Infecté par Win32

Justine -  
Bonjour,
Voila quelques jours qu'avast a repéré un cheval de troie du nom de Win32:Patched-ck [trj]. Il n'arrvie pas à le supprimer. J'ai donc essayé de changer d'antivirus, antivir le détecte également mais ne le supprime pas non plus (la quarantaine ne fonctionne pas non plus). J'ai essayé plusieurs anti spyware (superanti spyware, malwarebytes anti malware) qui ne servent à rien non plus. Par la suite j'ai essayé une restauration système, sauf que mon point de sauvegarde le plus anciens est éjà infecté.
Je ne sais plus trop quoi faire... J'ai envisagé la restauration usine ou le formatage mais je n'est pas les cd d'xp (mon pc est un portable windows été déjà installé)
J'ai vraiment besoin de votre aide, merci par avance
Configuration: Windows XP
Internet Explorer 7.0

23 réponses

  • Votes
  • Date
  • Date décroissante
  1. ep44 Contributeur
    Bonjour

    Ne t'inquiète pas je vais te guider et t'aider à désinfecter ton PC.

    Télécharge sur le Bureau HijackThis

    http://download.hijackthis.eu/HJTInstall.exe

    = Double-clique sur dessus pour l'installer
    = Clique sur Do a system scan and save the log
    = Colle le rapport
    si problème voir l'aide
    http://www.swl1f.net/viewtopic.php?f=14&t=153&p=1100#p1100
    http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    @+
    1. Justine
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 17:00:45, on 06/09/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Safe mode with network support

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Spyware Doctor\pctsAuxs.exe
      C:\Program Files\Spyware Doctor\pctsSvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Spyware Doctor\pctsTray.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
      O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - D:\Player\__CDS2.dll (file missing)
      O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
      O21 - SSODL: AHtwwebEK - {641D53F5-CEB7-F95F-6944-C8FA7BA4ACCC} - (no file)
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
      O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
      O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
      O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
      O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
      1. ep44 Contributeur
        Télécharge sur le Bureau http://siri.urz.free.fr/Fix/SmitfraudFix.exe
        => Double clic sur SmitfraudFix.zip
        => Extraire tout
        => Double clic sur SmitfraudFix
        => Double Clic sur SmitfraudFix.cmd
        => Choisir Option 1
        => poste le rapport
        @+
        1. Justine
          Désolé pour le retard, j'espère que quelqu'un est toujours la. Voici le rapport:

          SmitFraudFix v2.346

          Rapport fait à 21:23:52,20, 06/09/2008
          Executé à partir de C:\Documents and Settings\Justine\Bureau\SmitfraudFix
          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
          Le type du système de fichiers est NTFS
          Fix executé en mode sans echec

          »»»»»»»»»»»»»»»»»»»»»»»» Process

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Spyware Doctor\pctsAuxs.exe
          C:\Program Files\Spyware Doctor\pctsSvc.exe
          C:\Program Files\Spyware Doctor\pctsTray.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Documents and Settings\Justine\Bureau\SmitfraudFix\Policies.exe
          C:\WINDOWS\system32\cmd.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe

          »»»»»»»»»»»»»»»»»»»»»»»» hosts

          »»»»»»»»»»»»»»»»»»»»»»»» C:\

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

          »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Justine

          »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Justine\Application Data

          »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

          »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Justine\Favoris

          »»»»»»»»»»»»»»»»»»»»»»»» Bureau

          »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

          »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

          »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
          "Source"="About:Home"
          "SubscribedURL"="About:Home"
          "FriendlyName"="Ma page d'accueil"

          »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          IEDFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» VACFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          VACFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          404Fix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          AntiXPVSTFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
          "AppInit_DLLs"=""

          »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
          "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
          "System"=""

          »»»»»»»»»»»»»»»»»»»»»»»» RK

          »»»»»»»»»»»»»»»»»»»»»»»» DNS

          Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
          DNS Server Search Order: 89.2.0.1
          DNS Server Search Order: 89.2.0.2

          HKLM\SYSTEM\CCS\Services\Tcpip\..\{2EB11F6F-FCED-43A6-83C5-B9D3B3EA1DB7}: DhcpNameServer=89.2.0.1 89.2.0.2
          HKLM\SYSTEM\CCS\Services\Tcpip\..\{CD1BAA1C-7073-4E50-A6F2-5F0EB8102043}: DhcpNameServer=192.168.1.1
          HKLM\SYSTEM\CS1\Services\Tcpip\..\{2EB11F6F-FCED-43A6-83C5-B9D3B3EA1DB7}: DhcpNameServer=84.103.237.146 86.64.145.146
          HKLM\SYSTEM\CS1\Services\Tcpip\..\{CD1BAA1C-7073-4E50-A6F2-5F0EB8102043}: DhcpNameServer=192.168.1.1
          HKLM\SYSTEM\CS2\Services\Tcpip\..\{2EB11F6F-FCED-43A6-83C5-B9D3B3EA1DB7}: DhcpNameServer=89.2.0.1 89.2.0.2
          HKLM\SYSTEM\CS2\Services\Tcpip\..\{CD1BAA1C-7073-4E50-A6F2-5F0EB8102043}: DhcpNameServer=192.168.1.1
          HKLM\SYSTEM\CS3\Services\Tcpip\..\{2EB11F6F-FCED-43A6-83C5-B9D3B3EA1DB7}: DhcpNameServer=89.2.0.1 89.2.0.2
          HKLM\SYSTEM\CS3\Services\Tcpip\..\{CD1BAA1C-7073-4E50-A6F2-5F0EB8102043}: DhcpNameServer=192.168.1.1
          HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
          HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=84.103.237.146 86.64.145.146
          HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
          HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2

          »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

          »»»»»»»»»»»»»»»»»»»»»»»» Fin
          2. ep44 Contributeur
            ok pour la suite

            Télécharge malwarebytes
            http://www.malwarebytes.org/mbam/program/mbam-setup.exe
            Une aide pour l'installation
            http://www.swl1f.net/viewtopic.php?f=14&t=68

            => Installe le
            => Ensuite va en mode sans echec

            Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
            Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel

            => Lance malwarebytes
            => Coche "Executer un examen complet"
            => Si tu es en présence d'une infection à la fin de l'examen clique sur "ok"
            => Clique sur Supprimer la sélection
            => Pour poster le rapport Clique sur l'onglet Rapports/Logs, sélectionne celui t'intéresse et clique sur Ouvrir
            => Fait copier coller et poste le rapport

            --------------------------

            ensuite

            * Télécharge CCleaner
            https://filehippo.com/download_ccleaner/
            => Aide toi de ce tuto pour l'utiliser
            http://www.swl1f.net/viewtopic.php?f=14&t=69

            --------------------------

            Ensuite refais un nouveau HijackThis

            @+
            1. Justine
              le rapport malwarebytes
              Malwarebytes' Anti-Malware 1.25
              Version de la base de données: 1062
              Windows 5.1.2600 Service Pack 2

              22:46:07 06/09/2008
              mbam-log-09-06-2008 (22-46-07).txt

              Type de recherche: Examen complet (C:\|)
              Eléments examinés: 136750
              Temps écoulé: 33 minute(s), 35 second(s)

              Processus mémoire infecté(s): 0
              Module(s) mémoire infecté(s): 0
              Clé(s) du Registre infectée(s): 0
              Valeur(s) du Registre infectée(s): 0
              Elément(s) de données du Registre infecté(s): 0
              Dossier(s) infecté(s): 0
              Fichier(s) infecté(s): 0

              Processus mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Module(s) mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Clé(s) du Registre infectée(s):
              (Aucun élément nuisible détecté)

              Valeur(s) du Registre infectée(s):
              (Aucun élément nuisible détecté)

              Elément(s) de données du Registre infecté(s):
              (Aucun élément nuisible détecté)

              Dossier(s) infecté(s):
              (Aucun élément nuisible détecté)

              Fichier(s) infecté(s):
              (Aucun élément nuisible détecté)
              1. ep44 Contributeur
                ok au lieu de refaire un rapport HiajckThis fait ceci stp

                Télécharge DiagHelp.zip sur ton bureau http://www.malekal.com/download/DiagHelp.zip
                ==> Ne double-clic pas dessus !! Fais un clic droit sur le fichier et extraire tout
                ==> Un nouveau dossier chercher va être créé DiagHelp
                ==> Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
                ==> Une fenêtre va s'ouvrir, choisis l'option 1
                ==> L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande
                ==> Copie/colle le contenu du bloc-note qui s'ouvre, pour cela :
                ==> Dans le bloc-note, cliquez sur le menu Edition / Selectionner tout
                ==> A nouveau menu Edition / copier
                ==> Dans un nouveau message ici, faire un clic droit / coller
                @+
                1. Justine
                  et le rapport hijackthis

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 22:48:42, on 06/09/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                  Boot mode: Safe mode with network support

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\csrss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\Spyware Doctor\pctsAuxs.exe
                  C:\Program Files\Spyware Doctor\pctsSvc.exe
                  C:\Program Files\Spyware Doctor\pctsTray.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\WINDOWS\system32\NOTEPAD.EXE
                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                  C:\WINDOWS\system32\wbem\wmiprvse.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                  O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
                  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                  O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - D:\Player\__CDS2.dll (file missing)
                  O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                  O21 - SSODL: AHtwwebEK - {641D53F5-CEB7-F95F-6944-C8FA7BA4ACCC} - (no file)
                  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                  O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                  O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
                  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
                  2. Justine
                    DiagHelp version v1.4 - http://www.malekal.com
                    excute le 06/09/2008 à 22:53:07,40

                    Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
                    C:\WINDOWS\prefetch\GUARDGUI.EXE-2C20A958.pf -->06/09/2008 16:42:58
                    C:\WINDOWS\prefetch\PCTSGUI.EXE-281B8AB7.pf -->06/09/2008 16:42:10
                    C:\WINDOWS\prefetch\UPDATE.EXE-1A7E7F45.pf -->06/09/2008 16:42:01
                    C:\WINDOWS\prefetch\AVWSC.EXE-347FCF75.pf -->06/09/2008 16:41:52
                    C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->06/09/2008 16:33:28
                    C:\WINDOWS\prefetch\WMIADAP.EXE-2DF425B2.pf -->06/09/2008 16:33:27
                    C:\WINDOWS\prefetch\PCTSAUXS.EXE-1E8D77A6.pf -->06/09/2008 16:32:58
                    C:\WINDOWS\prefetch\PCTSTRAY.EXE-29391146.pf -->06/09/2008 16:32:53
                    C:\WINDOWS\prefetch\PCTSSVC.EXE-3A239962.pf -->06/09/2008 16:32:52
                    C:\WINDOWS\prefetch\UNZIP.EXE-08434430.pf -->06/09/2008 16:32:46

                    C:\WINDOWS\System32\drivers\556a2dc3.sys -->29/08/2008 11:22:04
                    C:\WINDOWS\System32\drivers\iksyssec.sys -->25/08/2008 11:36:30
                    C:\WINDOWS\System32\drivers\iksysflt.sys -->25/08/2008 11:36:28
                    C:\WINDOWS\System32\drivers\ikfilesec.sys -->25/08/2008 11:36:28
                    C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->17/08/2008 15:01:18
                    C:\WINDOWS\System32\drivers\mbam.sys -->17/08/2008 15:01:14
                    C:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42

                    C:\WINDOWS\System32\tmp.txt -->06/09/2008 21:23:54
                    C:\WINDOWS\System32\tmp.reg -->06/09/2008 21:23:54
                    C:\WINDOWS\System32\wpa.dbl -->06/09/2008 21:20:28
                    C:\WINDOWS\System32\PerfStringBackup.INI -->06/09/2008 16:33:35
                    C:\WINDOWS\System32\perfh00C.dat -->06/09/2008 16:33:35
                    C:\WINDOWS\System32\perfh009.dat -->06/09/2008 16:33:35
                    C:\WINDOWS\System32\perfc00C.dat -->06/09/2008 16:33:35
                    C:\WINDOWS\System32\perfc009.dat -->06/09/2008 16:33:35
                    C:\WINDOWS\System32\AntiXPVSTFix.exe -->02/09/2008 23:58:33
                    C:\WINDOWS\System32\VACFix.exe -->02/09/2008 16:51:48
                    C:\WINDOWS\System32\IEDFix.C.exe -->28/08/2008 22:36:57
                    C:\WINDOWS\System32\404Fix.exe -->18/08/2008 12:19:03
                    C:\WINDOWS\System32\TZLog.log -->16/08/2008 11:55:18
                    C:\WINDOWS\System32\FNTCACHE.DAT -->12/08/2008 13:09:31
                    C:\WINDOWS\System32\MRT.exe -->05/08/2008 20:11:01
                    C:\WINDOWS\System32\CONFIG.NT -->01/08/2008 19:55:36
                    C:\WINDOWS\System32\aswBoot.exe -->19/07/2008 16:43:08
                    C:\WINDOWS\System32\AvastSS.scr -->19/07/2008 16:30:53
                    C:\WINDOWS\System32\cdm.dll -->18/07/2008 22:10:48
                    C:\WINDOWS\System32\wuauclt.exe -->18/07/2008 22:10:42
                    C:\WINDOWS\System32\wups2.dll -->18/07/2008 22:10:40
                    C:\WINDOWS\System32\wucltui.dll.mui -->18/07/2008 22:10:36
                    C:\WINDOWS\System32\wups.dll -->18/07/2008 22:10:20
                    C:\WINDOWS\System32\wuaucpl.cpl.mui -->18/07/2008 22:09:56
                    C:\WINDOWS\System32\wucltui.dll -->18/07/2008 22:09:46

                    C:\WINDOWS\WindowsUpdate.log -->06/09/2008 22:52:07
                    C:\WINDOWS\bootstat.dat -->06/09/2008 21:18:52
                    C:\WINDOWS\win.ini -->28/08/2008 15:46:02
                    C:\WINDOWS\system.ini -->28/08/2008 15:46:02
                    C:\WINDOWS\QTFont.qfn -->20/08/2008 17:14:31
                    C:\WINDOWS\NeroDigital.ini -->16/08/2008 15:33:08
                    C:\WINDOWS\SIERRA.INI -->30/03/2008 16:53:27
                    C:\WINDOWS\ModemLog_Modem standard 33600 bps.txt -->30/11/2007 19:38:09
                    C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt -->30/11/2007 19:38:03
                    C:\WINDOWS\QTFont.for -->30/11/2007 15:58:53
                    C:\WINDOWS\aopr.ini -->23/06/2007 16:30:24
                    C:\WINDOWS\_MSRSTRT.EXE -->23/06/2007 14:06:07
                    C:\WINDOWS\aoxppr.ini -->23/06/2007 14:05:41
                    C:\WINDOWS\explorer.exe -->13/06/2007 15:22:28
                    C:\WINDOWS\tosOBEX.INI -->15/05/2007 16:43:08

                    winlogon.exe
                    svchost.exe
                    ws2_32.dll
                    user32.dll
                    Verified: Signed
                    tcpip.sys
                    Verified: Signed
                    ndis.sys
                    Verified: Signed
                    null.sys
                    Verified: Signed

                    ListDLLs v2.25 - DLL lister for Win9x/NT
                    Copyright (C) 1997-2004 Mark Russinovich
                    Sysinternals - www.sysinternals.com

                    ------------------------------------------------------------------------------
                    explorer.exe pid: 228
                    Command line: C:\WINDOWS\Explorer.EXE

                    Base Size Version Path
                    0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                    0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                    0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                    0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
                    0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                    0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                    0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                    0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat
                    0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
                    0x44360000 0x5cd000 7.00.6000.16705 C:\WINDOWS\system32\ieframe.dll
                    0x44160000 0x127000 7.00.6000.16705 C:\WINDOWS\system32\urlmon.dll
                    0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
                    0x10000000 0x14000 1.00.0000.1012 C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
                    0x00c10000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
                    0x016b0000 0x2c000 C:\Program Files\WinRAR\rarext.dll
                    0x00c00000 0xf000 1.00.0000.1004 C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL
                    0x016e0000 0x12000 7.00.0000.0015 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
                    0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL
                    0x02180000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll
                    0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL
                    0x02300000 0x37000 3.05.0000.0000 C:\Program Files\PowerISO\PWRISOSH.DLL
                    0x021e0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
                    0x64f00000 0x12000 4.08.1227.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll

                    ListDLLs v2.25 - DLL lister for Win9x/NT
                    Copyright (C) 1997-2004 Mark Russinovich
                    Sysinternals - www.sysinternals.com

                    ------------------------------------------------------------------------------
                    winlogon.exe pid: 808
                    Command line: winlogon.exe

                    Base Size Version Path
                    0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
                    0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
                    0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
                    0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
                    0x10000000 0x99000 1.00.0000.1048 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                    0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                    0x00de0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                    0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                    0x00f50000 0x11000 6.14.0010.4124 C:\WINDOWS\system32\Ati2evxx.dll
                    0x010e0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll
                    0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                    0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                    0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                    0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat

                    Le volume dans le lecteur C n'a pas de nom.
                    Le numéro de série du volume est 641D-53F4

                    Répertoire de C:\WINDOWS\system32

                    05/08/2004 13:00 6 144 csrss.exe
                    1 fichier(s) 6 144 octets
                    0 Rép(s) 40 314 417 152 octets libres

                    Contenu de Downloaded Program Files
                    Le volume dans le lecteur C n'a pas de nom.
                    Le numéro de série du volume est 641D-53F4

                    Répertoire de C:\WINDOWS\Downloaded Program Files

                    23/09/2006 10:49 <REP> .
                    23/09/2006 10:49 <REP> ..
                    16/01/2006 18:36 65 desktop.ini
                    26/05/2005 04:19 291 wuweb.inf
                    2 fichier(s) 356 octets

                    Total des fichiers listés :
                    2 fichier(s) 356 octets
                    2 Rép(s) 40 314 417 152 octets libres

                    Recherche de rootkit! (Merci S!Ri)

                    Recherche d'infections connues

                    Export des clefs sensibles..

                    Liste des fichiers en exception sur le pare-feu XP SP2

                    "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
                    "C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp"="C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp:*:Enabled:enable"
                    "C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system32\\sysrest32.exe:*:Enabled:enable"

                    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                    Export de la clef SharedTaskScheduler

                    [SharedTaskScheduler]
                    "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
                    "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

                    exports des policies
                    REGEDIT4

                    [system]
                    "dontdisplaylastusername"=dword:00000000
                    "legalnoticecaption"=""
                    "legalnoticetext"=""
                    "shutdownwithoutlogon"=dword:00000001
                    "undockwithoutlogon"=dword:00000001

                    Export des clefs sensibles..
                    Rechercher adresses sensibles dans le fichier HOSTS...
                    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2008-09-06 22:53:55
                    Windows 5.1.2600 Service Pack 2 NTFS

                    scanning hidden services & system hive ...

                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                    "h0"=dword:00000000
                    "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                    "p0"="C:\Program Files\DAEMON Tools\"
                    "h0"=dword:00000001
                    "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                    "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                    "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                    "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv]
                    "start"=dword:00000001
                    "type"=dword:00000001
                    "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                    "s1"=dword:2da7b4db
                    "s2"=dword:6e01368e
                    "h0"=dword:00000002

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                    "h0"=dword:00000000
                    "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                    "p0"="C:\Program Files\DAEMON Tools\"
                    "h0"=dword:00000001
                    "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                    "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                    "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                    "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv]
                    "start"=dword:00000001
                    "type"=dword:00000001
                    "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                    "h0"=dword:00000000
                    "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                    "p0"="C:\Program Files\DAEMON Tools\"
                    "h0"=dword:00000001
                    "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                    "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                    "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                    "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tdssserv]
                    "start"=dword:00000001
                    "type"=dword:00000001
                    "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

                    scanning hidden registry entries ...

                    scanning hidden files ...

                    scan completed successfully
                    hidden services: 0
                    hidden files: 0

                    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                    Error loading kernel support driver!
                    Make sure you are running this as Administrator.

                    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                    Error loading kernel support driver!
                    Make sure you are running this as Administrator.

                    Liste des programmes installes

                    802.11 USB Wireless LAN Adapter
                    Adobe Bridge 1.0
                    Adobe Common File Installer
                    Adobe Flash Player Plugin
                    Adobe Help Center 1.0
                    Adobe Photoshop CS2
                    Adobe Photoshop CS2
                    Adobe Reader 7.1.0 - Français
                    Adobe Shockwave Player
                    Adobe Stock Photos 1.0
                    AiO_Scan_CDA
                    AiOSoftwareNPI
                    Apple Software Update
                    Archiveur WinRAR
                    Assist TOSHIBA
                    Assistant de connexion Windows Live
                    ATI - Utilitaire de désinstallation du logiciel
                    ATI Catalyst Control Center
                    ATI Display Driver
                    avast! Antivirus
                    Avira AntiVir Personal - Free Antivirus
                    Azureus
                    Bluetooth Stack for Windows by Toshiba
                    BufferChm
                    C3100 c3100_Help
                    CCleaner (remove only)
                    CEP - Color Enable Package
                    Commandes TOSHIBA
                    Correctif pour Windows Internet Explorer 7 (KB947864)
                    Correctif Windows XP - KB884018
                    CustomerResearchQFolder
                    Destinations
                    DeviceManagementQFolder
                    DocProc
                    DocProcQFolder
                    eMule
                    eSupportQFolder
                    Fax_CDA
                    Formatage de carte mémoire SD TOSHIBA
                    Gestion d'énergie TOSHIBA
                    HijackThis 2.0.2
                    HP Customer Participation Program 7.0
                    HP Imaging Device Functions 7.0
                    HP Photosmart Essential
                    HP Photosmart, Officejet and Deskjet 7.0.A
                    HP Software Update
                    HP Solution Center 7.0
                    HPPhotoSmartExpress
                    HPProductAssistant
                    InstantShareDevicesMFC
                    Intel(R) PRO Network Connections Drivers
                    InterVideo WinDVD Creator 2
                    InterVideo WinDVD for TOSHIBA
                    J2SE Runtime Environment 5.0 Update 4
                    Le Petit MOURRE
                    Lecteur Windows Media 10
                    Les Indispensables Éducation pour Microsoft Office
                    Les Sims 2
                    Les Sims 2 : Nuits de Folie
                    Les Sims 2 Fun en Famille Kit
                    Les Sims 2 : La bonne affaire
                    Les Sims™ 2 Animaux & Cie
                    Les Sims™ 2 H&M® Fashion Kit
                    Les Sims™ 2 Jour de fête ! Kit 
                    Les Sims™ 2 Kit Glamour
                    Les Sims™ 2 Quartier Libre
                    Les Sims™ 2 Tout pour les ados Kit
                    Les Sims™ 2 Au fil des saisons
                    Les Sims™ 2 Bon Voyage
                    Lexibase Collins Français-Anglais
                    LG PC Suite
                    LG USB Modem driver [KU580]
                    livebox
                    Logiciel Intel(R) PROSet/Wireless
                    Macromedia Flash Player
                    Malwarebytes' Anti-Malware
                    Manuels TOSHIBA
                    MarketResearch
                    mCore
                    mDrWiFi
                    Messenger Plus! Live
                    mHelp
                    Microsoft .NET Framework 1.1
                    Microsoft .NET Framework 1.1
                    Microsoft .NET Framework 1.1 French Language Pack
                    Microsoft .NET Framework 1.1 Hotfix (KB928366)
                    Microsoft .NET Framework 2.0 Language Pack - FRA
                    Microsoft .NET Framework 2.0 Service Pack 1
                    Microsoft Encarta 2007 - Études
                    Microsoft Encarta Maths
                    Microsoft Internationalized Domain Names Mitigation APIs
                    Microsoft National Language Support Downlevel APIs
                    Microsoft Office OneNote 2003
                    Microsoft Office Professional Edition 2003
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
                    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)
                    Mise à jour Encarta_Les Indispensables Éducation
                    mIWA
                    mLogView
                    mMHouse
                    Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
                    Module sécurisé SD
                    mPfMgr
                    mPfWiz
                    mProSafe
                    MSXML 4.0 SP2 (KB927978)
                    MSXML 4.0 SP2 (KB936181)
                    MSXML 6.0 Parser (KB933579)
                    mWlsSafe
                    mXML
                    mZConfig
                    Nero 6 Ultra Edition
                    NewCopy_CDA
                    OCR Software by I.R.I.S 7.0
                    Outil de diagnostic PC TOSHIBA
                    PanoStandAlone
                    PowerISO
                    ProductContextNPI
                    QuickTime
                    Readme
                    Realtek High Definition Audio Driver
                    Réducteur de bruit lect. CD/DVD
                    SAGEM F@st 800-840
                    Satsuki Decoder Pack
                    Scan
                    ScannerCopy
                    Security Update for CAPICOM (KB931906)
                    Security Update for CAPICOM (KB931906)
                    SolutionCenter
                    Son virtuel TOSHIBA
                    Sonic DLA
                    Sony USB Driver
                    Spyware Doctor 6.0
                    Status
                    SUPERAntiSpyware Free Edition
                    Synaptics Pointing Device Driver
                    The Sims 2 University
                    Toolbox
                    TOSHIBA ConfigFree
                    TOSHIBA Hotkey Utility
                    TOSHIBA Software Modem
                    TOSHIBA TouchPad ON/Off Utility
                    TOSHIBA Utilities
                    TrayApp
                    Unload
                    Utilitaire de zoom TOSHIBA
                    VideoLAN VLC media player 0.8.6a
                    WebFldrs XP
                    WebReg
                    Winamp (remove only)
                    Windows Genuine Advantage Notifications (KB905474)
                    Windows Internet Explorer 7
                    Windows Live installer
                    Windows Live Messenger
                    Windows Live OneCare safety scanner
                    Windows Media Format Runtime

                    Le volume dans le lecteur C n'a pas de nom.
                    Le numéro de série du volume est 641D-53F4

                    Répertoire de C:\Program Files

                    06/09/2008 17:00 <REP> .
                    06/09/2008 17:00 <REP> ..
                    17/05/2007 16:35 <REP> 1964
                    09/12/2007 12:35 <REP> Adobe
                    22/04/2007 19:07 <REP> Ahead
                    22/09/2006 09:23 <REP> Alcohol Soft
                    10/04/2008 14:44 <REP> Alwil Software
                    13/05/2007 12:35 <REP> Apple Software Update
                    13/02/2006 13:12 <REP> ATI Technologies
                    06/09/2008 16:25 <REP> Avira
                    23/06/2008 14:45 <REP> Azureus
                    02/09/2007 21:56 <REP> CCleaner
                    16/01/2006 18:35 <REP> ComPlus Applications
                    01/06/2007 20:53 <REP> DAEMON Tools
                    01/03/2008 19:14 <REP> EA GAMES
                    23/06/2007 16:10 <REP> ElcomSoft
                    18/08/2008 15:00 <REP> eMule
                    28/08/2008 17:05 <REP> Enigma Software Group
                    01/03/2008 16:37 <REP> Fichiers communs
                    07/08/2007 14:55 <REP> Hewlett-Packard
                    25/12/2006 16:46 <REP> HP
                    29/08/2006 16:23 <REP> Intel
                    16/08/2008 11:54 <REP> Internet Explorer
                    29/08/2006 16:22 <REP> InterVideo
                    13/02/2006 13:14 <REP> Java
                    28/02/2007 20:17 <REP> Le Petit MOURRE
                    27/03/2008 09:10 <REP> Learning Essentials
                    18/05/2008 12:02 <REP> LG Electronics
                    18/05/2008 12:02 <REP> LG PC Suite 2
                    29/08/2008 11:40 <REP> Malwarebytes' Anti-Malware
                    16/08/2008 11:57 <REP> Messenger
                    06/09/2008 16:23 <REP> Messenger Plus! Live
                    26/03/2008 21:05 <REP> Microsoft CAPICOM 2.1.0.2
                    09/12/2007 14:57 <REP> Microsoft Etudes
                    13/02/2006 13:15 <REP> microsoft frontpage
                    02/02/2008 11:19 <REP> Microsoft Office
                    13/02/2006 13:16 <REP> Microsoft.NET
                    13/02/2006 13:16 <REP> Movie Maker
                    28/08/2008 19:24 <REP> Mozilla Firefox
                    13/02/2006 13:16 <REP> MSN
                    13/02/2006 13:16 <REP> MSN Gaming Zone
                    01/03/2008 16:38 <REP> MSN Messenger
                    03/02/2008 11:48 <REP> MSXML 6.0
                    13/02/2006 13:16 <REP> NetMeeting
                    13/02/2006 13:17 <REP> Online Services
                    06/07/2007 14:20 <REP> Outlook Express
                    08/12/2006 14:33 <REP> PowerISO
                    13/05/2007 12:36 <REP> QuickTime
                    12/03/2007 22:35 <REP> Real
                    13/02/2006 13:17 <REP> Realtek
                    25/04/2007 11:04 <REP> SAGEM
                    11/01/2007 21:28 <REP> SAGEM F@st 800-840
                    23/09/2006 19:13 <REP> Satsuki Decoder Pack
                    13/02/2006 13:17 <REP> Services en ligne
                    23/06/2007 13:37 <REP> Sims 2 Collection Maker
                    23/08/2007 10:41 <REP> Softissimo
                    06/09/2008 16:45 <REP> Spybot - Search & Destroy
                    06/09/2008 16:33 <REP> Spyware Doctor
                    24/06/2008 14:36 <REP> StepMania
                    06/09/2008 16:21 <REP> SUPERAntiSpyware
                    02/02/2008 11:39 <REP> Symantec
                    13/02/2006 13:18 <REP> Synaptics
                    12/05/2007 20:40 <REP> Timeline Interactive
                    23/06/2007 10:02 <REP> Toshiba
                    06/09/2008 17:00 <REP> Trend Micro
                    27/02/2007 19:55 <REP> VideoLAN
                    25/04/2007 11:34 <REP> Wanadoo
                    23/12/2007 20:27 <REP> Winamp
                    01/03/2008 16:38 <REP> Windows Live
                    26/03/2008 23:13 <REP> Windows Live Safety Center
                    24/09/2006 10:29 <REP> Windows Media Player
                    13/02/2006 13:19 <REP> Windows NT
                    01/03/2007 23:30 <REP> WinRAR
                    13/02/2006 13:19 <REP> xerox
                    0 fichier(s) 0 octets
                    74 Rép(s) 40 304 672 768 octets libres
                    Le volume dans le lecteur C n'a pas de nom.
                    Le numéro de série du volume est 641D-53F4

                    Répertoire de C:\Program Files\fichiers communs

                    01/03/2008 16:37 <REP> .
                    01/03/2008 16:37 <REP> ..
                    10/06/2008 14:51 <REP> Adobe
                    09/12/2007 12:26 <REP> Adobe Systems Shared
                    22/04/2007 19:07 <REP> Ahead
                    01/09/2006 21:53 <REP> DESIGNER
                    23/09/2006 09:59 278 528 FDEUnInstaller.exe
                    25/12/2006 16:42 <REP> Hewlett-Packard
                    25/12/2006 16:46 <REP> HP
                    13/02/2006 13:12 <REP> InstallShield
                    13/02/2006 13:12 <REP> Java
                    11/08/2008 21:34 <REP> Microsoft Shared
                    13/02/2006 13:13 <REP> MSSoap
                    13/02/2006 13:13 <REP> ODBC
                    13/03/2007 10:25 <REP> Real
                    13/02/2006 13:13 <REP> Services
                    13/02/2006 13:13 <REP> SpeechEngines
                    02/02/2008 11:41 <REP> Symantec Shared
                    06/07/2007 14:20 <REP> System
                    28/08/2008 18:34 <REP> Wise Installation Wizard
                    1 fichier(s) 278 528 octets
                    19 Rép(s) 40 304 672 768 octets libres
                    Le volume dans le lecteur C n'a pas de nom.
                    Le numéro de série du volume est 641D-53F4

                    Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

                    02/08/2008 10:14 <REP> .
                    02/08/2008 10:14 <REP> ..
                    13/02/2006 13:12 <REP> 1033
                    02/08/2008 10:14 <REP> 1036
                    20/09/2005 12:33 1 293 008 MSONSEXT.DLL
                    22/03/2007 19:29 39 256 MSOSV.DLL
                    03/06/1999 13:09 122 937 MSOWS409.DLL
                    07/03/2001 08:00 127 033 MSOWS40c.DLL
                    11/07/2003 03:25 80 448 PKMWS.DLL
                    5 fichier(s) 1 662 682 octets
                    4 Rép(s) 40 304 672 768 octets libres

                    c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe
                    c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
                    c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr710_fr_FR.exe
                    c:\Documents and Settings\Justine\Bureau\antivir_workstation_winu_en_h.exe
                    c:\Documents and Settings\Justine\Bureau\HJTInstall.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix.exe
                    c:\Documents and Settings\Justine\Bureau\zaSetup_fr.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\catchme.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\diff.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\dumphive.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\find2.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\Fport.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\grep.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\gzip.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LFiles.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\md5sums.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\pslist.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\sigcheck.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\streams.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\swreg.exe
                    c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\tar.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\404Fix.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\AntiXPVSTFix.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\dumphive.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\exit.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\GenericRenosFix.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\HostsChk.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.C.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Policies.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Process.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Reboot.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\restart.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SmiUpdate.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SrchSTS.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swreg.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swsc.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swxcacls.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\UIFix.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\unzip.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VACFix.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VCCLSID.exe
                    c:\Documents and Settings\Justine\Bureau\SmitfraudFix\WS2Fix.exe
                    c:\Documents and Settings\Justine\Local Settings\Temp\SSUPDATE.EXE
                    c:\Documents and Settings\Justine\Mes documents\Games\rom\PoKémon\Visual_Boy_Advance_V1.7.2_win_Fr\VisualBoyAdvance.exe
                    c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\GREASE.EXE
                    c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\VFW11E\SETUP.EXE
                    c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                    c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                    c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
                    c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
                    c:\Documents and Settings\Justine\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
                    c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
                    c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
                    c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                    c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                    c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

                    ****** Fin du rapport DiagHelp
                    Veuillez svp envoyer le fichier C:\upload_moi_JUSTINE.tar.gz a l'adresse http://upload.malekal.com
                    1. Justine
                      DiagHelp version v1.4 - http://www.malekal.com
                      excute le 06/09/2008 à 22:53:07,40

                      Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
                      C:\WINDOWS\prefetch\GUARDGUI.EXE-2C20A958.pf -->06/09/2008 16:42:58
                      C:\WINDOWS\prefetch\PCTSGUI.EXE-281B8AB7.pf -->06/09/2008 16:42:10
                      C:\WINDOWS\prefetch\UPDATE.EXE-1A7E7F45.pf -->06/09/2008 16:42:01
                      C:\WINDOWS\prefetch\AVWSC.EXE-347FCF75.pf -->06/09/2008 16:41:52
                      C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->06/09/2008 16:33:28
                      C:\WINDOWS\prefetch\WMIADAP.EXE-2DF425B2.pf -->06/09/2008 16:33:27
                      C:\WINDOWS\prefetch\PCTSAUXS.EXE-1E8D77A6.pf -->06/09/2008 16:32:58
                      C:\WINDOWS\prefetch\PCTSTRAY.EXE-29391146.pf -->06/09/2008 16:32:53
                      C:\WINDOWS\prefetch\PCTSSVC.EXE-3A239962.pf -->06/09/2008 16:32:52
                      C:\WINDOWS\prefetch\UNZIP.EXE-08434430.pf -->06/09/2008 16:32:46

                      C:\WINDOWS\System32\drivers\556a2dc3.sys -->29/08/2008 11:22:04
                      C:\WINDOWS\System32\drivers\iksyssec.sys -->25/08/2008 11:36:30
                      C:\WINDOWS\System32\drivers\iksysflt.sys -->25/08/2008 11:36:28
                      C:\WINDOWS\System32\drivers\ikfilesec.sys -->25/08/2008 11:36:28
                      C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->17/08/2008 15:01:18
                      C:\WINDOWS\System32\drivers\mbam.sys -->17/08/2008 15:01:14
                      C:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42

                      C:\WINDOWS\System32\tmp.txt -->06/09/2008 21:23:54
                      C:\WINDOWS\System32\tmp.reg -->06/09/2008 21:23:54
                      C:\WINDOWS\System32\wpa.dbl -->06/09/2008 21:20:28
                      C:\WINDOWS\System32\PerfStringBackup.INI -->06/09/2008 16:33:35
                      C:\WINDOWS\System32\perfh00C.dat -->06/09/2008 16:33:35
                      C:\WINDOWS\System32\perfh009.dat -->06/09/2008 16:33:35
                      C:\WINDOWS\System32\perfc00C.dat -->06/09/2008 16:33:35
                      C:\WINDOWS\System32\perfc009.dat -->06/09/2008 16:33:35
                      C:\WINDOWS\System32\AntiXPVSTFix.exe -->02/09/2008 23:58:33
                      C:\WINDOWS\System32\VACFix.exe -->02/09/2008 16:51:48
                      C:\WINDOWS\System32\IEDFix.C.exe -->28/08/2008 22:36:57
                      C:\WINDOWS\System32\404Fix.exe -->18/08/2008 12:19:03
                      C:\WINDOWS\System32\TZLog.log -->16/08/2008 11:55:18
                      C:\WINDOWS\System32\FNTCACHE.DAT -->12/08/2008 13:09:31
                      C:\WINDOWS\System32\MRT.exe -->05/08/2008 20:11:01
                      C:\WINDOWS\System32\CONFIG.NT -->01/08/2008 19:55:36
                      C:\WINDOWS\System32\aswBoot.exe -->19/07/2008 16:43:08
                      C:\WINDOWS\System32\AvastSS.scr -->19/07/2008 16:30:53
                      C:\WINDOWS\System32\cdm.dll -->18/07/2008 22:10:48
                      C:\WINDOWS\System32\wuauclt.exe -->18/07/2008 22:10:42
                      C:\WINDOWS\System32\wups2.dll -->18/07/2008 22:10:40
                      C:\WINDOWS\System32\wucltui.dll.mui -->18/07/2008 22:10:36
                      C:\WINDOWS\System32\wups.dll -->18/07/2008 22:10:20
                      C:\WINDOWS\System32\wuaucpl.cpl.mui -->18/07/2008 22:09:56
                      C:\WINDOWS\System32\wucltui.dll -->18/07/2008 22:09:46

                      C:\WINDOWS\WindowsUpdate.log -->06/09/2008 22:52:07
                      C:\WINDOWS\bootstat.dat -->06/09/2008 21:18:52
                      C:\WINDOWS\win.ini -->28/08/2008 15:46:02
                      C:\WINDOWS\system.ini -->28/08/2008 15:46:02
                      C:\WINDOWS\QTFont.qfn -->20/08/2008 17:14:31
                      C:\WINDOWS\NeroDigital.ini -->16/08/2008 15:33:08
                      C:\WINDOWS\SIERRA.INI -->30/03/2008 16:53:27
                      C:\WINDOWS\ModemLog_Modem standard 33600 bps.txt -->30/11/2007 19:38:09
                      C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt -->30/11/2007 19:38:03
                      C:\WINDOWS\QTFont.for -->30/11/2007 15:58:53
                      C:\WINDOWS\aopr.ini -->23/06/2007 16:30:24
                      C:\WINDOWS\_MSRSTRT.EXE -->23/06/2007 14:06:07
                      C:\WINDOWS\aoxppr.ini -->23/06/2007 14:05:41
                      C:\WINDOWS\explorer.exe -->13/06/2007 15:22:28
                      C:\WINDOWS\tosOBEX.INI -->15/05/2007 16:43:08

                      winlogon.exe
                      svchost.exe
                      ws2_32.dll
                      user32.dll
                      Verified: Signed
                      tcpip.sys
                      Verified: Signed
                      ndis.sys
                      Verified: Signed
                      null.sys
                      Verified: Signed

                      ListDLLs v2.25 - DLL lister for Win9x/NT
                      Copyright (C) 1997-2004 Mark Russinovich
                      Sysinternals - www.sysinternals.com

                      ------------------------------------------------------------------------------
                      explorer.exe pid: 228
                      Command line: C:\WINDOWS\Explorer.EXE

                      Base Size Version Path
                      0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                      0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                      0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                      0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
                      0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                      0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                      0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                      0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat
                      0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
                      0x44360000 0x5cd000 7.00.6000.16705 C:\WINDOWS\system32\ieframe.dll
                      0x44160000 0x127000 7.00.6000.16705 C:\WINDOWS\system32\urlmon.dll
                      0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
                      0x10000000 0x14000 1.00.0000.1012 C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
                      0x00c10000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
                      0x016b0000 0x2c000 C:\Program Files\WinRAR\rarext.dll
                      0x00c00000 0xf000 1.00.0000.1004 C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL
                      0x016e0000 0x12000 7.00.0000.0015 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
                      0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL
                      0x02180000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll
                      0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL
                      0x02300000 0x37000 3.05.0000.0000 C:\Program Files\PowerISO\PWRISOSH.DLL
                      0x021e0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
                      0x64f00000 0x12000 4.08.1227.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll

                      ListDLLs v2.25 - DLL lister for Win9x/NT
                      Copyright (C) 1997-2004 Mark Russinovich
                      Sysinternals - www.sysinternals.com

                      ------------------------------------------------------------------------------
                      winlogon.exe pid: 808
                      Command line: winlogon.exe

                      Base Size Version Path
                      0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
                      0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
                      0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
                      0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
                      0x10000000 0x99000 1.00.0000.1048 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                      0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                      0x00de0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                      0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                      0x00f50000 0x11000 6.14.0010.4124 C:\WINDOWS\system32\Ati2evxx.dll
                      0x010e0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll
                      0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                      0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                      0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                      0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat

                      Le volume dans le lecteur C n'a pas de nom.
                      Le numéro de série du volume est 641D-53F4

                      Répertoire de C:\WINDOWS\system32

                      05/08/2004 13:00 6 144 csrss.exe
                      1 fichier(s) 6 144 octets
                      0 Rép(s) 40 314 417 152 octets libres

                      Contenu de Downloaded Program Files
                      Le volume dans le lecteur C n'a pas de nom.
                      Le numéro de série du volume est 641D-53F4

                      Répertoire de C:\WINDOWS\Downloaded Program Files

                      23/09/2006 10:49 <REP> .
                      23/09/2006 10:49 <REP> ..
                      16/01/2006 18:36 65 desktop.ini
                      26/05/2005 04:19 291 wuweb.inf
                      2 fichier(s) 356 octets

                      Total des fichiers listés :
                      2 fichier(s) 356 octets
                      2 Rép(s) 40 314 417 152 octets libres

                      Recherche de rootkit! (Merci S!Ri)

                      Recherche d'infections connues

                      Export des clefs sensibles..

                      Liste des fichiers en exception sur le pare-feu XP SP2

                      "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
                      "C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp"="C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp:*:Enabled:enable"
                      "C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system32\\sysrest32.exe:*:Enabled:enable"

                      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                      Export de la clef SharedTaskScheduler

                      [SharedTaskScheduler]
                      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
                      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

                      exports des policies
                      REGEDIT4

                      [system]
                      "dontdisplaylastusername"=dword:00000000
                      "legalnoticecaption"=""
                      "legalnoticetext"=""
                      "shutdownwithoutlogon"=dword:00000001
                      "undockwithoutlogon"=dword:00000001

                      Export des clefs sensibles..
                      Rechercher adresses sensibles dans le fichier HOSTS...
                      catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-09-06 22:53:55
                      Windows 5.1.2600 Service Pack 2 NTFS

                      scanning hidden services & system hive ...

                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                      "h0"=dword:00000000
                      "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                      "p0"="C:\Program Files\DAEMON Tools\"
                      "h0"=dword:00000001
                      "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                      "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                      "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                      "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv]
                      "start"=dword:00000001
                      "type"=dword:00000001
                      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                      "s1"=dword:2da7b4db
                      "s2"=dword:6e01368e
                      "h0"=dword:00000002

                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                      "h0"=dword:00000000
                      "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                      "p0"="C:\Program Files\DAEMON Tools\"
                      "h0"=dword:00000001
                      "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                      "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                      "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                      "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv]
                      "start"=dword:00000001
                      "type"=dword:00000001
                      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                      "h0"=dword:00000000
                      "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                      "p0"="C:\Program Files\DAEMON Tools\"
                      "h0"=dword:00000001
                      "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                      "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                      "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                      "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tdssserv]
                      "start"=dword:00000001
                      "type"=dword:00000001
                      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

                      scanning hidden registry entries ...

                      scanning hidden files ...

                      scan completed successfully
                      hidden services: 0
                      hidden files: 0

                      KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                      Error loading kernel support driver!
                      Make sure you are running this as Administrator.

                      KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                      Error loading kernel support driver!
                      Make sure you are running this as Administrator.

                      Liste des programmes installes

                      802.11 USB Wireless LAN Adapter
                      Adobe Bridge 1.0
                      Adobe Common File Installer
                      Adobe Flash Player Plugin
                      Adobe Help Center 1.0
                      Adobe Photoshop CS2
                      Adobe Photoshop CS2
                      Adobe Reader 7.1.0 - Français
                      Adobe Shockwave Player
                      Adobe Stock Photos 1.0
                      AiO_Scan_CDA
                      AiOSoftwareNPI
                      Apple Software Update
                      Archiveur WinRAR
                      Assist TOSHIBA
                      Assistant de connexion Windows Live
                      ATI - Utilitaire de désinstallation du logiciel
                      ATI Catalyst Control Center
                      ATI Display Driver
                      avast! Antivirus
                      Avira AntiVir Personal - Free Antivirus
                      Azureus
                      Bluetooth Stack for Windows by Toshiba
                      BufferChm
                      C3100 c3100_Help
                      CCleaner (remove only)
                      CEP - Color Enable Package
                      Commandes TOSHIBA
                      Correctif pour Windows Internet Explorer 7 (KB947864)
                      Correctif Windows XP - KB884018
                      CustomerResearchQFolder
                      Destinations
                      DeviceManagementQFolder
                      DocProc
                      DocProcQFolder
                      eMule
                      eSupportQFolder
                      Fax_CDA
                      Formatage de carte mémoire SD TOSHIBA
                      Gestion d'énergie TOSHIBA
                      HijackThis 2.0.2
                      HP Customer Participation Program 7.0
                      HP Imaging Device Functions 7.0
                      HP Photosmart Essential
                      HP Photosmart, Officejet and Deskjet 7.0.A
                      HP Software Update
                      HP Solution Center 7.0
                      HPPhotoSmartExpress
                      HPProductAssistant
                      InstantShareDevicesMFC
                      Intel(R) PRO Network Connections Drivers
                      InterVideo WinDVD Creator 2
                      InterVideo WinDVD for TOSHIBA
                      J2SE Runtime Environment 5.0 Update 4
                      Le Petit MOURRE
                      Lecteur Windows Media 10
                      Les Indispensables Éducation pour Microsoft Office
                      Les Sims 2
                      Les Sims 2 : Nuits de Folie
                      Les Sims 2 Fun en Famille Kit
                      Les Sims 2 : La bonne affaire
                      Les Sims™ 2 Animaux & Cie
                      Les Sims™ 2 H&M® Fashion Kit
                      Les Sims™ 2 Jour de fête ! Kit 
                      Les Sims™ 2 Kit Glamour
                      Les Sims™ 2 Quartier Libre
                      Les Sims™ 2 Tout pour les ados Kit
                      Les Sims™ 2 Au fil des saisons
                      Les Sims™ 2 Bon Voyage
                      Lexibase Collins Français-Anglais
                      LG PC Suite
                      LG USB Modem driver [KU580]
                      livebox
                      Logiciel Intel(R) PROSet/Wireless
                      Macromedia Flash Player
                      Malwarebytes' Anti-Malware
                      Manuels TOSHIBA
                      MarketResearch
                      mCore
                      mDrWiFi
                      Messenger Plus! Live
                      mHelp
                      Microsoft .NET Framework 1.1
                      Microsoft .NET Framework 1.1
                      Microsoft .NET Framework 1.1 French Language Pack
                      Microsoft .NET Framework 1.1 Hotfix (KB928366)
                      Microsoft .NET Framework 2.0 Language Pack - FRA
                      Microsoft .NET Framework 2.0 Service Pack 1
                      Microsoft Encarta 2007 - Études
                      Microsoft Encarta Maths
                      Microsoft Internationalized Domain Names Mitigation APIs
                      Microsoft National Language Support Downlevel APIs
                      Microsoft Office OneNote 2003
                      Microsoft Office Professional Edition 2003
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
                      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)
                      Mise à jour Encarta_Les Indispensables Éducation
                      mIWA
                      mLogView
                      mMHouse
                      Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
                      Module sécurisé SD
                      mPfMgr
                      mPfWiz
                      mProSafe
                      MSXML 4.0 SP2 (KB927978)
                      MSXML 4.0 SP2 (KB936181)
                      MSXML 6.0 Parser (KB933579)
                      mWlsSafe
                      mXML
                      mZConfig
                      Nero 6 Ultra Edition
                      NewCopy_CDA
                      OCR Software by I.R.I.S 7.0
                      Outil de diagnostic PC TOSHIBA
                      PanoStandAlone
                      PowerISO
                      ProductContextNPI
                      QuickTime
                      Readme
                      Realtek High Definition Audio Driver
                      Réducteur de bruit lect. CD/DVD
                      SAGEM F@st 800-840
                      Satsuki Decoder Pack
                      Scan
                      ScannerCopy
                      Security Update for CAPICOM (KB931906)
                      Security Update for CAPICOM (KB931906)
                      SolutionCenter
                      Son virtuel TOSHIBA
                      Sonic DLA
                      Sony USB Driver
                      Spyware Doctor 6.0
                      Status
                      SUPERAntiSpyware Free Edition
                      Synaptics Pointing Device Driver
                      The Sims 2 University
                      Toolbox
                      TOSHIBA ConfigFree
                      TOSHIBA Hotkey Utility
                      TOSHIBA Software Modem
                      TOSHIBA TouchPad ON/Off Utility
                      TOSHIBA Utilities
                      TrayApp
                      Unload
                      Utilitaire de zoom TOSHIBA
                      VideoLAN VLC media player 0.8.6a
                      WebFldrs XP
                      WebReg
                      Winamp (remove only)
                      Windows Genuine Advantage Notifications (KB905474)
                      Windows Internet Explorer 7
                      Windows Live installer
                      Windows Live Messenger
                      Windows Live OneCare safety scanner
                      Windows Media Format Runtime

                      Le volume dans le lecteur C n'a pas de nom.
                      Le numéro de série du volume est 641D-53F4

                      Répertoire de C:\Program Files

                      06/09/2008 17:00 <REP> .
                      06/09/2008 17:00 <REP> ..
                      17/05/2007 16:35 <REP> 1964
                      09/12/2007 12:35 <REP> Adobe
                      22/04/2007 19:07 <REP> Ahead
                      22/09/2006 09:23 <REP> Alcohol Soft
                      10/04/2008 14:44 <REP> Alwil Software
                      13/05/2007 12:35 <REP> Apple Software Update
                      13/02/2006 13:12 <REP> ATI Technologies
                      06/09/2008 16:25 <REP> Avira
                      23/06/2008 14:45 <REP> Azureus
                      02/09/2007 21:56 <REP> CCleaner
                      16/01/2006 18:35 <REP> ComPlus Applications
                      01/06/2007 20:53 <REP> DAEMON Tools
                      01/03/2008 19:14 <REP> EA GAMES
                      23/06/2007 16:10 <REP> ElcomSoft
                      18/08/2008 15:00 <REP> eMule
                      28/08/2008 17:05 <REP> Enigma Software Group
                      01/03/2008 16:37 <REP> Fichiers communs
                      07/08/2007 14:55 <REP> Hewlett-Packard
                      25/12/2006 16:46 <REP> HP
                      29/08/2006 16:23 <REP> Intel
                      16/08/2008 11:54 <REP> Internet Explorer
                      29/08/2006 16:22 <REP> InterVideo
                      13/02/2006 13:14 <REP> Java
                      28/02/2007 20:17 <REP> Le Petit MOURRE
                      27/03/2008 09:10 <REP> Learning Essentials
                      18/05/2008 12:02 <REP> LG Electronics
                      18/05/2008 12:02 <REP> LG PC Suite 2
                      29/08/2008 11:40 <REP> Malwarebytes' Anti-Malware
                      16/08/2008 11:57 <REP> Messenger
                      06/09/2008 16:23 <REP> Messenger Plus! Live
                      26/03/2008 21:05 <REP> Microsoft CAPICOM 2.1.0.2
                      09/12/2007 14:57 <REP> Microsoft Etudes
                      13/02/2006 13:15 <REP> microsoft frontpage
                      02/02/2008 11:19 <REP> Microsoft Office
                      13/02/2006 13:16 <REP> Microsoft.NET
                      13/02/2006 13:16 <REP> Movie Maker
                      28/08/2008 19:24 <REP> Mozilla Firefox
                      13/02/2006 13:16 <REP> MSN
                      13/02/2006 13:16 <REP> MSN Gaming Zone
                      01/03/2008 16:38 <REP> MSN Messenger
                      03/02/2008 11:48 <REP> MSXML 6.0
                      13/02/2006 13:16 <REP> NetMeeting
                      13/02/2006 13:17 <REP> Online Services
                      06/07/2007 14:20 <REP> Outlook Express
                      08/12/2006 14:33 <REP> PowerISO
                      13/05/2007 12:36 <REP> QuickTime
                      12/03/2007 22:35 <REP> Real
                      13/02/2006 13:17 <REP> Realtek
                      25/04/2007 11:04 <REP> SAGEM
                      11/01/2007 21:28 <REP> SAGEM F@st 800-840
                      23/09/2006 19:13 <REP> Satsuki Decoder Pack
                      13/02/2006 13:17 <REP> Services en ligne
                      23/06/2007 13:37 <REP> Sims 2 Collection Maker
                      23/08/2007 10:41 <REP> Softissimo
                      06/09/2008 16:45 <REP> Spybot - Search & Destroy
                      06/09/2008 16:33 <REP> Spyware Doctor
                      24/06/2008 14:36 <REP> StepMania
                      06/09/2008 16:21 <REP> SUPERAntiSpyware
                      02/02/2008 11:39 <REP> Symantec
                      13/02/2006 13:18 <REP> Synaptics
                      12/05/2007 20:40 <REP> Timeline Interactive
                      23/06/2007 10:02 <REP> Toshiba
                      06/09/2008 17:00 <REP> Trend Micro
                      27/02/2007 19:55 <REP> VideoLAN
                      25/04/2007 11:34 <REP> Wanadoo
                      23/12/2007 20:27 <REP> Winamp
                      01/03/2008 16:38 <REP> Windows Live
                      26/03/2008 23:13 <REP> Windows Live Safety Center
                      24/09/2006 10:29 <REP> Windows Media Player
                      13/02/2006 13:19 <REP> Windows NT
                      01/03/2007 23:30 <REP> WinRAR
                      13/02/2006 13:19 <REP> xerox
                      0 fichier(s) 0 octets
                      74 Rép(s) 40 304 672 768 octets libres
                      Le volume dans le lecteur C n'a pas de nom.
                      Le numéro de série du volume est 641D-53F4

                      Répertoire de C:\Program Files\fichiers communs

                      01/03/2008 16:37 <REP> .
                      01/03/2008 16:37 <REP> ..
                      10/06/2008 14:51 <REP> Adobe
                      09/12/2007 12:26 <REP> Adobe Systems Shared
                      22/04/2007 19:07 <REP> Ahead
                      01/09/2006 21:53 <REP> DESIGNER
                      23/09/2006 09:59 278 528 FDEUnInstaller.exe
                      25/12/2006 16:42 <REP> Hewlett-Packard
                      25/12/2006 16:46 <REP> HP
                      13/02/2006 13:12 <REP> InstallShield
                      13/02/2006 13:12 <REP> Java
                      11/08/2008 21:34 <REP> Microsoft Shared
                      13/02/2006 13:13 <REP> MSSoap
                      13/02/2006 13:13 <REP> ODBC
                      13/03/2007 10:25 <REP> Real
                      13/02/2006 13:13 <REP> Services
                      13/02/2006 13:13 <REP> SpeechEngines
                      02/02/2008 11:41 <REP> Symantec Shared
                      06/07/2007 14:20 <REP> System
                      28/08/2008 18:34 <REP> Wise Installation Wizard
                      1 fichier(s) 278 528 octets
                      19 Rép(s) 40 304 672 768 octets libres
                      Le volume dans le lecteur C n'a pas de nom.
                      Le numéro de série du volume est 641D-53F4

                      Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

                      02/08/2008 10:14 <REP> .
                      02/08/2008 10:14 <REP> ..
                      13/02/2006 13:12 <REP> 1033
                      02/08/2008 10:14 <REP> 1036
                      20/09/2005 12:33 1 293 008 MSONSEXT.DLL
                      22/03/2007 19:29 39 256 MSOSV.DLL
                      03/06/1999 13:09 122 937 MSOWS409.DLL
                      07/03/2001 08:00 127 033 MSOWS40c.DLL
                      11/07/2003 03:25 80 448 PKMWS.DLL
                      5 fichier(s) 1 662 682 octets
                      4 Rép(s) 40 304 672 768 octets libres

                      c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe
                      c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
                      c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr710_fr_FR.exe
                      c:\Documents and Settings\Justine\Bureau\antivir_workstation_winu_en_h.exe
                      c:\Documents and Settings\Justine\Bureau\HJTInstall.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix.exe
                      c:\Documents and Settings\Justine\Bureau\zaSetup_fr.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\catchme.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\diff.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\dumphive.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\find2.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\Fport.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\grep.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\gzip.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LFiles.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\md5sums.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\pslist.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\sigcheck.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\streams.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\swreg.exe
                      c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\tar.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\404Fix.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\AntiXPVSTFix.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\dumphive.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\exit.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\GenericRenosFix.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\HostsChk.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.C.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Policies.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Process.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Reboot.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\restart.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SmiUpdate.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SrchSTS.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swreg.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swsc.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swxcacls.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\UIFix.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\unzip.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VACFix.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VCCLSID.exe
                      c:\Documents and Settings\Justine\Bureau\SmitfraudFix\WS2Fix.exe
                      c:\Documents and Settings\Justine\Local Settings\Temp\SSUPDATE.EXE
                      c:\Documents and Settings\Justine\Mes documents\Games\rom\PoKémon\Visual_Boy_Advance_V1.7.2_win_Fr\VisualBoyAdvance.exe
                      c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\GREASE.EXE
                      c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\VFW11E\SETUP.EXE
                      c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                      c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                      c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
                      c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
                      c:\Documents and Settings\Justine\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
                      c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
                      c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
                      c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                      c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                      c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

                      ****** Fin du rapport DiagHelp
                      Veuillez svp envoyer le fichier C:\upload_moi_JUSTINE.tar.gz a l'adresse http://upload.malekal.com
                      1. Justine
                        DiagHelp version v1.4 - http://www.malekal.com
                        excute le 06/09/2008 à 22:53:07,40

                        Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
                        C:\WINDOWS\prefetch\GUARDGUI.EXE-2C20A958.pf -->06/09/2008 16:42:58
                        C:\WINDOWS\prefetch\PCTSGUI.EXE-281B8AB7.pf -->06/09/2008 16:42:10
                        C:\WINDOWS\prefetch\UPDATE.EXE-1A7E7F45.pf -->06/09/2008 16:42:01
                        C:\WINDOWS\prefetch\AVWSC.EXE-347FCF75.pf -->06/09/2008 16:41:52
                        C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->06/09/2008 16:33:28
                        C:\WINDOWS\prefetch\WMIADAP.EXE-2DF425B2.pf -->06/09/2008 16:33:27
                        C:\WINDOWS\prefetch\PCTSAUXS.EXE-1E8D77A6.pf -->06/09/2008 16:32:58
                        C:\WINDOWS\prefetch\PCTSTRAY.EXE-29391146.pf -->06/09/2008 16:32:53
                        C:\WINDOWS\prefetch\PCTSSVC.EXE-3A239962.pf -->06/09/2008 16:32:52
                        C:\WINDOWS\prefetch\UNZIP.EXE-08434430.pf -->06/09/2008 16:32:46

                        C:\WINDOWS\System32\drivers\556a2dc3.sys -->29/08/2008 11:22:04
                        C:\WINDOWS\System32\drivers\iksyssec.sys -->25/08/2008 11:36:30
                        C:\WINDOWS\System32\drivers\iksysflt.sys -->25/08/2008 11:36:28
                        C:\WINDOWS\System32\drivers\ikfilesec.sys -->25/08/2008 11:36:28
                        C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->17/08/2008 15:01:18
                        C:\WINDOWS\System32\drivers\mbam.sys -->17/08/2008 15:01:14
                        C:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42

                        C:\WINDOWS\System32\tmp.txt -->06/09/2008 21:23:54
                        C:\WINDOWS\System32\tmp.reg -->06/09/2008 21:23:54
                        C:\WINDOWS\System32\wpa.dbl -->06/09/2008 21:20:28
                        C:\WINDOWS\System32\PerfStringBackup.INI -->06/09/2008 16:33:35
                        C:\WINDOWS\System32\perfh00C.dat -->06/09/2008 16:33:35
                        C:\WINDOWS\System32\perfh009.dat -->06/09/2008 16:33:35
                        C:\WINDOWS\System32\perfc00C.dat -->06/09/2008 16:33:35
                        C:\WINDOWS\System32\perfc009.dat -->06/09/2008 16:33:35
                        C:\WINDOWS\System32\AntiXPVSTFix.exe -->02/09/2008 23:58:33
                        C:\WINDOWS\System32\VACFix.exe -->02/09/2008 16:51:48
                        C:\WINDOWS\System32\IEDFix.C.exe -->28/08/2008 22:36:57
                        C:\WINDOWS\System32\404Fix.exe -->18/08/2008 12:19:03
                        C:\WINDOWS\System32\TZLog.log -->16/08/2008 11:55:18
                        C:\WINDOWS\System32\FNTCACHE.DAT -->12/08/2008 13:09:31
                        C:\WINDOWS\System32\MRT.exe -->05/08/2008 20:11:01
                        C:\WINDOWS\System32\CONFIG.NT -->01/08/2008 19:55:36
                        C:\WINDOWS\System32\aswBoot.exe -->19/07/2008 16:43:08
                        C:\WINDOWS\System32\AvastSS.scr -->19/07/2008 16:30:53
                        C:\WINDOWS\System32\cdm.dll -->18/07/2008 22:10:48
                        C:\WINDOWS\System32\wuauclt.exe -->18/07/2008 22:10:42
                        C:\WINDOWS\System32\wups2.dll -->18/07/2008 22:10:40
                        C:\WINDOWS\System32\wucltui.dll.mui -->18/07/2008 22:10:36
                        C:\WINDOWS\System32\wups.dll -->18/07/2008 22:10:20
                        C:\WINDOWS\System32\wuaucpl.cpl.mui -->18/07/2008 22:09:56
                        C:\WINDOWS\System32\wucltui.dll -->18/07/2008 22:09:46

                        C:\WINDOWS\WindowsUpdate.log -->06/09/2008 22:52:07
                        C:\WINDOWS\bootstat.dat -->06/09/2008 21:18:52
                        C:\WINDOWS\win.ini -->28/08/2008 15:46:02
                        C:\WINDOWS\system.ini -->28/08/2008 15:46:02
                        C:\WINDOWS\QTFont.qfn -->20/08/2008 17:14:31
                        C:\WINDOWS\NeroDigital.ini -->16/08/2008 15:33:08
                        C:\WINDOWS\SIERRA.INI -->30/03/2008 16:53:27
                        C:\WINDOWS\ModemLog_Modem standard 33600 bps.txt -->30/11/2007 19:38:09
                        C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt -->30/11/2007 19:38:03
                        C:\WINDOWS\QTFont.for -->30/11/2007 15:58:53
                        C:\WINDOWS\aopr.ini -->23/06/2007 16:30:24
                        C:\WINDOWS\_MSRSTRT.EXE -->23/06/2007 14:06:07
                        C:\WINDOWS\aoxppr.ini -->23/06/2007 14:05:41
                        C:\WINDOWS\explorer.exe -->13/06/2007 15:22:28
                        C:\WINDOWS\tosOBEX.INI -->15/05/2007 16:43:08

                        winlogon.exe
                        svchost.exe
                        ws2_32.dll
                        user32.dll
                        Verified: Signed
                        tcpip.sys
                        Verified: Signed
                        ndis.sys
                        Verified: Signed
                        null.sys
                        Verified: Signed

                        ListDLLs v2.25 - DLL lister for Win9x/NT
                        Copyright (C) 1997-2004 Mark Russinovich
                        Sysinternals - www.sysinternals.com

                        ------------------------------------------------------------------------------
                        explorer.exe pid: 228
                        Command line: C:\WINDOWS\Explorer.EXE

                        Base Size Version Path
                        0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                        0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                        0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                        0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
                        0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                        0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                        0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                        0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat
                        0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
                        0x44360000 0x5cd000 7.00.6000.16705 C:\WINDOWS\system32\ieframe.dll
                        0x44160000 0x127000 7.00.6000.16705 C:\WINDOWS\system32\urlmon.dll
                        0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
                        0x10000000 0x14000 1.00.0000.1012 C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
                        0x00c10000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
                        0x016b0000 0x2c000 C:\Program Files\WinRAR\rarext.dll
                        0x00c00000 0xf000 1.00.0000.1004 C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL
                        0x016e0000 0x12000 7.00.0000.0015 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
                        0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL
                        0x02180000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll
                        0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL
                        0x02300000 0x37000 3.05.0000.0000 C:\Program Files\PowerISO\PWRISOSH.DLL
                        0x021e0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
                        0x64f00000 0x12000 4.08.1227.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll

                        ListDLLs v2.25 - DLL lister for Win9x/NT
                        Copyright (C) 1997-2004 Mark Russinovich
                        Sysinternals - www.sysinternals.com

                        ------------------------------------------------------------------------------
                        winlogon.exe pid: 808
                        Command line: winlogon.exe

                        Base Size Version Path
                        0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
                        0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
                        0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
                        0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
                        0x10000000 0x99000 1.00.0000.1048 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                        0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                        0x00de0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                        0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                        0x00f50000 0x11000 6.14.0010.4124 C:\WINDOWS\system32\Ati2evxx.dll
                        0x010e0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll
                        0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                        0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                        0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                        0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat

                        Le volume dans le lecteur C n'a pas de nom.
                        Le numéro de série du volume est 641D-53F4

                        Répertoire de C:\WINDOWS\system32

                        05/08/2004 13:00 6 144 csrss.exe
                        1 fichier(s) 6 144 octets
                        0 Rép(s) 40 314 417 152 octets libres

                        Contenu de Downloaded Program Files
                        Le volume dans le lecteur C n'a pas de nom.
                        Le numéro de série du volume est 641D-53F4

                        Répertoire de C:\WINDOWS\Downloaded Program Files

                        23/09/2006 10:49 <REP> .
                        23/09/2006 10:49 <REP> ..
                        16/01/2006 18:36 65 desktop.ini
                        26/05/2005 04:19 291 wuweb.inf
                        2 fichier(s) 356 octets

                        Total des fichiers listés :
                        2 fichier(s) 356 octets
                        2 Rép(s) 40 314 417 152 octets libres

                        Recherche de rootkit! (Merci S!Ri)

                        Recherche d'infections connues

                        Export des clefs sensibles..

                        Liste des fichiers en exception sur le pare-feu XP SP2

                        "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
                        "C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp"="C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp:*:Enabled:enable"
                        "C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system32\\sysrest32.exe:*:Enabled:enable"

                        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                        Export de la clef SharedTaskScheduler

                        [SharedTaskScheduler]
                        "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
                        "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

                        exports des policies
                        REGEDIT4

                        [system]
                        "dontdisplaylastusername"=dword:00000000
                        "legalnoticecaption"=""
                        "legalnoticetext"=""
                        "shutdownwithoutlogon"=dword:00000001
                        "undockwithoutlogon"=dword:00000001

                        Export des clefs sensibles..
                        Rechercher adresses sensibles dans le fichier HOSTS...
                        catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-09-06 22:53:55
                        Windows 5.1.2600 Service Pack 2 NTFS

                        scanning hidden services & system hive ...

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                        "h0"=dword:00000000
                        "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                        "p0"="C:\Program Files\DAEMON Tools\"
                        "h0"=dword:00000001
                        "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                        "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                        "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                        "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv]
                        "start"=dword:00000001
                        "type"=dword:00000001
                        "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                        "s1"=dword:2da7b4db
                        "s2"=dword:6e01368e
                        "h0"=dword:00000002

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                        "h0"=dword:00000000
                        "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                        "p0"="C:\Program Files\DAEMON Tools\"
                        "h0"=dword:00000001
                        "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                        "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                        "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                        "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv]
                        "start"=dword:00000001
                        "type"=dword:00000001
                        "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                        "h0"=dword:00000000
                        "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                        "p0"="C:\Program Files\DAEMON Tools\"
                        "h0"=dword:00000001
                        "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                        "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                        "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                        "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tdssserv]
                        "start"=dword:00000001
                        "type"=dword:00000001
                        "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

                        scanning hidden registry entries ...

                        scanning hidden files ...

                        scan completed successfully
                        hidden services: 0
                        hidden files: 0

                        KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                        Error loading kernel support driver!
                        Make sure you are running this as Administrator.

                        KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                        Error loading kernel support driver!
                        Make sure you are running this as Administrator.

                        Liste des programmes installes

                        802.11 USB Wireless LAN Adapter
                        Adobe Bridge 1.0
                        Adobe Common File Installer
                        Adobe Flash Player Plugin
                        Adobe Help Center 1.0
                        Adobe Photoshop CS2
                        Adobe Photoshop CS2
                        Adobe Reader 7.1.0 - Français
                        Adobe Shockwave Player
                        Adobe Stock Photos 1.0
                        AiO_Scan_CDA
                        AiOSoftwareNPI
                        Apple Software Update
                        Archiveur WinRAR
                        Assist TOSHIBA
                        Assistant de connexion Windows Live
                        ATI - Utilitaire de désinstallation du logiciel
                        ATI Catalyst Control Center
                        ATI Display Driver
                        avast! Antivirus
                        Avira AntiVir Personal - Free Antivirus
                        Azureus
                        Bluetooth Stack for Windows by Toshiba
                        BufferChm
                        C3100 c3100_Help
                        CCleaner (remove only)
                        CEP - Color Enable Package
                        Commandes TOSHIBA
                        Correctif pour Windows Internet Explorer 7 (KB947864)
                        Correctif Windows XP - KB884018
                        CustomerResearchQFolder
                        Destinations
                        DeviceManagementQFolder
                        DocProc
                        DocProcQFolder
                        eMule
                        eSupportQFolder
                        Fax_CDA
                        Formatage de carte mémoire SD TOSHIBA
                        Gestion d'énergie TOSHIBA
                        HijackThis 2.0.2
                        HP Customer Participation Program 7.0
                        HP Imaging Device Functions 7.0
                        HP Photosmart Essential
                        HP Photosmart, Officejet and Deskjet 7.0.A
                        HP Software Update
                        HP Solution Center 7.0
                        HPPhotoSmartExpress
                        HPProductAssistant
                        InstantShareDevicesMFC
                        Intel(R) PRO Network Connections Drivers
                        InterVideo WinDVD Creator 2
                        InterVideo WinDVD for TOSHIBA
                        J2SE Runtime Environment 5.0 Update 4
                        Le Petit MOURRE
                        Lecteur Windows Media 10
                        Les Indispensables Éducation pour Microsoft Office
                        Les Sims 2
                        Les Sims 2 : Nuits de Folie
                        Les Sims 2 Fun en Famille Kit
                        Les Sims 2 : La bonne affaire
                        Les Sims™ 2 Animaux & Cie
                        Les Sims™ 2 H&M® Fashion Kit
                        Les Sims™ 2 Jour de fête ! Kit 
                        Les Sims™ 2 Kit Glamour
                        Les Sims™ 2 Quartier Libre
                        Les Sims™ 2 Tout pour les ados Kit
                        Les Sims™ 2 Au fil des saisons
                        Les Sims™ 2 Bon Voyage
                        Lexibase Collins Français-Anglais
                        LG PC Suite
                        LG USB Modem driver [KU580]
                        livebox
                        Logiciel Intel(R) PROSet/Wireless
                        Macromedia Flash Player
                        Malwarebytes' Anti-Malware
                        Manuels TOSHIBA
                        MarketResearch
                        mCore
                        mDrWiFi
                        Messenger Plus! Live
                        mHelp
                        Microsoft .NET Framework 1.1
                        Microsoft .NET Framework 1.1
                        Microsoft .NET Framework 1.1 French Language Pack
                        Microsoft .NET Framework 1.1 Hotfix (KB928366)
                        Microsoft .NET Framework 2.0 Language Pack - FRA
                        Microsoft .NET Framework 2.0 Service Pack 1
                        Microsoft Encarta 2007 - Études
                        Microsoft Encarta Maths
                        Microsoft Internationalized Domain Names Mitigation APIs
                        Microsoft National Language Support Downlevel APIs
                        Microsoft Office OneNote 2003
                        Microsoft Office Professional Edition 2003
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
                        Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)
                        Mise à jour Encarta_Les Indispensables Éducation
                        mIWA
                        mLogView
                        mMHouse
                        Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
                        Module sécurisé SD
                        mPfMgr
                        mPfWiz
                        mProSafe
                        MSXML 4.0 SP2 (KB927978)
                        MSXML 4.0 SP2 (KB936181)
                        MSXML 6.0 Parser (KB933579)
                        mWlsSafe
                        mXML
                        mZConfig
                        Nero 6 Ultra Edition
                        NewCopy_CDA
                        OCR Software by I.R.I.S 7.0
                        Outil de diagnostic PC TOSHIBA
                        PanoStandAlone
                        PowerISO
                        ProductContextNPI
                        QuickTime
                        Readme
                        Realtek High Definition Audio Driver
                        Réducteur de bruit lect. CD/DVD
                        SAGEM F@st 800-840
                        Satsuki Decoder Pack
                        Scan
                        ScannerCopy
                        Security Update for CAPICOM (KB931906)
                        Security Update for CAPICOM (KB931906)
                        SolutionCenter
                        Son virtuel TOSHIBA
                        Sonic DLA
                        Sony USB Driver
                        Spyware Doctor 6.0
                        Status
                        SUPERAntiSpyware Free Edition
                        Synaptics Pointing Device Driver
                        The Sims 2 University
                        Toolbox
                        TOSHIBA ConfigFree
                        TOSHIBA Hotkey Utility
                        TOSHIBA Software Modem
                        TOSHIBA TouchPad ON/Off Utility
                        TOSHIBA Utilities
                        TrayApp
                        Unload
                        Utilitaire de zoom TOSHIBA
                        VideoLAN VLC media player 0.8.6a
                        WebFldrs XP
                        WebReg
                        Winamp (remove only)
                        Windows Genuine Advantage Notifications (KB905474)
                        Windows Internet Explorer 7
                        Windows Live installer
                        Windows Live Messenger
                        Windows Live OneCare safety scanner
                        Windows Media Format Runtime

                        Le volume dans le lecteur C n'a pas de nom.
                        Le numéro de série du volume est 641D-53F4

                        Répertoire de C:\Program Files

                        06/09/2008 17:00 <REP> .
                        06/09/2008 17:00 <REP> ..
                        17/05/2007 16:35 <REP> 1964
                        09/12/2007 12:35 <REP> Adobe
                        22/04/2007 19:07 <REP> Ahead
                        22/09/2006 09:23 <REP> Alcohol Soft
                        10/04/2008 14:44 <REP> Alwil Software
                        13/05/2007 12:35 <REP> Apple Software Update
                        13/02/2006 13:12 <REP> ATI Technologies
                        06/09/2008 16:25 <REP> Avira
                        23/06/2008 14:45 <REP> Azureus
                        02/09/2007 21:56 <REP> CCleaner
                        16/01/2006 18:35 <REP> ComPlus Applications
                        01/06/2007 20:53 <REP> DAEMON Tools
                        01/03/2008 19:14 <REP> EA GAMES
                        23/06/2007 16:10 <REP> ElcomSoft
                        18/08/2008 15:00 <REP> eMule
                        28/08/2008 17:05 <REP> Enigma Software Group
                        01/03/2008 16:37 <REP> Fichiers communs
                        07/08/2007 14:55 <REP> Hewlett-Packard
                        25/12/2006 16:46 <REP> HP
                        29/08/2006 16:23 <REP> Intel
                        16/08/2008 11:54 <REP> Internet Explorer
                        29/08/2006 16:22 <REP> InterVideo
                        13/02/2006 13:14 <REP> Java
                        28/02/2007 20:17 <REP> Le Petit MOURRE
                        27/03/2008 09:10 <REP> Learning Essentials
                        18/05/2008 12:02 <REP> LG Electronics
                        18/05/2008 12:02 <REP> LG PC Suite 2
                        29/08/2008 11:40 <REP> Malwarebytes' Anti-Malware
                        16/08/2008 11:57 <REP> Messenger
                        06/09/2008 16:23 <REP> Messenger Plus! Live
                        26/03/2008 21:05 <REP> Microsoft CAPICOM 2.1.0.2
                        09/12/2007 14:57 <REP> Microsoft Etudes
                        13/02/2006 13:15 <REP> microsoft frontpage
                        02/02/2008 11:19 <REP> Microsoft Office
                        13/02/2006 13:16 <REP> Microsoft.NET
                        13/02/2006 13:16 <REP> Movie Maker
                        28/08/2008 19:24 <REP> Mozilla Firefox
                        13/02/2006 13:16 <REP> MSN
                        13/02/2006 13:16 <REP> MSN Gaming Zone
                        01/03/2008 16:38 <REP> MSN Messenger
                        03/02/2008 11:48 <REP> MSXML 6.0
                        13/02/2006 13:16 <REP> NetMeeting
                        13/02/2006 13:17 <REP> Online Services
                        06/07/2007 14:20 <REP> Outlook Express
                        08/12/2006 14:33 <REP> PowerISO
                        13/05/2007 12:36 <REP> QuickTime
                        12/03/2007 22:35 <REP> Real
                        13/02/2006 13:17 <REP> Realtek
                        25/04/2007 11:04 <REP> SAGEM
                        11/01/2007 21:28 <REP> SAGEM F@st 800-840
                        23/09/2006 19:13 <REP> Satsuki Decoder Pack
                        13/02/2006 13:17 <REP> Services en ligne
                        23/06/2007 13:37 <REP> Sims 2 Collection Maker
                        23/08/2007 10:41 <REP> Softissimo
                        06/09/2008 16:45 <REP> Spybot - Search & Destroy
                        06/09/2008 16:33 <REP> Spyware Doctor
                        24/06/2008 14:36 <REP> StepMania
                        06/09/2008 16:21 <REP> SUPERAntiSpyware
                        02/02/2008 11:39 <REP> Symantec
                        13/02/2006 13:18 <REP> Synaptics
                        12/05/2007 20:40 <REP> Timeline Interactive
                        23/06/2007 10:02 <REP> Toshiba
                        06/09/2008 17:00 <REP> Trend Micro
                        27/02/2007 19:55 <REP> VideoLAN
                        25/04/2007 11:34 <REP> Wanadoo
                        23/12/2007 20:27 <REP> Winamp
                        01/03/2008 16:38 <REP> Windows Live
                        26/03/2008 23:13 <REP> Windows Live Safety Center
                        24/09/2006 10:29 <REP> Windows Media Player
                        13/02/2006 13:19 <REP> Windows NT
                        01/03/2007 23:30 <REP> WinRAR
                        13/02/2006 13:19 <REP> xerox
                        0 fichier(s) 0 octets
                        74 Rép(s) 40 304 672 768 octets libres
                        Le volume dans le lecteur C n'a pas de nom.
                        Le numéro de série du volume est 641D-53F4

                        Répertoire de C:\Program Files\fichiers communs

                        01/03/2008 16:37 <REP> .
                        01/03/2008 16:37 <REP> ..
                        10/06/2008 14:51 <REP> Adobe
                        09/12/2007 12:26 <REP> Adobe Systems Shared
                        22/04/2007 19:07 <REP> Ahead
                        01/09/2006 21:53 <REP> DESIGNER
                        23/09/2006 09:59 278 528 FDEUnInstaller.exe
                        25/12/2006 16:42 <REP> Hewlett-Packard
                        25/12/2006 16:46 <REP> HP
                        13/02/2006 13:12 <REP> InstallShield
                        13/02/2006 13:12 <REP> Java
                        11/08/2008 21:34 <REP> Microsoft Shared
                        13/02/2006 13:13 <REP> MSSoap
                        13/02/2006 13:13 <REP> ODBC
                        13/03/2007 10:25 <REP> Real
                        13/02/2006 13:13 <REP> Services
                        13/02/2006 13:13 <REP> SpeechEngines
                        02/02/2008 11:41 <REP> Symantec Shared
                        06/07/2007 14:20 <REP> System
                        28/08/2008 18:34 <REP> Wise Installation Wizard
                        1 fichier(s) 278 528 octets
                        19 Rép(s) 40 304 672 768 octets libres
                        Le volume dans le lecteur C n'a pas de nom.
                        Le numéro de série du volume est 641D-53F4

                        Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

                        02/08/2008 10:14 <REP> .
                        02/08/2008 10:14 <REP> ..
                        13/02/2006 13:12 <REP> 1033
                        02/08/2008 10:14 <REP> 1036
                        20/09/2005 12:33 1 293 008 MSONSEXT.DLL
                        22/03/2007 19:29 39 256 MSOSV.DLL
                        03/06/1999 13:09 122 937 MSOWS409.DLL
                        07/03/2001 08:00 127 033 MSOWS40c.DLL
                        11/07/2003 03:25 80 448 PKMWS.DLL
                        5 fichier(s) 1 662 682 octets
                        4 Rép(s) 40 304 672 768 octets libres

                        c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe
                        c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
                        c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr710_fr_FR.exe
                        c:\Documents and Settings\Justine\Bureau\antivir_workstation_winu_en_h.exe
                        c:\Documents and Settings\Justine\Bureau\HJTInstall.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix.exe
                        c:\Documents and Settings\Justine\Bureau\zaSetup_fr.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\catchme.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\diff.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\dumphive.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\find2.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\Fport.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\grep.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\gzip.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LFiles.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\md5sums.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\pslist.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\sigcheck.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\streams.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\swreg.exe
                        c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\tar.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\404Fix.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\AntiXPVSTFix.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\dumphive.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\exit.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\GenericRenosFix.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\HostsChk.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.C.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Policies.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Process.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Reboot.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\restart.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SmiUpdate.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SrchSTS.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swreg.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swsc.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swxcacls.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\UIFix.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\unzip.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VACFix.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VCCLSID.exe
                        c:\Documents and Settings\Justine\Bureau\SmitfraudFix\WS2Fix.exe
                        c:\Documents and Settings\Justine\Local Settings\Temp\SSUPDATE.EXE
                        c:\Documents and Settings\Justine\Mes documents\Games\rom\PoKémon\Visual_Boy_Advance_V1.7.2_win_Fr\VisualBoyAdvance.exe
                        c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\GREASE.EXE
                        c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\VFW11E\SETUP.EXE
                        c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                        c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                        c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
                        c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
                        c:\Documents and Settings\Justine\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
                        c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
                        c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
                        c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                        c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                        c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

                        ****** Fin du rapport DiagHelp
                        Veuillez svp envoyer le fichier C:\upload_moi_JUSTINE.tar.gz a l'adresse http://upload.malekal.com
                        1. Justine
                          j'ai vu, voici le rapport de diaghelp

                          DiagHelp version v1.4 - http://www.malekal.com
                          excute le 06/09/2008 à 22:53:07,40

                          Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
                          C:\WINDOWS\prefetch\GUARDGUI.EXE-2C20A958.pf -->06/09/2008 16:42:58
                          C:\WINDOWS\prefetch\PCTSGUI.EXE-281B8AB7.pf -->06/09/2008 16:42:10
                          C:\WINDOWS\prefetch\UPDATE.EXE-1A7E7F45.pf -->06/09/2008 16:42:01
                          C:\WINDOWS\prefetch\AVWSC.EXE-347FCF75.pf -->06/09/2008 16:41:52
                          C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->06/09/2008 16:33:28
                          C:\WINDOWS\prefetch\WMIADAP.EXE-2DF425B2.pf -->06/09/2008 16:33:27
                          C:\WINDOWS\prefetch\PCTSAUXS.EXE-1E8D77A6.pf -->06/09/2008 16:32:58
                          C:\WINDOWS\prefetch\PCTSTRAY.EXE-29391146.pf -->06/09/2008 16:32:53
                          C:\WINDOWS\prefetch\PCTSSVC.EXE-3A239962.pf -->06/09/2008 16:32:52
                          C:\WINDOWS\prefetch\UNZIP.EXE-08434430.pf -->06/09/2008 16:32:46

                          C:\WINDOWS\System32\drivers\556a2dc3.sys -->29/08/2008 11:22:04
                          C:\WINDOWS\System32\drivers\iksyssec.sys -->25/08/2008 11:36:30
                          C:\WINDOWS\System32\drivers\iksysflt.sys -->25/08/2008 11:36:28
                          C:\WINDOWS\System32\drivers\ikfilesec.sys -->25/08/2008 11:36:28
                          C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->17/08/2008 15:01:18
                          C:\WINDOWS\System32\drivers\mbam.sys -->17/08/2008 15:01:14
                          C:\WINDOWS\System32\drivers\aswFsBlk.sys -->19/07/2008 16:37:42

                          C:\WINDOWS\System32\tmp.txt -->06/09/2008 21:23:54
                          C:\WINDOWS\System32\tmp.reg -->06/09/2008 21:23:54
                          C:\WINDOWS\System32\wpa.dbl -->06/09/2008 21:20:28
                          C:\WINDOWS\System32\PerfStringBackup.INI -->06/09/2008 16:33:35
                          C:\WINDOWS\System32\perfh00C.dat -->06/09/2008 16:33:35
                          C:\WINDOWS\System32\perfh009.dat -->06/09/2008 16:33:35
                          C:\WINDOWS\System32\perfc00C.dat -->06/09/2008 16:33:35
                          C:\WINDOWS\System32\perfc009.dat -->06/09/2008 16:33:35
                          C:\WINDOWS\System32\AntiXPVSTFix.exe -->02/09/2008 23:58:33
                          C:\WINDOWS\System32\VACFix.exe -->02/09/2008 16:51:48
                          C:\WINDOWS\System32\IEDFix.C.exe -->28/08/2008 22:36:57
                          C:\WINDOWS\System32\404Fix.exe -->18/08/2008 12:19:03
                          C:\WINDOWS\System32\TZLog.log -->16/08/2008 11:55:18
                          C:\WINDOWS\System32\FNTCACHE.DAT -->12/08/2008 13:09:31
                          C:\WINDOWS\System32\MRT.exe -->05/08/2008 20:11:01
                          C:\WINDOWS\System32\CONFIG.NT -->01/08/2008 19:55:36
                          C:\WINDOWS\System32\aswBoot.exe -->19/07/2008 16:43:08
                          C:\WINDOWS\System32\AvastSS.scr -->19/07/2008 16:30:53
                          C:\WINDOWS\System32\cdm.dll -->18/07/2008 22:10:48
                          C:\WINDOWS\System32\wuauclt.exe -->18/07/2008 22:10:42
                          C:\WINDOWS\System32\wups2.dll -->18/07/2008 22:10:40
                          C:\WINDOWS\System32\wucltui.dll.mui -->18/07/2008 22:10:36
                          C:\WINDOWS\System32\wups.dll -->18/07/2008 22:10:20
                          C:\WINDOWS\System32\wuaucpl.cpl.mui -->18/07/2008 22:09:56
                          C:\WINDOWS\System32\wucltui.dll -->18/07/2008 22:09:46

                          C:\WINDOWS\WindowsUpdate.log -->06/09/2008 22:52:07
                          C:\WINDOWS\bootstat.dat -->06/09/2008 21:18:52
                          C:\WINDOWS\win.ini -->28/08/2008 15:46:02
                          C:\WINDOWS\system.ini -->28/08/2008 15:46:02
                          C:\WINDOWS\QTFont.qfn -->20/08/2008 17:14:31
                          C:\WINDOWS\NeroDigital.ini -->16/08/2008 15:33:08
                          C:\WINDOWS\SIERRA.INI -->30/03/2008 16:53:27
                          C:\WINDOWS\ModemLog_Modem standard 33600 bps.txt -->30/11/2007 19:38:09
                          C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt -->30/11/2007 19:38:03
                          C:\WINDOWS\QTFont.for -->30/11/2007 15:58:53
                          C:\WINDOWS\aopr.ini -->23/06/2007 16:30:24
                          C:\WINDOWS\_MSRSTRT.EXE -->23/06/2007 14:06:07
                          C:\WINDOWS\aoxppr.ini -->23/06/2007 14:05:41
                          C:\WINDOWS\explorer.exe -->13/06/2007 15:22:28
                          C:\WINDOWS\tosOBEX.INI -->15/05/2007 16:43:08

                          winlogon.exe
                          svchost.exe
                          ws2_32.dll
                          user32.dll
                          Verified: Signed
                          tcpip.sys
                          Verified: Signed
                          ndis.sys
                          Verified: Signed
                          null.sys
                          Verified: Signed

                          ListDLLs v2.25 - DLL lister for Win9x/NT
                          Copyright (C) 1997-2004 Mark Russinovich
                          Sysinternals - www.sysinternals.com

                          ------------------------------------------------------------------------------
                          explorer.exe pid: 228
                          Command line: C:\WINDOWS\Explorer.EXE

                          Base Size Version Path
                          0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                          0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                          0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                          0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
                          0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                          0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                          0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                          0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat
                          0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
                          0x44360000 0x5cd000 7.00.6000.16705 C:\WINDOWS\system32\ieframe.dll
                          0x44160000 0x127000 7.00.6000.16705 C:\WINDOWS\system32\urlmon.dll
                          0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
                          0x10000000 0x14000 1.00.0000.1012 C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
                          0x00c10000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
                          0x016b0000 0x2c000 C:\Program Files\WinRAR\rarext.dll
                          0x00c00000 0xf000 1.00.0000.1004 C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL
                          0x016e0000 0x12000 7.00.0000.0015 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
                          0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL
                          0x02180000 0x56000 7.10.3052.0004 C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll
                          0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL
                          0x02300000 0x37000 3.05.0000.0000 C:\Program Files\PowerISO\PWRISOSH.DLL
                          0x021e0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
                          0x64f00000 0x12000 4.08.1227.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll

                          ListDLLs v2.25 - DLL lister for Win9x/NT
                          Copyright (C) 1997-2004 Mark Russinovich
                          Sysinternals - www.sysinternals.com

                          ------------------------------------------------------------------------------
                          winlogon.exe pid: 808
                          Command line: winlogon.exe

                          Base Size Version Path
                          0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
                          0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
                          0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
                          0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
                          0x10000000 0x99000 1.00.0000.1048 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                          0x44080000 0xd0000 7.00.6000.16705 C:\WINDOWS\system32\WININET.dll
                          0x00de0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
                          0x43e00000 0x45000 7.00.6000.16705 C:\WINDOWS\system32\iertutil.dll
                          0x00f50000 0x11000 6.14.0010.4124 C:\WINDOWS\system32\Ati2evxx.dll
                          0x010e0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll
                          0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
                          0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
                          0x636e0000 0x29000 6.00.0000.0002 C:\Program Files\Spyware Doctor\smumhook.dll
                          0x5a000000 0x1f000 6.00.0000.0000 C:\Program Files\Spyware Doctor\klg.dat

                          Le volume dans le lecteur C n'a pas de nom.
                          Le numéro de série du volume est 641D-53F4

                          Répertoire de C:\WINDOWS\system32

                          05/08/2004 13:00 6 144 csrss.exe
                          1 fichier(s) 6 144 octets
                          0 Rép(s) 40 314 417 152 octets libres

                          Contenu de Downloaded Program Files
                          Le volume dans le lecteur C n'a pas de nom.
                          Le numéro de série du volume est 641D-53F4

                          Répertoire de C:\WINDOWS\Downloaded Program Files

                          23/09/2006 10:49 <REP> .
                          23/09/2006 10:49 <REP> ..
                          16/01/2006 18:36 65 desktop.ini
                          26/05/2005 04:19 291 wuweb.inf
                          2 fichier(s) 356 octets

                          Total des fichiers listés :
                          2 fichier(s) 356 octets
                          2 Rép(s) 40 314 417 152 octets libres

                          Recherche de rootkit! (Merci S!Ri)

                          Recherche d'infections connues

                          Export des clefs sensibles..

                          Liste des fichiers en exception sur le pare-feu XP SP2

                          "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
                          "C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp"="C:\\Documents and Settings\\Justine\\Local Settings\\Temp\\.tt22.tmp:*:Enabled:enable"
                          "C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system32\\sysrest32.exe:*:Enabled:enable"

                          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                          Export de la clef SharedTaskScheduler

                          [SharedTaskScheduler]
                          "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
                          "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

                          exports des policies
                          REGEDIT4

                          [system]
                          "dontdisplaylastusername"=dword:00000000
                          "legalnoticecaption"=""
                          "legalnoticetext"=""
                          "shutdownwithoutlogon"=dword:00000001
                          "undockwithoutlogon"=dword:00000001

                          Export des clefs sensibles..
                          Rechercher adresses sensibles dans le fichier HOSTS...
                          catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-09-06 22:53:55
                          Windows 5.1.2600 Service Pack 2 NTFS

                          scanning hidden services & system hive ...

                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                          "h0"=dword:00000000
                          "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                          "p0"="C:\Program Files\DAEMON Tools\"
                          "h0"=dword:00000001
                          "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                          "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                          "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                          "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv]
                          "start"=dword:00000001
                          "type"=dword:00000001
                          "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                          "s1"=dword:2da7b4db
                          "s2"=dword:6e01368e
                          "h0"=dword:00000002

                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                          "h0"=dword:00000000
                          "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                          "p0"="C:\Program Files\DAEMON Tools\"
                          "h0"=dword:00000001
                          "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                          "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                          "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                          "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv]
                          "start"=dword:00000001
                          "type"=dword:00000001
                          "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                          "h0"=dword:00000000
                          "ujdew"=hex:b9,c2,93,2d,b3,bd,14,8c,04,f3,a3,11,90,47,05,c9,7f,b0,95,f6,0d,..
                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                          "p0"="C:\Program Files\DAEMON Tools\"
                          "h0"=dword:00000001
                          "khjeh"=hex:2e,eb,5a,55,73,53,95,62,50,1c,cf,69,a9,71,a4,c6,1a,89,be,16,00,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                          "a0"=hex:20,01,00,00,7d,5a,fb,17,9a,19,96,6c,45,d0,8d,fa,2b,a2,bd,e9,83,..
                          "khjeh"=hex:af,02,fb,35,e5,09,f8,25,21,d9,d3,19,f6,e0,5a,4d,7b,aa,4c,83,13,..

                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                          "khjeh"=hex:1c,95,da,08,af,a7,e0,ad,48,58,86,e5,7e,9a,21,d8,ff,c4,75,e2,ba,..
                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tdssserv]
                          "start"=dword:00000001
                          "type"=dword:00000001
                          "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

                          scanning hidden registry entries ...

                          scanning hidden files ...

                          scan completed successfully
                          hidden services: 0
                          hidden files: 0

                          KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                          Error loading kernel support driver!
                          Make sure you are running this as Administrator.

                          KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

                          Error loading kernel support driver!
                          Make sure you are running this as Administrator.

                          Liste des programmes installes

                          802.11 USB Wireless LAN Adapter
                          Adobe Bridge 1.0
                          Adobe Common File Installer
                          Adobe Flash Player Plugin
                          Adobe Help Center 1.0
                          Adobe Photoshop CS2
                          Adobe Photoshop CS2
                          Adobe Reader 7.1.0 - Français
                          Adobe Shockwave Player
                          Adobe Stock Photos 1.0
                          AiO_Scan_CDA
                          AiOSoftwareNPI
                          Apple Software Update
                          Archiveur WinRAR
                          Assist TOSHIBA
                          Assistant de connexion Windows Live
                          ATI - Utilitaire de désinstallation du logiciel
                          ATI Catalyst Control Center
                          ATI Display Driver
                          avast! Antivirus
                          Avira AntiVir Personal - Free Antivirus
                          Azureus
                          Bluetooth Stack for Windows by Toshiba
                          BufferChm
                          C3100 c3100_Help
                          CCleaner (remove only)
                          CEP - Color Enable Package
                          Commandes TOSHIBA
                          Correctif pour Windows Internet Explorer 7 (KB947864)
                          Correctif Windows XP - KB884018
                          CustomerResearchQFolder
                          Destinations
                          DeviceManagementQFolder
                          DocProc
                          DocProcQFolder
                          eMule
                          eSupportQFolder
                          Fax_CDA
                          Formatage de carte mémoire SD TOSHIBA
                          Gestion d'énergie TOSHIBA
                          HijackThis 2.0.2
                          HP Customer Participation Program 7.0
                          HP Imaging Device Functions 7.0
                          HP Photosmart Essential
                          HP Photosmart, Officejet and Deskjet 7.0.A
                          HP Software Update
                          HP Solution Center 7.0
                          HPPhotoSmartExpress
                          HPProductAssistant
                          InstantShareDevicesMFC
                          Intel(R) PRO Network Connections Drivers
                          InterVideo WinDVD Creator 2
                          InterVideo WinDVD for TOSHIBA
                          J2SE Runtime Environment 5.0 Update 4
                          Le Petit MOURRE
                          Lecteur Windows Media 10
                          Les Indispensables Éducation pour Microsoft Office
                          Les Sims 2
                          Les Sims 2 : Nuits de Folie
                          Les Sims 2 Fun en Famille Kit
                          Les Sims 2 : La bonne affaire
                          Les Sims™ 2 Animaux & Cie
                          Les Sims™ 2 H&M® Fashion Kit
                          Les Sims™ 2 Jour de fête ! Kit 
                          Les Sims™ 2 Kit Glamour
                          Les Sims™ 2 Quartier Libre
                          Les Sims™ 2 Tout pour les ados Kit
                          Les Sims™ 2 Au fil des saisons
                          Les Sims™ 2 Bon Voyage
                          Lexibase Collins Français-Anglais
                          LG PC Suite
                          LG USB Modem driver [KU580]
                          livebox
                          Logiciel Intel(R) PROSet/Wireless
                          Macromedia Flash Player
                          Malwarebytes' Anti-Malware
                          Manuels TOSHIBA
                          MarketResearch
                          mCore
                          mDrWiFi
                          Messenger Plus! Live
                          mHelp
                          Microsoft .NET Framework 1.1
                          Microsoft .NET Framework 1.1
                          Microsoft .NET Framework 1.1 French Language Pack
                          Microsoft .NET Framework 1.1 Hotfix (KB928366)
                          Microsoft .NET Framework 2.0 Language Pack - FRA
                          Microsoft .NET Framework 2.0 Service Pack 1
                          Microsoft Encarta 2007 - Études
                          Microsoft Encarta Maths
                          Microsoft Internationalized Domain Names Mitigation APIs
                          Microsoft National Language Support Downlevel APIs
                          Microsoft Office OneNote 2003
                          Microsoft Office Professional Edition 2003
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)
                          Mise à jour Encarta_Les Indispensables Éducation
                          mIWA
                          mLogView
                          mMHouse
                          Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
                          Module sécurisé SD
                          mPfMgr
                          mPfWiz
                          mProSafe
                          MSXML 4.0 SP2 (KB927978)
                          MSXML 4.0 SP2 (KB936181)
                          MSXML 6.0 Parser (KB933579)
                          mWlsSafe
                          mXML
                          mZConfig
                          Nero 6 Ultra Edition
                          NewCopy_CDA
                          OCR Software by I.R.I.S 7.0
                          Outil de diagnostic PC TOSHIBA
                          PanoStandAlone
                          PowerISO
                          ProductContextNPI
                          QuickTime
                          Readme
                          Realtek High Definition Audio Driver
                          Réducteur de bruit lect. CD/DVD
                          SAGEM F@st 800-840
                          Satsuki Decoder Pack
                          Scan
                          ScannerCopy
                          Security Update for CAPICOM (KB931906)
                          Security Update for CAPICOM (KB931906)
                          SolutionCenter
                          Son virtuel TOSHIBA
                          Sonic DLA
                          Sony USB Driver
                          Spyware Doctor 6.0
                          Status
                          SUPERAntiSpyware Free Edition
                          Synaptics Pointing Device Driver
                          The Sims 2 University
                          Toolbox
                          TOSHIBA ConfigFree
                          TOSHIBA Hotkey Utility
                          TOSHIBA Software Modem
                          TOSHIBA TouchPad ON/Off Utility
                          TOSHIBA Utilities
                          TrayApp
                          Unload
                          Utilitaire de zoom TOSHIBA
                          VideoLAN VLC media player 0.8.6a
                          WebFldrs XP
                          WebReg
                          Winamp (remove only)
                          Windows Genuine Advantage Notifications (KB905474)
                          Windows Internet Explorer 7
                          Windows Live installer
                          Windows Live Messenger
                          Windows Live OneCare safety scanner
                          Windows Media Format Runtime

                          Le volume dans le lecteur C n'a pas de nom.
                          Le numéro de série du volume est 641D-53F4

                          Répertoire de C:\Program Files

                          06/09/2008 17:00 <REP> .
                          06/09/2008 17:00 <REP> ..
                          17/05/2007 16:35 <REP> 1964
                          09/12/2007 12:35 <REP> Adobe
                          22/04/2007 19:07 <REP> Ahead
                          22/09/2006 09:23 <REP> Alcohol Soft
                          10/04/2008 14:44 <REP> Alwil Software
                          13/05/2007 12:35 <REP> Apple Software Update
                          13/02/2006 13:12 <REP> ATI Technologies
                          06/09/2008 16:25 <REP> Avira
                          23/06/2008 14:45 <REP> Azureus
                          02/09/2007 21:56 <REP> CCleaner
                          16/01/2006 18:35 <REP> ComPlus Applications
                          01/06/2007 20:53 <REP> DAEMON Tools
                          01/03/2008 19:14 <REP> EA GAMES
                          23/06/2007 16:10 <REP> ElcomSoft
                          18/08/2008 15:00 <REP> eMule
                          28/08/2008 17:05 <REP> Enigma Software Group
                          01/03/2008 16:37 <REP> Fichiers communs
                          07/08/2007 14:55 <REP> Hewlett-Packard
                          25/12/2006 16:46 <REP> HP
                          29/08/2006 16:23 <REP> Intel
                          16/08/2008 11:54 <REP> Internet Explorer
                          29/08/2006 16:22 <REP> InterVideo
                          13/02/2006 13:14 <REP> Java
                          28/02/2007 20:17 <REP> Le Petit MOURRE
                          27/03/2008 09:10 <REP> Learning Essentials
                          18/05/2008 12:02 <REP> LG Electronics
                          18/05/2008 12:02 <REP> LG PC Suite 2
                          29/08/2008 11:40 <REP> Malwarebytes' Anti-Malware
                          16/08/2008 11:57 <REP> Messenger
                          06/09/2008 16:23 <REP> Messenger Plus! Live
                          26/03/2008 21:05 <REP> Microsoft CAPICOM 2.1.0.2
                          09/12/2007 14:57 <REP> Microsoft Etudes
                          13/02/2006 13:15 <REP> microsoft frontpage
                          02/02/2008 11:19 <REP> Microsoft Office
                          13/02/2006 13:16 <REP> Microsoft.NET
                          13/02/2006 13:16 <REP> Movie Maker
                          28/08/2008 19:24 <REP> Mozilla Firefox
                          13/02/2006 13:16 <REP> MSN
                          13/02/2006 13:16 <REP> MSN Gaming Zone
                          01/03/2008 16:38 <REP> MSN Messenger
                          03/02/2008 11:48 <REP> MSXML 6.0
                          13/02/2006 13:16 <REP> NetMeeting
                          13/02/2006 13:17 <REP> Online Services
                          06/07/2007 14:20 <REP> Outlook Express
                          08/12/2006 14:33 <REP> PowerISO
                          13/05/2007 12:36 <REP> QuickTime
                          12/03/2007 22:35 <REP> Real
                          13/02/2006 13:17 <REP> Realtek
                          25/04/2007 11:04 <REP> SAGEM
                          11/01/2007 21:28 <REP> SAGEM F@st 800-840
                          23/09/2006 19:13 <REP> Satsuki Decoder Pack
                          13/02/2006 13:17 <REP> Services en ligne
                          23/06/2007 13:37 <REP> Sims 2 Collection Maker
                          23/08/2007 10:41 <REP> Softissimo
                          06/09/2008 16:45 <REP> Spybot - Search & Destroy
                          06/09/2008 16:33 <REP> Spyware Doctor
                          24/06/2008 14:36 <REP> StepMania
                          06/09/2008 16:21 <REP> SUPERAntiSpyware
                          02/02/2008 11:39 <REP> Symantec
                          13/02/2006 13:18 <REP> Synaptics
                          12/05/2007 20:40 <REP> Timeline Interactive
                          23/06/2007 10:02 <REP> Toshiba
                          06/09/2008 17:00 <REP> Trend Micro
                          27/02/2007 19:55 <REP> VideoLAN
                          25/04/2007 11:34 <REP> Wanadoo
                          23/12/2007 20:27 <REP> Winamp
                          01/03/2008 16:38 <REP> Windows Live
                          26/03/2008 23:13 <REP> Windows Live Safety Center
                          24/09/2006 10:29 <REP> Windows Media Player
                          13/02/2006 13:19 <REP> Windows NT
                          01/03/2007 23:30 <REP> WinRAR
                          13/02/2006 13:19 <REP> xerox
                          0 fichier(s) 0 octets
                          74 Rép(s) 40 304 672 768 octets libres
                          Le volume dans le lecteur C n'a pas de nom.
                          Le numéro de série du volume est 641D-53F4

                          Répertoire de C:\Program Files\fichiers communs

                          01/03/2008 16:37 <REP> .
                          01/03/2008 16:37 <REP> ..
                          10/06/2008 14:51 <REP> Adobe
                          09/12/2007 12:26 <REP> Adobe Systems Shared
                          22/04/2007 19:07 <REP> Ahead
                          01/09/2006 21:53 <REP> DESIGNER
                          23/09/2006 09:59 278 528 FDEUnInstaller.exe
                          25/12/2006 16:42 <REP> Hewlett-Packard
                          25/12/2006 16:46 <REP> HP
                          13/02/2006 13:12 <REP> InstallShield
                          13/02/2006 13:12 <REP> Java
                          11/08/2008 21:34 <REP> Microsoft Shared
                          13/02/2006 13:13 <REP> MSSoap
                          13/02/2006 13:13 <REP> ODBC
                          13/03/2007 10:25 <REP> Real
                          13/02/2006 13:13 <REP> Services
                          13/02/2006 13:13 <REP> SpeechEngines
                          02/02/2008 11:41 <REP> Symantec Shared
                          06/07/2007 14:20 <REP> System
                          28/08/2008 18:34 <REP> Wise Installation Wizard
                          1 fichier(s) 278 528 octets
                          19 Rép(s) 40 304 672 768 octets libres
                          Le volume dans le lecteur C n'a pas de nom.
                          Le numéro de série du volume est 641D-53F4

                          Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

                          02/08/2008 10:14 <REP> .
                          02/08/2008 10:14 <REP> ..
                          13/02/2006 13:12 <REP> 1033
                          02/08/2008 10:14 <REP> 1036
                          20/09/2005 12:33 1 293 008 MSONSEXT.DLL
                          22/03/2007 19:29 39 256 MSOSV.DLL
                          03/06/1999 13:09 122 937 MSOWS409.DLL
                          07/03/2001 08:00 127 033 MSOWS40c.DLL
                          11/07/2003 03:25 80 448 PKMWS.DLL
                          5 fichier(s) 1 662 682 octets
                          4 Rép(s) 40 304 672 768 octets libres

                          c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe
                          c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
                          c:\Documents and Settings\Justine\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr710_fr_FR.exe
                          c:\Documents and Settings\Justine\Bureau\antivir_workstation_winu_en_h.exe
                          c:\Documents and Settings\Justine\Bureau\HJTInstall.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix.exe
                          c:\Documents and Settings\Justine\Bureau\zaSetup_fr.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\catchme.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\diff.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\dumphive.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\find2.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\Fport.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\grep.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\gzip.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LFiles.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\md5sums.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\pslist.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\sigcheck.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\streams.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\swreg.exe
                          c:\Documents and Settings\Justine\Bureau\DiagHelp\DiagHelp\tar.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\404Fix.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\AntiXPVSTFix.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\dumphive.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\exit.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\GenericRenosFix.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\HostsChk.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.C.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\IEDFix.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Policies.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Process.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\Reboot.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\restart.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SmiUpdate.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\SrchSTS.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swreg.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swsc.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\swxcacls.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\UIFix.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\unzip.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VACFix.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\VCCLSID.exe
                          c:\Documents and Settings\Justine\Bureau\SmitfraudFix\WS2Fix.exe
                          c:\Documents and Settings\Justine\Local Settings\Temp\SSUPDATE.EXE
                          c:\Documents and Settings\Justine\Mes documents\Games\rom\PoKémon\Visual_Boy_Advance_V1.7.2_win_Fr\VisualBoyAdvance.exe
                          c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\GREASE.EXE
                          c:\Documents and Settings\Justine\Mes documents\Ma musique\Musique\Grease - Soundtrack\Grease\Multimedia\VFW11E\SETUP.EXE
                          c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                          c:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                          c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
                          c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
                          c:\Documents and Settings\Justine\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
                          c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
                          c:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
                          c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
                          c:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
                          c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

                          ****** Fin du rapport DiagHelp
                          Veuillez svp envoyer le fichier C:\upload_moi_JUSTINE.tar.gz a l'adresse http://upload.malekal.com
                          1. ep44 Contributeur
                            ah bien voilà on la vois la maline

                            Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau.
                            http://download.bleepingcomputer.com/sUBs/ComboFix.exe
                            * Déconnecte toi d'internet et ferme toutes tes applications.
                            * Désactive tes protections (antivirus, parefeu,antispyware) provisoirement et seulement le temps de l'utilisation de ComboFix,
                            * Double-clic sur combofix.exe, il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.
                            * /! Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne /!
                            * Attends que Combofix ait terminé, un rapport sera créé.
                            * réactive ton parefeu, ton antivirus, la garde de ton antispyware
                            * copie/colle le rapport, le rapport se trouve dans : C:Combofix.txt
                            * Réactive tes protections en temps réel, Antivirus, Antispywares, avant de te reconnecter à internet.

                            1. JUSTINE
                              Tout d'abord merci beaucoup pour ton aide. Je voulais savoir si c'est normal que le scan soit très long (presque une heure maintenant). Je n'est touché à rien depuis le début du scan, le pc à redémarrer et depuis il est bloqué sur "compte rendu en cours de préparation, ne lancer aucun programme tant que combofix n'est pas fini " avec un tiret qui clignote en dessous.
                              Est ce que c'est normal ou est ce qu'il y a eu un bug?
                              Désolé pour mon inexpérience mais je m'inquiéte!!!
                              2. JUSTINE
                                c 'est bon voivi le scan

                                ComboFix 08-09-05.02 - Justine 2008-09-07 15:17:22.2 - NTFSx86 NETWORK
                                Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.801 [GMT 2:00]
                                Endroit: C:\Documents and Settings\Justine\Bureau\ComboFix.exe

                                [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                                .

                                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                .
                                ---- Previous Run -------
                                .
                                C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML

                                .
                                ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                                .

                                -------\Legacy_TDSSSERV
                                -------\Service_poof
                                -------\Service_tdssserv

                                ((((((((((((((((((((((((((((( Fichiers créés 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))))))))
                                .

                                2008-09-06 22:54 . 2008-09-06 22:54 9,705,579 --a------ C:\upload_moi_JUSTINE.tar.gz
                                2008-09-06 17:00 . 2008-09-06 17:00 <REP> d-------- C:\Program Files\Trend Micro
                                2008-09-06 16:32 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
                                2008-09-06 16:32 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
                                2008-09-06 16:32 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
                                2008-09-06 16:32 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
                                2008-09-06 16:31 . 2008-09-06 16:33 <REP> d-------- C:\Program Files\Spyware Doctor
                                2008-09-06 16:31 . 2008-09-06 16:31 <REP> d-------- C:\Documents and Settings\Justine\Application Data\PC Tools
                                2008-09-06 16:25 . 2008-09-06 16:25 <REP> d-------- C:\Program Files\Avira
                                2008-09-06 16:25 . 2008-09-06 16:25 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
                                2008-09-04 21:19 . 2008-09-06 16:45 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                                2008-09-04 21:19 . 2008-09-06 16:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                                2008-08-29 12:25 . 2008-08-29 12:25 <REP> d-------- C:\WINDOWS\ERUNT
                                2008-08-29 11:40 . 2008-08-29 11:40 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                2008-08-29 11:40 . 2008-08-29 11:40 <REP> d-------- C:\Documents and Settings\Justine\Application Data\Malwarebytes
                                2008-08-29 11:40 . 2008-08-29 11:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                2008-08-29 11:40 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                                2008-08-29 11:40 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                2008-08-29 11:03 . 2008-08-29 11:03 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com
                                2008-08-28 18:54 . 2008-08-28 19:48 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
                                2008-08-28 18:34 . 2008-09-06 16:21 <REP> d-------- C:\Program Files\SUPERAntiSpyware
                                2008-08-28 18:34 . 2008-08-28 18:34 <REP> d-------- C:\Documents and Settings\Justine\Application Data\SUPERAntiSpyware.com
                                2008-08-28 18:34 . 2008-08-28 18:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
                                2008-08-28 18:20 . 2008-08-28 18:20 <REP> d-------- C:\Documents and Settings\Justine\Application Data\Grisoft
                                2008-08-28 18:20 . 2008-08-28 18:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                                2008-08-28 17:48 . 2008-09-07 10:50 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                                2008-08-28 17:20 . 2008-08-28 17:20 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback
                                2008-08-28 17:05 . 2008-08-28 17:05 <REP> d-------- C:\Program Files\Enigma Software Group
                                2008-08-28 09:33 . 2006-02-13 13:04 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
                                2008-08-28 09:33 . 2006-08-29 16:22 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage réseau
                                2008-08-28 09:33 . 2006-01-16 19:29 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                                2008-08-28 09:33 . 2006-02-13 13:04 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
                                2008-08-28 09:33 . 2006-02-13 13:04 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
                                2008-08-28 09:33 . 2006-02-13 13:04 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
                                2008-08-28 09:33 . 2006-02-13 13:03 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
                                2008-08-28 09:33 . 2008-08-29 11:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                                2008-08-28 09:33 . 2006-02-13 13:03 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
                                2008-08-28 09:33 . 2006-02-13 13:03 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
                                2008-08-28 09:33 . 2006-08-29 16:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Intel
                                2008-08-28 09:33 . 2006-02-13 13:03 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ATI
                                2008-08-28 09:33 . 2008-08-28 09:33 <REP> d-------- C:\Documents and Settings\Administrateur
                                2008-08-24 16:26 . 2008-08-29 11:22 86,804 --a------ C:\WINDOWS\system32\drivers\556a2dc3.sys
                                2008-08-15 20:59 . 2008-05-01 16:31 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

                                .
                                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                2008-09-06 19:23 1,510 ----a-w C:\WINDOWS\system32\tmp.reg
                                2008-09-06 14:23 --------- d-----w C:\Program Files\Messenger Plus! Live
                                2008-09-02 21:58 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
                                2008-09-02 14:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
                                2008-08-28 20:36 82,432 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
                                2008-08-28 16:34 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
                                2008-08-18 13:00 --------- d-----w C:\Program Files\eMule
                                2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
                                2008-08-12 20:27 --------- d-----w C:\Documents and Settings\Justine\Application Data\Azureus
                                2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                                2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                                2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
                                2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                                2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                                2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                                2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                                2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                                2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
                                2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
                                2008-07-07 20:18 253,952 ----a-w C:\WINDOWS\system32\es.dll
                                2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                                2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                                2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                                2006-09-23 07:59 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
                                .

                                ------- Sigcheck -------

                                2008-04-14 04:34 14336 e4bdf223cd75478bf44567b4d5c2634d C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\svchost.exe
                                2004-08-05 13:00 17408 e10254428fff9cd12ed29d3dbcfb4d53 C:\WINDOWS\system32\svchost.exe

                                2008-04-14 04:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\winlogon.exe
                                2004-08-05 13:00 510464 9de86ca5059f94cec98bd279474261cc C:\WINDOWS\system32\winlogon.exe

                                2007-06-13 15:22 1039872 6774bd7f38465fecdbe88db8fe762fa7 C:\WINDOWS\explorer.exe
                                2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
                                2008-04-14 04:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\explorer.exe

                                2008-04-14 04:34 109056 54cb50058851d95e56ec70d09f70857f C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\services.exe
                                2004-08-05 13:00 110592 1508d377147923d69343cb60bbdd0c63 C:\WINDOWS\system32\services.exe

                                2008-04-14 04:34 13312 91e6024d6d4dcdecdb36c43ecf9bbecb C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\lsass.exe
                                2004-08-05 13:00 14848 e377fc401c6696bf48f5beacb6dcd8fd C:\WINDOWS\system32\lsass.exe
                                .
                                ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                .
                                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                REGEDIT4

                                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
                                "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
                                "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-06 1576176]

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
                                "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

                                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]

                                C:\Documents and Settings\Justine\Menu D‚marrer\Programmes\D‚marrage\
                                Lancement rapide de Microsoft Office OneNote 2003.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]

                                C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

                                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                                "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
                                2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                "VIDC.VP40"= vp4vfw.dll

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]
                                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk
                                backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^DSLMON.lnk]
                                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk
                                backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
                                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
                                backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
                                path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
                                backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

                                [HKLM\~\startupfolder\C:^Documents and Settings^Justine^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
                                path=C:\Documents and Settings\Justine\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
                                backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
                                --a--c--- 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
                                --a--c--- 2006-02-19 03:41 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L07FXLRD_13069265]
                                --a------ 2006-06-13 18:11 351000 C:\Program Files\Microsoft Etudes\Microsoft Encarta 2007 - Études DVD\EDICT.EXE

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
                                --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
                                --a--c--- 2007-04-27 09:41 282624 C:\Program Files\QuickTime\qttask.exe

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                                "DisableMonitoring"=dword:00000001

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                                "DisableMonitoring"=dword:00000001

                                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                                "DisableMonitoring"=dword:00000001

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                "C:\\WINDOWS\\system32\\sessmgr.exe"=

                                S1 556a2dc3;556a2dc3;C:\WINDOWS\system32\drivers\556a2dc3.sys [2008-08-29 86804]
                                S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
                                S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
                                S3 e9637c0e-8e0f-480f-a798-fc1387b2d5fe;e9637c0e-8e0f-480f-a798-fc1387b2d5fe;D:\Player\cds300.dll [ ]
                                S3 lg3gbus;LGE KU580 driver (WDM);C:\WINDOWS\system32\DRIVERS\lg3gbus.sys [2007-04-26 83080]
                                S3 lg3gmdfl;LGE KU580 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\lg3gmdfl.sys [2007-04-26 15112]
                                S3 lg3gmdm;LGE KU580 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\lg3gmdm.sys [2007-04-26 108552]
                                S3 lg3gobex;LGE KU580 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\lg3gobex.sys [2007-04-26 98568]
                                S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-06-20 215040]

                                [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a23ae763-ef8d-11dc-bf9c-00a0d13d8e2d}]
                                \Shell\AutoRun\command - G:\LaunchU3.exe

                                [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fafd4b7e-4a0a-11db-bbf1-00a0d13d8e2d}]
                                \Shell\AutoRun\command - E:\AutoRun.exe
                                .
                                Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                                .
                                - - - - ORPHANS REMOVED - - - -

                                SSODL-AHtwwebEK-{641D53F5-CEB7-F95F-6944-C8FA7BA4ACCC} - (no file)
                                MSConfigStartUp-lphcaw0j0er2j - C:\WINDOWS\system32\lphcaw0j0er2j.exe
                                MSConfigStartUp-SiteAdvisor - C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
                                MSConfigStartUp-SMrhcew0j0er2j - C:\Program Files\rhcew0j0er2j\rhcew0j0er2j.exe

                                .
                                ------- Supplementary Scan -------
                                .
                                FireFox -: Profile - C:\Documents and Settings\Justine\Application Data\Mozilla\Firefox\Profiles\ntkjgpgm.default\
                                FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                                FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr
                                .

                                **************************************************************************

                                catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                Rootkit scan 2008-09-07 15:20:49
                                Windows 5.1.2600 Service Pack 2 NTFS

                                Balayage processus cachés ...

                                Balayage caché autostart entries ...

                                Balayage des fichiers cachés ...

                                Scan terminé avec succès
                                Les fichiers cachés: 0

                                **************************************************************************
                                .
                                Temps d'accomplissement: 2008-09-07 15:22:02
                                ComboFix-quarantined-files.txt 2008-09-07 13:21:54

                                Pre-Run: 40,177,131,520 octets libres
                                Post-Run: 40,158,871,552 octets libres

                                203 --- E O F --- 2008-08-16 09:57:23
                                1. ep44 Contributeur
                                  Bonjour très bien :)

                                  Refais un nouveau rapport HijackThis stp ainsi qu'un nouveau DiagHelp et dit moi comment ce comporte ton PC
                                  1. JUSTINE
                                    voici les rapports

                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 16:00:53, on 07/09/2008
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                    Boot mode: Safe mode with network support

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                                    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
                                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
                                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                    O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
                                    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                    O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                                    O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - D:\Player\__CDS2.dll (file missing)
                                    O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                                    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                                    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
                                    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                    O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
                                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                                    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                                    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                                    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                                    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                                    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
                                    1. ep44 Contributeur
                                      Oui en effet trois antivirus sur ton PC dur dur pour lui

                                      tu as avast, norton et antivir

                                      je te conseil vivement de garder antivir
                                      utilise c'est outils pour la désinstallation de avast et de norton
                                      avast ==> https://www.avast.com/fr-fr/uninstall-utility
                                      Norton ==> http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

                                      ensuite
                                      Télécharge ATF Cleaner par Atribune.
                                      http://www.atribune.org/ccount/click.php?id=1

                                      Double-clique ATF-Cleaner.exe afin de lancer le programme.
                                      Sous l'onglet Main, choisis : Select All
                                      Clique sur le bouton Empty Selected

                                      Si tu utilises le navigateur Firefox :

                                      Clique Firefox au haut et choisis : Select All
                                      Clique le bouton Empty Selected
                                      NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

                                      Si tu utilises le navigateur Opera :

                                      Clique Opera au haut et choisis : Select All
                                      Clique le bouton Empty Selected
                                      NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

                                      Clique Exit, du menu principal, afin de fermer le programme.
                                      Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus.

                                      • 1
                                      • 2

                                      Discussions similaires

                                      Problème avec "PUADIManager:Win32/OfferCore
                                      Knaki

                                      3 réponses
                                      PUADlManager:Win32/OfferCore
                                      tenmalade

                                      2 réponses
                                      PUADlManager:Win32/OfferCore
                                      bernardarrad

                                      3 réponses
                                      OneStart de Google qu'est-ce ?
                                      locaguo

                                      7 réponses
                                      Pb Windows 7, .EXE n'est pas app win32 valide
                                      Witeric

                                      15 réponses