANP1\Teasing_728x90_20080822[1].swf L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\k2kYxpr7kVMId2KDlr&related=1&related=1&autoplay=1[1] L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

D:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

et enfin celui de bitdefender:

BitDefender Online Scanner

Rapport d'analyse généré à: Wed, Sep 03, 2008 - 16:56:51

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;

Statistiques

Temps
00:15:44

Fichiers
69276

Directoires
5441

Secteurs de boot
0

Archives
1020

Paquets programmes
6286

Résultats

Virus identifiés
0

Fichiers infectés
0

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
0

Info sur les moteurs

Définition virus
1710163

Version des moteurs
AVCORE v1.7 (build 8314.19) (i386) (Aug 11 2008 17:31:32)

Analyse des plugins
16

Archive des plugins
43

Unpack des plugins
7

E-mail plugins
6

Système plugins
4

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

Aucun virus trouvé.

voila j'espère avoir bien travaillé mais après avoir refait une verif avec spyware doctor il m'a
retrouvé le trojan zlob.gen et je sais pas si il l'a bien enlevé

ok désole j'ai pas eu le temps de faire ça hier soir alors je m'y suis mis vite fait avant de devoir
repartir et un grand bonsoir au passage.
sinon voici les rapports sauf celui de regseeker qui ne m'en n'a pas généré et comme je ne savais pas trop quoi
faire avec lui j'ai juste nettoyé le registre.
enfin voici les autres rapports

trojan remover:

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.2.2541. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 19:39:25 02 sept. 2008
Using Database v7121
Operating System: Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System: NTFS
Data directory: C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory: C:\Documents and Settings\drikceline\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
[AV Warnings are suppressed]
Avast! Antivirus

************************************************************

************************************************************
19:39:26: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
19:39:26: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
19:39:26: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
19:39:26: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 29/08/2002
Modified: 13/06/2007
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: DAEMON Tools-1033
Value Data: "C:\Program Files\D-Tools\daemon.exe" -lang 1033
C:\Program Files\D-Tools\daemon.exe
81920 bytes
Created: 15/12/2003
Modified: 15/12/2003
Company: DAEMON'S HOME
--------------------
Value Name: ATIPTA
Value Data: "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
344064 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company: ATI Technologies, Inc.
--------------------
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 77824 bytes
Created: 22/03/2006
Modified: 14/06/2005
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 27/03/2006
Modified: 9/07/2001
Company: Ahead Software Gmbh
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
79224 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\qttask.exe" -atboottime
C:\Program Files\QuickTime\qttask.exe
413696 bytes
Created: 27/05/2008
Modified: 27/05/2008
Company: Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created: 11/01/2008
Modified: 11/01/2008
Company: Adobe Systems Incorporated
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
916560 bytes
Created: 2/09/2008
Modified: 30/08/2008
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: CTFMON.EXE
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
--------------------
Value Name: CursorXP
Value Data: C:\themeGold55\CursorXP\CursorXP.exe -s
C:\themeGold55\CursorXP\CursorXP.exe
100864 bytes
Created: 22/03/2006
Modified: 13/12/2001
Company:
--------------------
Value Name: CTSyncU.exe
Value Data: "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
692224 bytes
Created: 14/10/2006
Modified: 28/04/2006
Company:
--------------------
Value Name: MtdAcqu
Value Data: "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
278528 bytes
Created: 14/10/2006
Modified: 8/03/2006
Company: Creative Technology Ltd
--------------------
Value Name: PowerArchiver Tray
Value Data: C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\PowerArchiver\PASTARTER.EXE
141352 bytes
Created: 20/03/2007
Modified: 20/03/2007
Company: ConeXware, Inc.
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe
1694208 bytes
Created: 19/08/2004
Modified: 13/10/2004
Company: Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
19:39:28: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------
ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8}
Value: AVG Anti-Spyware 7.5
File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
79408 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------

************************************************************
19:39:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
19:39:28: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
19:39:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created: 3/11/2006
Modified: 3/11/2006
Company:
----------

************************************************************
19:39:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
19:39:30: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 4166FEB2
ImagePath: C:\WINDOWS\System32\F1DCCBDD.EXE -a
C:\WINDOWS\System32\F1DCCBDD.EXE [file not found to scan]
----------
Key: Adobe LM Service
ImagePath: "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
68096 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
----------
Key: Apple Mobile Device
ImagePath: "C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created: 10/07/2008
Modified: 10/07/2008
Company: Apple Inc.
----------
Key: aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created: 15/07/2004
Modified: 15/07/2004
Company: Microsoft Corporation
----------
Key: aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created: 7/07/2008
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
17272 bytes
Created: 30/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ATI Smart
ImagePath: C:\WINDOWS\system32\ati2sgag.exe
C:\WINDOWS\system32\ati2sgag.exe
516096 bytes
Created: 22/03/2006
Modified: 30/08/2005
Company:
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
144760 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
247160 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
349560 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: AVG Anti-Spyware Driver
ImagePath: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
11000 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company:
----------
Key: AVG Anti-Spyware Guard
ImagePath: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
312880 bytes
Created: 28/09/2006
Modified: 18/10/2007
Company: GRISOFT s.r.o.
----------
Key: AvgAsCln
ImagePath: System32\DRIVERS\AvgAsCln.sys
C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys
3968 bytes
Created: 5/03/2007
Modified: 5/09/2006
Company: GRISOFT, s.r.o.
----------
Key: Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created: 24/07/2007
Modified: 24/07/2007
Company: Apple Inc.
----------
Key: Boonty Games
ImagePath: "C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
69120 bytes
Created: 16/02/2007
Modified: 16/02/2007
Company: BOONTY
----------
Key: d343bus
ImagePath: System32\DRIVERS\d343bus.sys
C:\WINDOWS\System32\DRIVERS\d343bus.sys
136704 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: d343port
ImagePath: System32\DRIVERS\d343port.sys
C:\WINDOWS\System32\DRIVERS\d343port.sys
5632 bytes
Created: 22/03/2006
Modified: 15/12/2003
Company:
----------
Key: D8D496F5
ImagePath: C:\WINDOWS\System32\86271EFE.EXE -d
C:\WINDOWS\System32\86271EFE.EXE [file not found to scan]
----------
Key: gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created: 20/03/2008
Modified: 2/09/2008
Company: Google
----------
Key: IDriverT
ImagePath: C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created: 14/11/2005
Modified: 14/11/2005
Company: Macrovision Corporation
----------
Key: IKFileSec
ImagePath: \SystemRoot\system32\drivers\ikfilesec.sys
C:\WINDOWS\system32\drivers\ikfilesec.sys
42376 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysFlt
ImagePath: system32\drivers\iksysflt.sys
C:\WINDOWS\system32\drivers\iksysflt.sys
66952 bytes
Created: 2/09/2008
Modified: 2/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: IKSysSec
ImagePath: system32\drivers\iksyssec.sys
C:\WINDOWS\system32\drivers\iksyssec.sys
81288 bytes
Created: 2/09/2008
Modified: 10/06/2008
Company: PCTools Research Pty Ltd.
----------
Key: ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created: 22/03/2006
Modified: 17/08/2001
Company: Microsoft Corporation
----------
Key: nvatabus
ImagePath: System32\DRIVERS\nvatabus.sys
C:\WINDOWS\System32\DRIVERS\nvatabus.sys
-R- 79360 bytes
Created: 22/03/2006
Modified: 3/06/2004
Company: NVIDIA Corporation
----------
Key: NVENETFD
ImagePath: System32\DRIVERS\NVENETFD.sys
C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
-R- 33024 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: nvnetbus
ImagePath: System32\DRIVERS\nvnetbus.sys
C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
-R- 12928 bytes
Created: 22/03/2006
Modified: 28/07/2004
Company: NVIDIA Corporation
----------
Key: NVSvc
ImagePath: %SystemRoot%\System32\nvsvc32.exe
C:\WINDOWS\System32\nvsvc32.exe [file not found to scan]
----------
Key: nv_agp
ImagePath: System32\DRIVERS\nv_agp.sys
C:\WINDOWS\System32\DRIVERS\nv_agp.sys
-R- 21120 bytes
Created: 22/03/2006
Modified: 29/10/2003
Company: NVIDIA Corporation
----------
Key: PCAMPR5
ImagePath: \??\C:\WINDOWS\System32\PCAMPR5.SYS
C:\WINDOWS\System32\PCAMPR5.SYS [file not found to scan]
----------
Key: PCANDIS5
ImagePath: \??\C:\WINDOWS\System32\PCANDIS5.SYS
C:\WINDOWS\System32\PCANDIS5.SYS
16128 bytes
Created: 29/01/2007
Modified: 4/08/2003
Company: Printing Communications Assoc., Inc. (PCAUSA)
----------
Key: sdAuxService
ImagePath: C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
356920 bytes
Created: 2/09/2008
Modified: 13/06/2008
Company: PC Tools
----------
Key: sdCoreService
ImagePath: C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
1073544 bytes
Created: 2/09/2008
Modified: 7/08/2008
Company: PC Tools
----------
Key: Secdrv
ImagePath: System32\DRIVERS\secdrv.sys
C:\WINDOWS\System32\DRIVERS\secdrv.sys
12464 bytes
Created: 25/03/2002
Modified: 29/12/2007
Company: Macrovision Europe Ltd
----------
Key: SIS163u
ImagePath: System32\DRIVERS\sis163u.sys
C:\WINDOWS\System32\DRIVERS\sis163u.sys [file not found to scan]
----------
Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73600 bytes
Created: 22/03/2006
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{51E7EF02-4C7B-4914-8243-03E90A0AD280}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 28/08/2001
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: USBAAPL
ImagePath: System32\Drivers\usbaapl.sys
C:\WINDOWS\System32\Drivers\usbaapl.sys
32000 bytes
Created: 28/12/2007
Modified: 10/07/2008
Company: Apple, Inc.
----------
Key: WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
10144 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
21280 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
5600 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
44064 bytes
Created: 29/12/2007
Modified: 14/04/2004
Company: Logitech Inc.
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 11/10/2004
Modified: 18/10/2006
Company: Microsoft Corporation
----------
Key: xmasbus
ImagePath: System32\DRIVERS\xmasbus.sys
C:\WINDOWS\System32\DRIVERS\xmasbus.sys
140800 bytes
Created: 22/03/2006
Modified: 21/12/2003
Company:
----------
Key: xmasscsi
ImagePath: System32\Drivers\xmasscsi.sys
C:\WINDOWS\System32\Drivers\xmasscsi.sys
5504 bytes
Created: 22/03/2006
Modified: 20/12/2003
Company:
----------

************************************************************
19:39:37: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created: 22/03/2006
Modified: 28/02/2003
Company:
VxD Key = JAVASUP
----------
----------

************************************************************
19:39:37: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
19:39:37: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
75128 bytes
Created: 29/01/2007
Modified: 16/05/2008
Company: ALWIL Software
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
19:39:38: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
372736 bytes
Created: 10/05/2007
Modified: 10/05/2007
Company: Adobe Systems, Inc.
----------

************************************************************
19:39:38: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {02478D38-C3F9-4EFB-9B51-7695ECA05670}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
440384 bytes
Created: 6/03/2007
Modified: 26/10/2006
Company: Yahoo! Inc.
----------
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created: 22/10/2006
Modified: 22/10/2006
Company: Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
1562448 bytes
Created: 29/07/2008
Modified: 7/07/2008
Company: Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created: 19/08/2008
Modified: 10/06/2008
Company: Sun Microsystems, Inc.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2436160 bytes
Created: 20/03/2008
Modified: 20/03/2008
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
651248 bytes
Created: 2/09/2008
Modified: 2/09/2008
Company: Google Inc.
----------

************************************************************
19:39:38: Scanning ----- SHELLSERVICEOBJECTS -----
Key: WebCheck
CLSID: {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
Path: %SystemRoot%\System32\webcheck.dll
C:\WINDOWS\System32\webcheck.dll
281600 bytes
Created: 29/08/2002
Modified: 19/08/2004
Company: Microsoft Corporation
----------
Key: WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path: C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created: 18/10/2006
Modified: 18/10/2006
Company: Microsoft Corporation
----------

************************************************************
19:39:38: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
19:39:38: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
19:39:38: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank

************************************************************
19:39:38: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
19:39:38: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
113664 bytes
Created: 22/03/2006
Modified: 4/11/1999
Company: Adobe Systems, Inc.
Adobe Gamma Loader.lnk - links to C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 22/03/2006
Modified: 22/03/2006
Company:
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
155715 bytes
Created: 24/04/2006
Modified: 12/04/2002
Company:
NaturalColorLoad.lnk - links to C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
19:39:39: Scanning ----- SCHEDULED TASKS -----
Taskname: AppleSoftwareUpdate.job
File: C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created: 29/08/2007
Modified: 11/04/2008
Company: Apple Inc.
Parameters: -task
Next Run Time: 8/09/2008 9:36:00
Status: La tâche n'a pas encore été exécutée
Creator: SYSTEM
Comments: [blank]
----------

************************************************************
19:39:39: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
19:39:39: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Checking for specific malicious files:
C:\WINDOWS\system32\WS2Fix.exe - Trojan.FakeAlert
C:\WINDOWS\system32\WS2Fix.exe - process is either not running or could not be terminated
C:\WINDOWS\system32\WS2Fix.exe - file renamed to: C:\WINDOWS\system32\WS2Fix.exe.vir
----------
Desktop Wallpaper: C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2986038 bytes
Created: 22/03/2006
Modified: 30/08/2008
Company:
----------
Additional checks completed

************************************************************
19:40:08: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[13 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[69 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[56 loaded modules in total]
--------------------
C:\WINDOWS\System32\Ati2evxx.exe
[12 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[47 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[146 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[29 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[43 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
[52 loaded modules in total]
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
[17 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE
[100 loaded modules in total]
--------------------
C:\Program Files\D-Tools\daemon.exe
[30 loaded modules in total]
--------------------
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[33 loaded modules in total]
--------------------
C:\WINDOWS\SOUNDMAN.EXE
[21 loaded modules in total]
--------------------
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[47 loaded modules in total]
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[18 loaded modules in total]
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe
[22 loaded modules in total]
--------------------
C:\themeGold55\CursorXP\CursorXP.exe
[16 loaded modules in total]
--------------------
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
[72 loaded modules in total]
--------------------
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
[50 loaded modules in total]
--------------------
C:\Program Files\PowerArchiver\PASTARTER.EXE
[15 loaded modules in total]
--------------------
C:\Program Files\Messenger\msmsgs.exe
[38 loaded modules in total]
--------------------
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
[19 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[48 loaded modules in total]
--------------------
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
[25 loaded modules in total]
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
[26 loaded modules in total]
--------------------
C:\WINDOWS\System32\CTsvcCDA.exe
[9 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[37 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[14 loaded modules in total]
--------------------
C:\Program Files\iPod\bin\iPodService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[31 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
[41 loaded modules in total]
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
[28 loaded modules in total]
--------------------
C:\WINDOWS\System32\msiexec.exe
[54 loaded modules in total]
--------------------
C:\Documents and Settings\drikceline\Application Data\Simply Super Software\Trojan Remover\jky8B.exe
FileSize: 2548288
[This is a Trojan Remover component]
[22 loaded modules in total]
--------------------

************************************************************
19:40:34: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
19:40:34: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
19:40:34: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
19:40:34: Scanning ------ %TEMP% DIRECTORY ------
d:\temp\JET22D.tmp appears to be in-use/locked
************************************************************
19:40:34: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
19:40:34: Scanning ------ ROOT DIRECTORY ------

************************************************************
19:40:35: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://neufportail.fr/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 19:40:35 02 sept. 2008
************************************************************

puis malwarebit:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

14:38:27 3/09/2008
mbam-log-09-03-2008 (14-38-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 92692
Temps écoulé: 32 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

puis ccleaner:

NETTOYAGE COMPLET - (2,177 secs)
------------------------------------------------------------------------------------------
7,98MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 236) 3,30MB
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Documents and Settings\drikceline\Cookies\index.dat
Poubelle vidée (1 fichiers) 3,38MB
C:\WINDOWS\TEMP\{AC76BA86-7AD7-1036-7B44-A81200000003}.ini 678 bytes
d:\temp\jusched.log 173 bytes
d:\temp\wmplog00.sqm 1,45KB
d:\temp\wmplog01.sqm 1,49KB
d:\temp\wmplog02.sqm 1,75KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 1,61KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 327 bytes
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 49 bytes
C:\WINDOWS\WindowsUpdate.log 1,10MB
C:\WINDOWS\wmsetup.log 940 bytes
C:\WINDOWS\ntbtlog.txt 0,19MB
C:\WINDOWS\Debug\UserMode\userenv.log 1,63KB
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\soundData.sol 58 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\#SharedObjects\7FK8KSAV\s.ytimg.com\videostats.sol 199 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Documents and Settings\drikceline\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 377 bytes
------------------------------------------------------------------------------------------

les logs de kapersky:

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 3:43:34 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Zones critiques
C:\WINDOWS
d:\temp\

Statistiques de l'analyse
Total d'objets analysés 16848
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:13:06

Nom de l'objet infecté Nom du virus Dernière action
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

d:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, September 03, 2008 4:38:35 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 3/09/2008
Enregistrements dans la base antivirus Kaspersky : 1060098

Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\
G:\

Statistiques de l'analyse
Total d'objets analysés 58627
Nombre de virus trouvés 0
Nombre d'objets infectés 0 / 0
Nombre d'objets suspects 0
Durée de l'analyse 00:53:36

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.dpm L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Application Data\Creative\Media Database\PCML_1.ldb L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Historique\History.IE5\MSHist012008090320080904\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\FXZ0ANP1\Teasing_728x90_20080822[1].swf L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\k2kYxpr7kVMId2KDlr&related=1&related=1&autoplay=1[1] L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\drikceline\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\Temp\Perflib_Perfdata_4d8.dat L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

D:\temp\JETF6C3.tmp L'objet est verrouillé ignoré

Analyse terminée.

et enfin celui de bitdefender:

BitDefender Online Scanner

Rapport d'analyse généré à: Wed, Sep 03, 2008 - 16:56:51

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;

Statistiques

Temps
00:15:44

Fichiers
69276

Directoires
5441

Secteurs de boot
0

Archives
1020

Paquets programmes
6286

Résultats

Virus identifiés
0

Fichiers infectés
0

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
0

Info sur les moteurs

Définition virus
1710163

Version des moteurs
AVCORE v1.7 (build 8314.19) (i386) (Aug 11 2008 17:31:32)

Analyse des plugins
16

Archive des plugins
43

Unpack des plugins
7

E-mail plugins
6

Système plugins
4

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

Aucun virus trouvé.

voila j'espère avoir bien travaillé mais après avoir refait une verif avec spyware doctor il m'a
retrouvé le trojan zlob.gen et je sais pas si il l'a bien enlevé