Virus alerte dans la barre d'horloge , plus

le pc est bien en mode normal , j'ai arrete le anti virus , ... mais lorsque je lance hijack il ne se lance pas
que veux tu que je fasses

je ne peux pas aller sur Ajout suppression de programmes

pour commencer voisi l'analyse de smithfraudix
je viens de relancer le pc en mode normale
SmitFraudFix v2.373

Rapport fait à 13:10:00.36, 2008-11-08
Executé à partir de C:\Documents and Settings\jmi\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 NtKrnlpa.cn

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{12DEC126-B320-499F-A220-2040E51C1BEB}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{72A893E1-A9CB-4818-8FF5-EB30853DD671}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{12DEC126-B320-499F-A220-2040E51C1BEB}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{72A893E1-A9CB-4818-8FF5-EB30853DD671}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{12DEC126-B320-499F-A220-2040E51C1BEB}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{72A893E1-A9CB-4818-8FF5-EB30853DD671}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

malwarebyte en mode normale.
ne fonctionne pas

ca ne marche pas

je peux t'appeler

ComboFix 08-11-07.01 - jmi 2008-11-08 14:24:40.2 - NTFSx86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.795 [GMT 1:00]
Running from: c:\documents and settings\jmi\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\enbo.exe
c:\windows\system32\efyvao.dll
c:\windows\system32\eguypbvf.dll
c:\windows\system32\fqschwyx.dll
c:\windows\system32\hqltifue.dll
c:\windows\system32\nwnxyple.dll
c:\windows\system32\potvkg.dll
c:\windows\system32\ydulpx.dll
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\OutpostProInstall_tele[1].exe
c:\documents and settings\jmi\Application Data\Facegame
c:\documents and settings\jmi\Application Data\Facegame\Facegame.exe
c:\documents and settings\jmi\Application Data\Gool
c:\documents and settings\jmi\Application Data\Gool\Gool.exe
c:\documents and settings\jmi\Application Data\PCPrivacyCleaner
c:\documents and settings\jmi\Application Data\PCPrivacyCleaner\Logs\scns.log
c:\documents and settings\jmi\Application Data\SpeedRunner
c:\documents and settings\jmi\Application Data\SpeedRunner\config.cfg
c:\documents and settings\jmi\Application Data\SpeedRunner\SpeedRunner.exe
c:\documents and settings\jmi\Application Data\SpeedRunner\SRUninstall.exe
c:\documents and settings\jmi\Cookies\eqelimewa.scr
c:\documents and settings\jmi\Cookies\ohuroh.dat
c:\documents and settings\jmi\Cookies\olufodopov.com
c:\documents and settings\jmi\Cookies\tixake.dll
c:\documents and settings\jmi\Cookies\uqeqihylo.db
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\lamag.exe
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\ohicikuzyn.exe
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\oxesirozah.dll
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\ritugociq.dll
c:\documents and settings\jmi\Local Settings\Temporary Internet Files\zuhifycudy.dll
c:\documents and settings\jmi\Menu Démarrer\Programmes\AntiSpywareXP2009
c:\documents and settings\jmi\Menu Démarrer\Programmes\AntiSpywareXP2009\AntiSpywareXP2009.lnk
c:\documents and settings\jmi\Menu Démarrer\Programmes\AntiSpywareXP2009\Uninstall.lnk
c:\documents and settings\jmi\Menu Démarrer\Programmes\Outerinfo
c:\documents and settings\jmi\Menu Démarrer\Programmes\Outerinfo\Terms.lnk
c:\program files\AntiSpywareXP2009
c:\program files\AntiSpywareXP2009\AntiSpywareXP2009.cfg
c:\program files\AntiSpywareXP2009\AntiSpywareXP2009.exe
c:\program files\AntiSpywareXP2009\data\daily.cvd
c:\program files\AntiSpywareXP2009\htmlayout.dll
c:\program files\AntiSpywareXP2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\program files\AntiSpywareXP2009\Microsoft.VC80.CRT\msvcm80.dll
c:\program files\AntiSpywareXP2009\Microsoft.VC80.CRT\msvcp80.dll
c:\program files\AntiSpywareXP2009\Microsoft.VC80.CRT\msvcr80.dll
c:\program files\AntiSpywareXP2009\pthreadVC2.dll
c:\program files\AntiSpywareXP2009\Uninstall.exe
c:\program files\AntiSpywareXP2009\wscui.cpl
c:\program files\Fichiers communs\Yazzle3090OinAdmin.exe
c:\program files\GetPack
c:\program files\GetPack\dictame.gz
c:\program files\GetPack\GetPack23.exe
c:\program files\GetPack\trgtame.gz
c:\program files\iCheck
c:\program files\iCheck\iCheck.exe
c:\program files\iCheck\Uninstall.exe
c:\program files\Mjcore
c:\program files\Mjcore\Mjcore.dll
c:\program files\outerinfo
c:\program files\outerinfo\FF\chrome.manifest
c:\program files\outerinfo\FF\components\OuterinfoAds.xpt
c:\program files\outerinfo\FF\install.rdf
c:\program files\outerinfo\Terms.rtf
c:\program files\PCPrivacyCleaner
c:\windows\brastk.exe
c:\windows\default.htm
c:\windows\Downloaded Program Files\setup.inf
c:\windows\pack.epk
c:\windows\pppatc~1
c:\windows\pppatc~1\?ppPatch\
c:\windows\pppatc~1\svchost.exe
c:\windows\system32\ajmtghrt.ini
c:\windows\system32\av.dat
c:\windows\system32\bwiisnej.dll
c:\windows\system32\cudmqgwa.ini
c:\windows\system32\DelSelf.bat
c:\windows\system32\drivers\TDSSmhct.sys
c:\windows\system32\eufitlqh.ini
c:\windows\system32\getsn32.dll
c:\windows\system32\gurxhn.dll
c:\windows\system32\hpocytwf.ini
c:\windows\system32\iackduks.ini
c:\windows\system32\ipessjgf.dll
c:\windows\system32\karna.dat
c:\windows\system32\kiu.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\moqhigxs.ini
c:\windows\system32\nhrjmctqip.dat
c:\windows\system32\nhrjmctqip_nav.dat
c:\windows\system32\nhrjmctqip_navps.dat
c:\windows\system32\nnnkJYpO.dll
c:\windows\system32\nnnkLcYp.dll
c:\windows\system32\pqturdvb.dll
c:\windows\system32\pYcLknnn.ini
c:\windows\system32\pYcLknnn.ini2
c:\windows\system32\rtwuyxwy.ini
c:\windows\system32\skudkcai.dll
c:\windows\system32\smwin32.dll
c:\windows\system32\TDSScfou.log
c:\windows\system32\TDSSfpmp.dll
c:\windows\system32\TDSSliqp.dll
c:\windows\system32\TDSSmaxt.log
c:\windows\system32\TDSSnmxh.dll
c:\windows\system32\TDSSnrse.dll
c:\windows\system32\TDSSoeqh.dll
c:\windows\system32\TDSSofxh.log
c:\windows\system32\TDSSoity.dll
c:\windows\system32\TDSSosvn.dll
c:\windows\system32\TDSSpqxt.dat
c:\windows\system32\tysxah.dll
c:\windows\system32\uesiuqcr.exe
c:\windows\system32\uvygtbcw.ini
c:\windows\system32\vpwxuk.dll
c:\windows\system32\wini10803.exe

[COLOR=RED] c:\windows\system32\userinit.exe . . . is infected!!/COLOR

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS
-------\Legacy_BOONTY_GAMES
-------\Legacy_NPF
-------\Legacy_VFILT
-------\Service_Boonty Games
-------\Service_NPF
-------\Service_VFILT


((((((((((((((((((((((((( Files Created from 2008-10-08 to 2008-11-08 )))))))))))))))))))))))))))))))
.

2063-09-19 06:50 . 2063-09-19 06:50 5,501 --a------ c:\windows\system32\rtclmg32.dll
2008-11-08 13:31 . 2008-11-08 14:21 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-08 13:31 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-08 13:31 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-08 10:00 . 2008-11-08 10:00 <REP> d-------- c:\program files\Trend Micro
2008-11-08 03:14 . 2008-11-08 03:14 <REP> d-------- c:\documents and settings\jmi\Application Data\Malwarebytes
2008-11-08 02:43 . 2008-11-08 03:06 <REP> d-------- c:\program files\Navilog1
2008-11-08 01:51 . 2008-11-08 01:51 0 --------- c:\windows\system32\HFXA.tmp
2008-11-08 00:56 . 2008-11-08 00:56 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-07 23:26 . 2008-11-08 13:10 4,444 --a------ c:\windows\system32\tmp.reg
2008-11-07 21:41 . 2008-11-07 21:41 116,224 --a------ c:\windows\system32\hnhhvkkg.dll
2008-11-06 22:53 . 2008-11-06 22:53 18,286 --a------ c:\windows\system32\jyjihobixe.db
2008-11-06 22:53 . 2008-11-06 22:53 18,033 --a------ c:\windows\system32\vidoqocek.vbs
2008-11-06 22:53 . 2008-11-06 22:53 17,764 --a------ c:\program files\Fichiers communs\zudedybi.bat
2008-11-06 22:53 . 2008-11-06 22:53 17,607 --a------ c:\windows\ytoq.ban
2008-11-06 22:53 . 2008-11-06 22:53 16,805 --a------ c:\windows\azagowow.exe
2008-11-06 22:53 . 2008-11-06 22:53 16,708 --a------ c:\windows\isyro.ban
2008-11-06 22:53 . 2008-11-06 22:53 16,319 --a------ c:\windows\system32\supedyje.db
2008-11-06 22:53 . 2008-11-06 22:53 16,003 --a------ c:\windows\cyxabivun.reg
2008-11-06 22:53 . 2008-11-06 22:53 15,913 --a------ c:\windows\system32\uxyv.sys
2008-11-06 22:53 . 2008-11-06 22:53 13,851 --a------ c:\windows\system32\ujoc.vbs
2008-11-06 22:53 . 2008-11-06 22:53 13,018 --a------ c:\windows\cakezilucu.exe
2008-11-06 22:53 . 2008-11-06 22:53 12,170 --a------ c:\windows\system32\afoqicopiq.bin
2008-11-06 22:53 . 2008-11-06 22:53 11,211 --a------ c:\documents and settings\All Users\Application Data\rufe.com
2008-11-06 22:53 . 2008-11-06 22:53 10,127 --a------ c:\documents and settings\jmi\Application Data\kuhutenuj.sys
2008-11-06 21:40 . 2008-11-06 21:40 <REP> d-------- c:\program files\Enigma Software Group
2008-11-06 21:29 . 2001-08-28 13:00 4,224 --a------ c:\windows\system32\drivers\beep.sys
2008-11-03 01:07 . 2008-11-04 00:18 <REP> d--h----- C:\$AVG8.VAULT$
2008-11-02 22:31 . 2008-11-08 12:38 <REP> d-------- c:\windows\system32\drivers\Avg
2008-11-02 22:31 . 2008-11-02 22:34 <REP> d-------- c:\documents and settings\jmi\Application Data\AVGTOOLBAR
2008-11-02 22:31 . 2008-11-08 00:21 98,440 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-02 22:31 . 2008-11-08 00:22 90,632 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-02 22:31 . 2008-11-02 22:31 12,936 --a------ c:\windows\system32\drivers\avgrkx86.sys
2008-11-02 22:31 . 2008-11-02 22:31 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-10-31 23:17 . 2008-10-31 23:21 <REP> d-------- C:\VIRUSfighter
2008-10-31 22:22 . 2008-10-31 22:26 <REP> d-------- c:\program files\Fighters
2008-10-31 22:22 . 2008-10-31 22:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Fighters
2008-10-31 21:54 . 2008-10-31 21:54 <REP> d-------- c:\program files\Kaspersky Lab
2008-10-27 22:56 . 2008-10-27 22:57 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-27 22:02 . 2008-10-27 22:02 10,752 --a------ c:\windows\system32\voecqlaa.exe
2008-10-27 20:00 . 2008-10-27 20:00 10,752 --a------ c:\windows\system32\xrctvedv.exe
2008-10-27 19:59 . 2008-10-27 21:30 344 --ahs---- c:\windows\system32\WHRsAJlm.ini
2008-10-27 19:49 . 2008-10-27 19:49 12,296 --a------ c:\windows\sukidojy.dll
2008-10-26 21:32 . 2008-10-26 21:32 19,503 --a------ c:\program files\Fichiers communs\otiqyp.vbs
2008-10-26 21:32 . 2008-10-26 21:32 18,688 --a------ c:\windows\efewicovi.exe
2008-10-26 21:32 . 2008-10-26 21:32 17,416 --a------ c:\program files\Fichiers communs\gutuxomyfu.pif
2008-10-26 21:32 . 2008-10-26 21:32 17,187 --a------ c:\windows\system32\wutuxetuh.bat
2008-10-26 21:32 . 2008-10-26 21:32 15,581 --a------ c:\windows\system32\qenisycabi.dll
2008-10-26 21:32 . 2008-10-26 21:32 14,644 --a------ c:\windows\esiniwubyt.inf
2008-10-26 21:32 . 2008-10-26 21:32 12,943 --a------ c:\windows\system32\uzamo.sys
2008-10-26 21:32 . 2008-10-26 21:32 10,930 --a------ c:\windows\system32\tajyw.dll
2008-10-26 21:32 . 2008-10-26 21:32 10,774 --a------ c:\documents and settings\All Users\Application Data\awekug.scr
2008-10-26 21:32 . 2008-10-26 21:32 10,636 --a------ c:\program files\Fichiers communs\nuxu.dll
2008-10-26 21:32 . 2008-10-26 21:32 10,398 --a------ c:\windows\ifag._sy
2008-10-26 13:56 . 2008-10-26 13:56 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2008-10-26 13:55 . 2008-10-26 13:55 2,681,969 --a------ c:\windows\Super Internet TV v7.3 Setup.exe
2008-10-26 13:55 . 2008-10-26 13:55 217,088 --a------ c:\windows\RTIfer.exe
2008-10-26 13:53 . 2008-10-26 21:13 344 --ahs---- c:\windows\system32\pqAccccf.ini
2008-10-26 13:49 . 2008-10-26 13:49 <REP> d-------- c:\program files\AVG
2008-10-26 13:49 . 2008-11-08 04:15 <REP> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-10-25 20:02 . 2008-10-25 20:02 <REP> d-------- c:\program files\FileZilla FTP Client
2008-10-25 20:02 . 2008-10-26 12:05 <REP> d-------- c:\documents and settings\jmi\Application Data\FileZilla
2008-10-25 12:47 . 2008-10-25 12:50 <REP> d-------- c:\program files\adslTV
2008-10-24 08:55 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-23 06:30 . 2007-07-19 17:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2008-10-23 06:30 . 2008-03-05 15:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll
2008-10-23 06:30 . 2007-07-19 23:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll
2008-10-23 06:30 . 2008-03-05 15:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll
2008-10-16 03:27 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-16 03:26 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 03:26 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 03:26 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 03:26 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-16 03:26 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-08 12:45 --------- d-----w c:\program files\Winamp Remote
2008-11-07 22:52 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-11-02 19:58 --------- d-----w c:\program files\Common Files
2008-10-31 22:23 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-31 22:17 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-31 21:58 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-31 21:00 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-10-28 04:11 --------- d-----w c:\program files\DAEMON Tools
2008-10-27 21:56 --------- d-----w c:\program files\Lavasoft
2008-10-27 21:56 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-10-27 21:56 --------- d-----w c:\documents and settings\jmi\Application Data\Lavasoft
2008-10-27 21:08 --------- d-----w c:\program files\TuneUp Utilities 2007
2008-10-27 20:38 --------- d-----w c:\program files\FILBANQUE
2008-10-27 20:36 --------- d-----w c:\program files\Miranda IM
2008-10-26 20:44 --------- d-----w c:\program files\Fichiers communs\Agnitum Shared
2008-10-26 20:29 --------- d-----w c:\program files\Norton Security Scan
2008-10-26 20:29 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-10-26 11:40 2,560 ----a-w c:\windows\system32\BitCometRes.dll
2008-10-21 22:27 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-16 18:30 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-03 17:57 --------- d-----w c:\program files\Fritivi
2008-09-26 15:33 15,496 ----a-w c:\windows\system32\drivers\vffilter.sys
2008-09-26 12:19 --------- d-----w c:\documents and settings\jmi\Application Data\Apple Computer
2008-09-26 11:38 --------- d-----w c:\program files\iTunes
2008-09-26 11:38 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-26 11:37 --------- d-----w c:\program files\QuickTime
2008-09-26 11:37 --------- d-----w c:\program files\iPod
2008-09-26 11:37 --------- d-----w c:\program files\Bonjour
2008-09-26 11:37 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-26 11:35 --------- d-----w c:\program files\Fichiers communs\Apple
2008-09-26 11:35 --------- d-----w c:\program files\Apple Software Update
2008-09-26 11:35 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-09-26 10:25 --------- d-----w c:\program files\Freecorder
2008-09-26 10:25 --------- d-----w c:\program files\Conduit
2008-09-26 10:16 11,264 ----a-w c:\windows\_MSRSTRT.EXE
2008-09-26 10:09 --------- d-----w c:\program files\Freecorder Toolbar
2008-09-25 17:51 --------- d-----w c:\documents and settings\jmi\Application Data\Imperium Romanum
2008-09-25 17:49 --------- d-----w c:\program files\Kalypso
2008-09-24 17:47 --------- d-----w c:\documents and settings\All Users\Application Data\Age of Empires 3 YPack Trial
2008-09-24 17:45 --------- d-----w c:\program files\Microsoft Games
2008-09-23 18:24 --------- d-----w c:\documents and settings\jmi\Application Data\vlc
2008-09-23 17:59 --------- d-----w c:\program files\MyFreeTV
2008-09-23 17:35 --------- d-----w c:\documents and settings\jmi\Application Data\dvdcss
2008-09-23 17:04 --------- d-----w c:\program files\Free Multimedia Center
2008-09-23 16:52 --------- d-----w c:\program files\FpTest
2008-09-21 06:39 --------- d-----w c:\program files\SEGA
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
2008-09-11 09:25 80,896 ----a-w c:\windows\system32\tasklist.exe
2008-09-11 07:40 --------- d-----w c:\program files\Sun
2008-09-11 07:39 --------- d-----w c:\program files\Java
2008-09-11 07:34 --------- d-----w c:\program files\foobar2000
2008-09-11 07:25 --------- d-----w c:\program files\Yahoo!
2008-09-08 13:34 --------- d-----w c:\program files\WinStars2
2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys
2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 13:23 2,191,232 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w c:\windows\system32\ntkrnlpa.exe
2006-10-09 17:47 546 -c--a-w c:\documents and settings\jmi\Application Data\wklnhst.dat
2006-09-14 19:18 94,208 ----a-w c:\documents and settings\jmi\Application Data\ezpinst.exe
2006-09-14 19:18 47,360 -c--a-w c:\documents and settings\jmi\Application Data\pcouffin.sys
2006-10-04 18:37 0 -csha-w c:\windows\SMINST\HPCD.sys
.

------- Sigcheck -------

2004-08-05 13:00 23040 a3883212b51b9947bc0c01247f26112b c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-14 03:34 23040 8ef3af3dd515bb527b795088d0b673cf c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-14 03:34 23040 2fc19b8ee3207c16be9c80d4d217b338 c:\windows\system32\svchost.exe

2008-04-14 03:34 1046528 02eb1130a84bc66a64d0951c7100d946 c:\windows\explorer.exe
2007-06-13 14:10 1046016 63ea746c60d943aeaf1c2ac946f4eafb c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 14:22 1046016 98c0af7b3a762cf5c19bc94501c440b7 c:\windows\$NtServicePackUninstall$\explorer.exe
2008-04-14 03:34 1046528 f448363d860c1e04fd0311486803d06c c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-05 13:00 24064 0522b09303c71405fa08ded8723dd291 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 03:33 24064 17884a2ee3878c0281b51e652145c53c c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 03:33 24064 7f6802dc9800e22f11a631915369ccfc c:\windows\system32\ctfmon.exe

2005-06-11 01:17 66560 6d1dc28604447bcb5e0476e662647849 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-11 00:53 66560 b28e42b27e8e3179d6b06c594bbcdb0d c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-14 03:34 66560 9f4cfbe35d4048b6dd0d12529f9ad870 c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-14 03:34 66560 0224493ecfa3a448826c5c01c9e6bd55 c:\windows\system32\spoolsv.exe

2004-08-05 13:00 33792 2c55d7151728860909e09ff4cc73875b c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-14 03:34 35328 69b6c95536aacd8681ddd95f7dd39eb4 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 03:34 35328 1b349f6195d4dfba66779538827b29a8 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 24064]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-03-25 520192]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-31 68856]
"Google Update"="c:\documents and settings\jmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-26 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 225280]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-07 356352]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 45056]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 167936]
"XCSyncML"="c:\windows\system32\XCSyncML.exe" [2005-07-14 147456]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 414720]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 421888]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 90112]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-09-26 348160]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]
"Adobe_ID0EYTHM"="c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1896448]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 102400]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 425984]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-08-30 94720]
"spywarefighterguard"="c:\program files\Fighters\spywarefighter\SpywarefighterUser.exe" [2008-09-26 180872]
"Norman ZANDA"="c:\virusfighter\bin\ZLH.EXE" [2005-05-25 147456]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-08 1235736]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-08 c:\windows\AGRSMMSG.exe]
"CHotkey"="zHotkey.exe" [2004-05-17 c:\windows\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Avsbpf"="c:\program files\Common Files\??curity\n?lookup.exe" [?]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 24064]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 38400]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 127488]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=karna.dat gurxhn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"MSACM.CEGSM"= mobilev.acm
"VIDC.CTRX"= ctrxvid.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avgfws8"=2 (0x2)
"avg8wd"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\NetMeeting\\Conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NEC\\NEC Mobile Suite\\CommsService.exe"=
"<NO NAME>"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Agnitum\\Outpost Firewall\\outpost.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9122:TCP"= 9122:TCP:BitComet 9122 TCP
"9122:UDP"= 9122:UDP:BitComet 9122 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-11-02 12936]
S0 fvdscsi;fvdscsi;c:\windows\system32\DRIVERS\fvdscsi.sys [ ]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-08 98440]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-08 90632]
S1 SandBox;Outpost Firewall Sandbox Driver;c:\program files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2006-09-26 244667]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-08 231704]
S2 DVC120;Dazzle DVC120;c:\windows\system32\Drivers\dvc120.sys [2004-03-26 31893]
S2 PTK License-FIGHTERS-297811811;PTK License-FIGHTERS-297811811;c:\program files\Fighters\licenseservice.exe [2008-09-26 283272]
S2 PTK Live Update-FIGHTERS-297811811;PTK Live Update-FIGHTERS-297811811;c:\program files\Fighters\updateservice.exe [2008-09-26 307848]
S2 PTK Scanner-FIGHTERS-297811811;PTK Scanner-FIGHTERS-297811811;c:\program files\Fighters\ScannerService.exe [2008-09-26 311944]
S2 PTK SharedAccess-FIGHTERS-297811811;PTK SharedAccess-FIGHTERS-297811811;c:\program files\Fighters\configservice.exe [2008-09-26 139912]
S2 UxTuneUp;TuneUp Extension de thème;c:\windows\System32\svchost.exe [2008-04-14 23040]
S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2006-08-30 33568]
S3 archbus;NEC WMC USB_BJ1 Composite Device driver (WDM);c:\windows\system32\DRIVERS\archbus.sys [2005-08-30 52480]
S3 archmdfl;NEC WMC USB_BJ1 Modem Filter;c:\windows\system32\DRIVERS\archmdfl.sys [2005-08-30 6032]
S3 archmdm;NEC WMC USB_BJ1 Modem Drivers;c:\windows\system32\DRIVERS\archmdm.sys [2005-08-30 87360]
S3 archobex;NEC WMC USB_BJ1 OBEX Interface Drivers (WDM);c:\windows\system32\DRIVERS\archobex.sys [2005-08-30 76976]
S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2006-08-30 17408]
S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2006-08-30 4896]
S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2006-08-30 14464]
S3 fbxusb;FreeBox USB Network Adapter;c:\windows\system32\DRIVERS\fbxusb.sys [2002-12-11 18953]
S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2006-08-30 9248]
S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2006-08-30 11552]
S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2006-08-30 13216]
S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2006-08-30 7168]
S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2006-08-30 14880]
S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2006-08-30 6752]
S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2006-08-30 10048]
S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2006-08-30 15200]
S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);c:\program files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2006-08-30 12928]
S3 SmartCd;SmartCd;c:\windows\system32\Drivers\SmartCd.sys [ ]
S3 Vfscan;Vfscan;c:\windows\system32\DRIVERS\vffilter.sys [2008-09-26 15496]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2008-10-24 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-27 06:51]

2008-11-08 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\jmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-26 09:59]

2008-10-02 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2008-01-09 04:08]

2008-11-08 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
URLSearchHooks-{bc4be15d-6a34-4356-9e97-79e43da32b1d} - (no file)
BHO-{22B801C4-C555-442D-AC65-7FA466B1578C} - c:\windows\system32\nnnkLcYp.dll
BHO-{24E0BE74-5BE5-4AD1-A5DF-671E2FC9BB19} - (no file)
BHO-{28A2911F-2741-401B-BDF0-DFB8803AC1B9} - (no file)
BHO-{4A839A1F-57D5-2C0F-8C3F-2CC00B51D0B9} - c:\windows\system32\kiu.dll
BHO-{4C168E24-CF34-411B-A0D5-B504C7607BFC} - (no file)
BHO-{578BB304-514A-4357-9E6A-F99D463A9B88} - (no file)
BHO-{6c56583e-f88c-404f-803c-8bacab9f9b2b} - c:\windows\system32\urbtbc.dll
BHO-{79117664-7A50-429C-B3AF-6CDF9E1886CE} - (no file)
BHO-{7dead720-eb7b-4fb0-b130-9c09eaa49d74} - c:\windows\system32\vpwxuk.dll
BHO-{8F80EB61-825E-40CE-BBEF-2537D5F8B300} - (no file)
BHO-{A9A221CD-4C20-4CA0-B866-0D725A3FF15A} - (no file)
BHO-{C7CD4D29-2281-4F52-A949-E0EE6DF8D2DA} - (no file)
BHO-{caee0d65-9871-4647-8189-df109b208dfd} - c:\windows\system32\gurxhn.dll
BHO-{E95D2D0E-B832-4BC9-87D7-00AA61AE69FA} - (no file)
Toolbar-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
Toolbar-{bc4be15d-6a34-4356-9e97-79e43da32b1d} - (no file)
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100429 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FREE; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ( EmbeddedWB http://bsalsa.com/); .NET CLR 1.1.4322; InfoPath.2; .NET
HKLM-Run-Antivirus Pro 2009 - c:\program files\AntivirusPro2009\AntivirusPro2009.exe
HKLM-Run-504cf7e0 - c:\windows\system32\skudkcai.dll
HKLM-Run-AntiSpywareExpert - c:\program files\AntiSpywareExpert\ase.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
HKU-Default-Run-brastk - c:\windows\system32\brastk.exe
HKU-Default-Run-GetPack23 - c:\program files\GetPack\GetPack23.exe
HKU-Default-Run-Aadr - c:\windows\PPPATC~1\svchost.exe
HKU-Default-Run-Facegame - c:\documents and settings\jmi\Application Data\Facegame\Facegame.exe
Notify-klogon - (no file)
Notify-nnnkJYpO - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = www.google.com
R1 -: HKCU-Internet Settings,ProxyOverride = <local>;*.local
O8 -: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 -: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Download all links using BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
O8 -: Download link using &BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
O8 -: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 -: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 -: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 -: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 -: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 -: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d5570c17e444408b9f382a9ed3fecdbc
O8 -: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d5570c17e444408b9f382a9ed3fecdbc
O18 -: WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
O18 -: WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {7F8C8173-AD80-4807-AA75-5672F22B4582}

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF}

O16 -: {88764F69-3831-4EC1-B40B-FF21D8381345}
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-08 14:29:57
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\docume~1\jmi\LOCALS~1\Temp\RGI1.tmp

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2008-11-08 14:33:19
ComboFix-quarantined-files.txt 2008-11-08 13:32:26

Pre-Run: 128,219,320,320 octets libres
Post-Run: 128,201,035,776 octets libres

514 --- E O F --- 2008-11-08 00:53:24

----------------- FindyKill V4.095 ------------------

* User : jmi - NOM-370AA047E0E
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 07/11/08 par Chiquitine29
* Recherche effectuée à 14:52:37 le 08/11/2008
* Windows XP - Internet Explorer 7.0.5730.11

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch


»»»» Presence des fichiers dans C:\WINDOWS\system32


»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers


»»»» Presence des fichiers dans C:\Documents and Settings\jmi\Application Data


»»»» Presence des fichiers dans C:\DOCUME~1\jmi\LOCALS~1\Temp


»»»» Presence des fichiers dans C:\Documents and Settings\jmi\Local Settings\Temporary Internet Files\Content.IE5


--------------- [ Registre / Startup ] ----------------


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
AGRSMMSG REG_SZ AGRSMMSG.exe
CHotkey REG_SZ zHotkey.exe
RemoteControl REG_SZ "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
XCSyncML REG_SZ C:\WINDOWS\system32\XCSyncML.exe
PinnacleDriverCheck REG_SZ C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
Easy-PrintToolBox REG_SZ C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
amd_dc_opt REG_SZ C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
OutpostFeedBack REG_SZ C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
Acrobat Assistant 8.0 REG_SZ "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
Adobe_ID0EYTHM REG_SZ C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
StartCCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
Outpost Firewall REG_SZ "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" /waitservice
spywarefighterguard REG_SZ C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
Norman ZANDA REG_SZ C:\VIRUSfighter\bin\ZLH.EXE /LOAD /SPLASH
AVG8_TRAY REG_SZ C:\PROGRA~1\AVG\AVG8\avgtray.exe
Antivirus Pro 2009 REG_SZ "C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe" /hide
504cf7e0 REG_SZ rundll32.exe "C:\WINDOWS\system32\skudkcai.dll",b
brastk REG_SZ brastk.exe
AntiSpywareExpert REG_SZ C:\Program Files\AntiSpywareExpert\ase.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AutorunsDisabled

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\avp6_post_uninstall

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
H/PC Connection Agent REG_SZ "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Orb REG_SZ "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Google Update REG_SZ "C:\Documents and Settings\jmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater

--------------- [ Registre / Clés infectieuses ] ----------------



--------------- [ Etat / Services ] ----------------



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 3

Ip6Fw - Type de démarrage = 3

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2



--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe

J: - Lecteur de CD-ROM

K: - Lecteur amovible


+- presence des fichiers :



--------------- [ Registre / Moutpoint2 ] ----------------

Present ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\Z\Shell\AutoRun\command


------------------- ! Fin du rapport ! --------------------

Fichier RTIfer.exe reçu le 2008.11.16 13:27:14 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 28/36 (77.78%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 3.
L'heure estimée de démarrage est entre 54 et 77 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.14.3 2008.11.15 Win32/Virut.Gen
AntiVir 7.9.0.31 2008.11.14 W32/Virut.BO
Authentium 5.1.0.4 2008.11.15 -
Avast 4.8.1281.0 2008.11.16 Win32:Virtob
AVG 8.0.0.199 2008.11.15 Win32/Virut.AE
BitDefender 7.2 2008.11.16 Trojan.Generic.984616
CAT-QuickHeal 10.00 2008.11.15 W32.Virut.AJ
ClamAV 0.94.1 2008.11.15 -
DrWeb 4.44.0.09170 2008.11.16 Win32.Virut.50
eSafe 7.0.17.0 2008.11.13 -
eTrust-Vet 31.6.6210 2008.11.14 Win32/Virut.8704
Ewido 4.0 2008.11.16 -
F-Prot 4.4.4.56 2008.11.15 -
F-Secure 8.0.14332.0 2008.11.16 Virus.Win32.Virut.bw
Fortinet 3.117.0.0 2008.11.15 W32/Virut.J
GData 19 2008.11.16 Trojan.Generic.984616
Ikarus T3.1.1.45.0 2008.11.16 Trojan.Win32.Buzus
K7AntiVirus 7.10.526 2008.11.15 Virus.Win32.Virut.bw
Kaspersky 7.0.0.125 2008.11.16 Virus.Win32.Virut.bw
McAfee 5435 2008.11.15 W32/Virut.j
Microsoft 1.4104 2008.11.16 Virus:Win32/Virut.BI
NOD32 3615 2008.11.15 Win32/Virut.NBH
Norman 5.80.02 2008.11.14 W32/Virut.BQ
Panda 9.0.0.4 2008.11.15 W32/Virutas.FG
PCTools 4.4.2.0 2008.11.15 -
Prevx1 V2 2008.11.16 -
Rising 21.03.42.00 2008.11.14 Win32.Agent.ck
SecureWeb-Gateway 6.7.6 2008.11.14 Win32.Virut.BO
Sophos 4.35.0 2008.11.16 W32/Virut-Gen
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.16 W32.Virut.W
TheHacker 6.3.1.1.155 2008.11.15 W32/Virut.gen2
TrendMicro 8.700.0.1004 2008.11.14 PE_VIRUT.AP
VBA32 3.12.8.9 2008.11.15 Trojan.Win32.Buzus.abgi
ViRobot 2008.11.15.1470 2008.11.15 Win32.Virut.AI
VirusBuster 4.5.11.0 2008.11.15 Win32.Virut.Gen.4
Information additionnelle
File size: 217088 bytes
MD5...: 852eeb3fa775af862c01a5ea83a869f1
SHA1..: 5530c34149d125aaf36aa5576bbcfa8683f1ff18
SHA256: d544ddb16a2fb2776c28f8294f6ed9f839ddbbbd7addbd89d02b5723ccf9cefe
SHA512: f9ba8b6dc89414b789e0762db39cf2b9737ba76e439a47c3064fc7f3fb84677d
4e9654ce28e92aa3fdb1602b22f97e6335ed3d4fdead5690ffd9cd2723f1abf5
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x433000
timedatestamp.....: 0x48f2a4c4 (Mon Oct 13 01:30:44 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6be4 0x7000 4.87 db404a319660a97d5d61a91cf4f1f26c
.data 0x8000 0x4f4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x9000 0x31000 0x2d000 7.85 73d14ca540f0790200ac9fd423d6ccb2

( 1 imports )
> MSVBVM60.DLL: -, -, -, -, -, -, -, -, -, DllFunctionCall, -, -, -, -, __vbaExceptHandler, -, -, -, -, ProcCallEngine, -, -, -, -, -, -, -, -, -, -, -

( 0 exports )



ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

lorsque j'ai glisse j'ai perdu COMBI FIX tu peux me le redonner

en premier temps le rapport
Fichier n__lookup.exe reçu le 2008.11.16 14:41:59 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 28/36 (77.78%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 38 et 55 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.14.3 2008.11.15 Win32/Virut.Gen
AntiVir 7.9.0.31 2008.11.14 W32/Virut.BO
Authentium 5.1.0.4 2008.11.15 -
Avast 4.8.1281.0 2008.11.16 Win32:Virtob
AVG 8.0.0.199 2008.11.15 Win32/Virut.AE
BitDefender 7.2 2008.11.16 Adware.Generic.43405
CAT-QuickHeal 10.00 2008.11.15 W32.Virut.AJ
ClamAV 0.94.1 2008.11.15 -
DrWeb 4.44.0.09170 2008.11.16 Win32.Virut.50
eSafe 7.0.17.0 2008.11.13 Suspicious File
eTrust-Vet 31.6.6210 2008.11.14 Win32/Virut.8704
Ewido 4.0 2008.11.16 -
F-Prot 4.4.4.56 2008.11.15 -
F-Secure 8.0.14332.0 2008.11.16 Virus.Win32.Virut.bw
Fortinet 3.117.0.0 2008.11.15 W32/Virut.J
GData 19 2008.11.16 Adware.Generic.43405
Ikarus T3.1.1.45.0 2008.11.16 Win32.Virut.U
K7AntiVirus 7.10.526 2008.11.15 Virus.Win32.Virut.bw
Kaspersky 7.0.0.125 2008.11.16 Virus.Win32.Virut.bw
McAfee 5435 2008.11.15 W32/Virut.j
Microsoft 1.4104 2008.11.16 Virus:Win32/Virut.BI
NOD32 3615 2008.11.15 Win32/Virut.NBH
Norman 5.80.02 2008.11.14 -
Panda 9.0.0.4 2008.11.16 W32/Virutas.FG
PCTools 4.4.2.0 2008.11.15 -
Prevx1 V2 2008.11.16 -
Rising 21.03.42.00 2008.11.14 Win32.Agent.ck
SecureWeb-Gateway 6.7.6 2008.11.16 Win32.Virut.BO
Sophos 4.35.0 2008.11.16 W32/Virut-Gen
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.16 W32.Virut.W
TheHacker 6.3.1.1.155 2008.11.15 W32/Virut.gen2
TrendMicro 8.700.0.1004 2008.11.14 PE_VIRUT.AP
VBA32 3.12.8.9 2008.11.15 AdWare.Win32.PurityScan.jw
ViRobot 2008.11.15.1470 2008.11.15 Win32.Virut.AI
VirusBuster 4.5.11.0 2008.11.15 Win32.Virut.Gen.4
Information additionnelle
File size: 242688 bytes
MD5...: a172583badb491c6fee449ea527b7800
SHA1..: fac7c8d9e8f2834a6b60c51ae11aa3a32f581af6
SHA256: e86229f0d6307e852bc0f8f900bf60399d72a3be7355401d7923bf3c0b436cf6
SHA512: 48d15bda77fad7acd721f0bcd026d47426b3e0c8262a7fbcc8f9b1bebd01fe33
584330f177839bf00cfccffd33d9a4ebe9468f96c1179e38124cbf0feac4bf40
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x49f000
timedatestamp.....: 0x48e22eec (Tue Sep 30 13:51:40 2008)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x93000 0x2de00 8.00 8b7adea5026f89278675c67c2c545c96
.rsrc 0x94000 0x12000 0xd200 4.69 ea1ab3b7225db38668a84dce83a3cdc0

( 17 imports )
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
> SHLWAPI.dll: SHGetValueW
> iphlpapi.dll: GetNetworkParams
> gdiplus.dll: GdipDisposeImage
> WININET.dll: FindFirstUrlCacheEntryA
> USER32.dll: ClientToScreen
> GDI32.dll: PtVisible
> comdlg32.dll: GetOpenFileNameA
> WINSPOOL.DRV: OpenPrinterA
> ADVAPI32.dll: SetSecurityDescriptorDacl
> SHELL32.dll: SHAppBarMessage
> COMCTL32.dll: -
> oledlg.dll: -
> ole32.dll: OleFlushClipboard
> OLEPRO32.DLL: -
> OLEAUT32.dll: -
> urlmon.dll: URLDownloadToFileA

( 0 exports )

j'avais lance combofix voici le rapport spybot etait ouvert
ComboFix 08-11-14.01 - jmi 2008-11-16 14:53:59.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.482 [GMT 1:00]
Running from: c:\documents and settings\jmi\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

[COLOR=RED] c:\windows\system32\userinit.exe . . . is infected!!/COLOR

[COLOR=RED] c:\windows\system32\svchost.exe . . . is infected!!/COLOR

[COLOR=RED] c:\windows\system32\spoolsv.exe . . . is infected!!/COLOR

[COLOR=RED] c:\windows\explorer.exe . . . is infected!!/COLOR

.
((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.

2063-09-19 06:50 . 2063-09-19 06:50 5,501 --a------ c:\windows\system32\rtclmg32.dll
2008-11-16 14:01 . 2008-11-16 14:02 1,393 --a------ c:\windows\imsins.BAK
2008-11-16 13:29 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-16 13:29 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-15 14:03 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
2008-11-15 14:03 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
2008-11-15 14:03 . 2008-10-01 14:51 98,816 --a------ c:\windows\system32\VACFix.exe
2008-11-15 14:03 . 2008-10-10 07:58 94,208 --a------ c:\windows\system32\o4Patch.exe
2008-11-15 14:03 . 2008-05-18 20:40 94,208 --a------ c:\windows\system32\IEDFix.exe
2008-11-15 14:03 . 2008-10-10 07:58 94,208 --a------ c:\windows\system32\IEDFix.C.exe
2008-11-15 14:03 . 2008-08-18 11:19 93,696 --a------ c:\windows\system32\404Fix.exe
2008-11-15 14:03 . 2003-06-05 20:13 65,536 --a------ c:\windows\system32\Process.exe
2008-11-15 14:03 . 2004-07-31 17:50 59,904 --a------ c:\windows\system32\dumphive.exe
2008-11-15 14:03 . 2007-10-03 23:36 37,888 --a------ c:\windows\system32\WS2Fix.exe
2008-11-08 15:36 . 2008-11-08 15:36 <REP> d-------- c:\program files\UsbFix
2008-11-08 14:47 . 2008-11-08 15:22 <REP> d-------- c:\program files\FindyKill
2008-11-08 13:31 . 2008-11-08 15:13 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-08 13:31 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-08 13:31 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-08 10:00 . 2008-11-08 10:00 <REP> d-------- c:\program files\Trend Micro
2008-11-08 03:14 . 2008-11-08 03:14 <REP> d-------- c:\documents and settings\jmi\Application Data\Malwarebytes
2008-11-08 02:43 . 2008-11-08 03:06 <REP> d-------- c:\program files\Navilog1
2008-11-08 01:51 . 2008-11-08 01:51 0 --------- c:\windows\system32\HFXA.tmp
2008-11-08 00:56 . 2008-11-08 00:56 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-07 23:26 . 2008-11-08 13:10 4,444 --a------ c:\windows\system32\tmp.reg
2008-11-07 21:41 . 2008-11-07 21:41 116,224 --a------ c:\windows\system32\hnhhvkkg.dll
2008-11-06 22:53 . 2008-11-06 22:53 18,286 --a------ c:\windows\system32\jyjihobixe.db
2008-11-06 22:53 . 2008-11-06 22:53 18,033 --a------ c:\windows\system32\vidoqocek.vbs
2008-11-06 22:53 . 2008-11-06 22:53 17,764 --a------ c:\program files\Fichiers communs\zudedybi.bat
2008-11-06 22:53 . 2008-11-06 22:53 17,607 --a------ c:\windows\ytoq.ban
2008-11-06 22:53 . 2008-11-06 22:53 16,805 --a------ c:\windows\azagowow.exe
2008-11-06 22:53 . 2008-11-06 22:53 16,708 --a------ c:\windows\isyro.ban
2008-11-06 22:53 . 2008-11-06 22:53 16,319 --a------ c:\windows\system32\supedyje.db
2008-11-06 22:53 . 2008-11-06 22:53 16,003 --a------ c:\windows\cyxabivun.reg
2008-11-06 22:53 . 2008-11-06 22:53 15,913 --a------ c:\windows\system32\uxyv.sys
2008-11-06 22:53 . 2008-11-06 22:53 13,851 --a------ c:\windows\system32\ujoc.vbs
2008-11-06 22:53 . 2008-11-06 22:53 13,018 --a------ c:\windows\cakezilucu.exe
2008-11-06 22:53 . 2008-11-06 22:53 12,170 --a------ c:\windows\system32\afoqicopiq.bin
2008-11-06 22:53 . 2008-11-06 22:53 11,211 --a------ c:\documents and settings\All Users\Application Data\rufe.com
2008-11-06 22:53 . 2008-11-06 22:53 10,127 --a------ c:\documents and settings\jmi\Application Data\kuhutenuj.sys
2008-11-06 21:40 . 2008-11-06 21:40 <REP> d-------- c:\program files\Enigma Software Group
2008-11-06 21:29 . 2001-08-28 13:00 4,224 --a------ c:\windows\system32\drivers\beep.sys
2008-11-03 01:07 . 2008-11-04 00:18 <REP> d--h----- C:\$AVG8.VAULT$
2008-11-02 21:50 . 2008-11-02 21:50 <REP> d-------- c:\windows\system32\config\systemprofile\Application Data\Facegame
2008-10-31 23:17 . 2008-10-31 23:21 <REP> d-------- C:\VIRUSfighter
2008-10-31 22:22 . 2008-10-31 22:26 <REP> d-------- c:\program files\Fighters
2008-10-31 22:22 . 2008-10-31 22:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Fighters
2008-10-31 21:54 . 2008-10-31 21:54 <REP> d-------- c:\program files\Kaspersky Lab
2008-10-27 22:56 . 2008-10-27 22:57 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-27 22:02 . 2008-10-27 22:02 10,752 --a------ c:\windows\system32\voecqlaa.exe
2008-10-27 20:00 . 2008-10-27 20:00 10,752 --a------ c:\windows\system32\xrctvedv.exe
2008-10-27 19:59 . 2008-10-27 21:30 344 --ahs---- c:\windows\system32\WHRsAJlm.ini
2008-10-27 19:49 . 2008-10-27 19:49 12,296 --a------ c:\windows\sukidojy.dll
2008-10-26 21:32 . 2008-10-26 21:32 19,503 --a------ c:\program files\Fichiers communs\otiqyp.vbs
2008-10-26 21:32 . 2008-10-26 21:32 18,688 --a------ c:\windows\efewicovi.exe
2008-10-26 21:32 . 2008-10-26 21:32 17,416 --a------ c:\program files\Fichiers communs\gutuxomyfu.pif
2008-10-26 21:32 . 2008-10-26 21:32 17,187 --a------ c:\windows\system32\wutuxetuh.bat
2008-10-26 21:32 . 2008-10-26 21:32 15,581 --a------ c:\windows\system32\qenisycabi.dll
2008-10-26 21:32 . 2008-10-26 21:32 14,644 --a------ c:\windows\esiniwubyt.inf
2008-10-26 21:32 . 2008-10-26 21:32 12,943 --a------ c:\windows\system32\uzamo.sys
2008-10-26 21:32 . 2008-10-26 21:32 10,930 --a------ c:\windows\system32\tajyw.dll
2008-10-26 21:32 . 2008-10-26 21:32 10,774 --a------ c:\documents and settings\All Users\Application Data\awekug.scr
2008-10-26 21:32 . 2008-10-26 21:32 10,636 --a------ c:\program files\Fichiers communs\nuxu.dll
2008-10-26 21:32 . 2008-10-26 21:32 10,398 --a------ c:\windows\ifag._sy
2008-10-26 13:56 . 2008-10-26 13:56 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2008-10-26 13:55 . 2008-10-26 13:55 2,681,969 --a------ c:\windows\Super Internet TV v7.3 Setup.exe
2008-10-26 13:53 . 2008-10-26 21:13 344 --ahs---- c:\windows\system32\pqAccccf.ini
2008-10-26 13:49 . 2008-10-26 13:49 <REP> d-------- c:\program files\AVG
2008-10-26 13:49 . 2008-11-15 13:56 <REP> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-10-25 20:02 . 2008-10-25 20:02 <REP> d-------- c:\program files\FileZilla FTP Client
2008-10-25 20:02 . 2008-10-26 12:05 <REP> d-------- c:\documents and settings\jmi\Application Data\FileZilla
2008-10-25 12:47 . 2008-10-25 12:50 <REP> d-------- c:\program files\adslTV
2008-10-24 08:55 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-23 06:30 . 2007-07-19 17:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2008-10-23 06:30 . 2008-03-05 15:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll
2008-10-23 06:30 . 2007-07-19 23:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll
2008-10-23 06:30 . 2008-03-05 15:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll
2008-10-16 03:27 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-16 03:26 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 03:26 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 03:26 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 03:26 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-16 03:26 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 13:54 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-11-16 13:07 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-15 12:59 --------- d-----w c:\program files\Winamp Remote
2008-11-02 19:58 --------- d-----w c:\program files\Common Files
2008-10-31 22:23 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-31 22:17 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-31 21:58 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-31 21:00 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-10-28 04:11 --------- d-----w c:\program files\DAEMON Tools
2008-10-27 21:56 --------- d-----w c:\program files\Lavasoft
2008-10-27 21:56 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-10-27 21:56 --------- d-----w c:\documents and settings\jmi\Application Data\Lavasoft
2008-10-27 21:08 --------- d-----w c:\program files\TuneUp Utilities 2007
2008-10-27 20:38 --------- d-----w c:\program files\FILBANQUE
2008-10-27 20:36 --------- d-----w c:\program files\Miranda IM
2008-10-26 20:44 --------- d-----w c:\program files\Fichiers communs\Agnitum Shared
2008-10-26 20:29 --------- d-----w c:\program files\Norton Security Scan
2008-10-26 20:29 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-10-26 11:40 2,560 ----a-w c:\windows\system32\BitCometRes.dll
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-21 22:27 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-03 17:57 --------- d-----w c:\program files\Fritivi
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-26 15:33 15,496 ----a-w c:\windows\system32\drivers\vffilter.sys
2008-09-26 12:19 --------- d-----w c:\documents and settings\jmi\Application Data\Apple Computer
2008-09-26 11:38 --------- d-----w c:\program files\iTunes
2008-09-26 11:38 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-26 11:37 --------- d-----w c:\program files\QuickTime
2008-09-26 11:37 --------- d-----w c:\program files\iPod
2008-09-26 11:37 --------- d-----w c:\program files\Bonjour
2008-09-26 11:37 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-26 11:35 --------- d-----w c:\program files\Fichiers communs\Apple
2008-09-26 11:35 --------- d-----w c:\program files\Apple Software Update
2008-09-26 11:35 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-09-26 10:25 --------- d-----w c:\program files\Freecorder
2008-09-26 10:25 --------- d-----w c:\program files\Conduit
2008-09-26 10:16 11,264 ----a-w c:\windows\_MSRSTRT.EXE
2008-09-26 10:09 --------- d-----w c:\program files\Freecorder Toolbar
2008-09-25 17:51 --------- d-----w c:\documents and settings\jmi\Application Data\Imperium Romanum
2008-09-25 17:49 --------- d-----w c:\program files\Kalypso
2008-09-24 17:47 --------- d-----w c:\documents and settings\All Users\Application Data\Age of Empires 3 YPack Trial
2008-09-24 17:45 --------- d-----w c:\program files\Microsoft Games
2008-09-23 18:24 --------- d-----w c:\documents and settings\jmi\Application Data\vlc
2008-09-23 17:59 --------- d-----w c:\program files\MyFreeTV
2008-09-23 17:35 --------- d-----w c:\documents and settings\jmi\Application Data\dvdcss
2008-09-23 17:04 --------- d-----w c:\program files\Free Multimedia Center
2008-09-23 16:52 --------- d-----w c:\program files\FpTest
2008-09-21 06:39 --------- d-----w c:\program files\SEGA
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
2008-09-11 09:25 80,896 ----a-w c:\windows\system32\tasklist.exe
2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-04 17:16 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
2006-10-09 17:47 546 -c--a-w c:\documents and settings\jmi\Application Data\wklnhst.dat
2006-09-14 19:18 94,208 ----a-w c:\documents and settings\jmi\Application Data\ezpinst.exe
2006-09-14 19:18 47,360 -c--a-w c:\documents and settings\jmi\Application Data\pcouffin.sys
2006-10-04 18:37 0 -csha-w c:\windows\SMINST\HPCD.sys
.

------- Sigcheck -------

2004-08-05 13:00 23040 a3883212b51b9947bc0c01247f26112b c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-14 03:34 23040 8ef3af3dd515bb527b795088d0b673cf c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-14 03:34 23040 2fc19b8ee3207c16be9c80d4d217b338 c:\windows\system32\svchost.exe

2008-04-14 03:34 1046528 02eb1130a84bc66a64d0951c7100d946 c:\windows\explorer.exe
2007-06-13 14:10 1046016 63ea746c60d943aeaf1c2ac946f4eafb c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 14:22 1046016 98c0af7b3a762cf5c19bc94501c440b7 c:\windows\$NtServicePackUninstall$\explorer.exe
2008-04-14 03:34 1046528 f448363d860c1e04fd0311486803d06c c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-05 13:00 24064 0522b09303c71405fa08ded8723dd291 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 03:33 24064 17884a2ee3878c0281b51e652145c53c c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 03:33 24064 7f6802dc9800e22f11a631915369ccfc c:\windows\system32\ctfmon.exe

2005-06-11 01:17 66560 6d1dc28604447bcb5e0476e662647849 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-11 00:53 66560 b28e42b27e8e3179d6b06c594bbcdb0d c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-14 03:34 66560 9f4cfbe35d4048b6dd0d12529f9ad870 c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-14 03:34 66560 0224493ecfa3a448826c5c01c9e6bd55 c:\windows\system32\spoolsv.exe

2004-08-05 13:00 33792 2c55d7151728860909e09ff4cc73875b c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-14 03:34 35328 69b6c95536aacd8681ddd95f7dd39eb4 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 03:34 35328 1b349f6195d4dfba66779538827b29a8 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 24064]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-03-25 520192]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-31 68856]
"Google Update"="c:\documents and settings\jmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-26 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 225280]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-07 356352]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 45056]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 167936]
"XCSyncML"="c:\windows\system32\XCSyncML.exe" [2005-07-14 147456]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 414720]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 421888]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 90112]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2006-09-26 348160]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]
"Adobe_ID0EYTHM"="c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1896448]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 102400]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 425984]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"Outpost Firewall"="c:\program files\Agnitum\Outpost Firewall\outpost.exe" [2006-08-30 94720]
"spywarefighterguard"="c:\program files\Fighters\spywarefighter\SpywarefighterUser.exe" [2008-09-26 180872]
"Norman ZANDA"="c:\virusfighter\bin\ZLH.EXE" [2005-05-25 147456]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-08 c:\windows\AGRSMMSG.exe]
"CHotkey"="zHotkey.exe" [2004-05-17 c:\windows\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Avsbpf"="c:\program files\Common Files\??curity\n?lookup.exe" [?]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 24064]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 38400]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 127488]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=karna.dat gurxhn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"MSACM.CEGSM"= mobilev.acm
"VIDC.CTRX"= ctrxvid.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avgfws8"=2 (0x2)
"avg8wd"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\NetMeeting\\Conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NEC\\NEC Mobile Suite\\CommsService.exe"=
"<NO NAME>"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Agnitum\\Outpost Firewall\\outpost.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9122:TCP"= 9122:TCP:BitComet 9122 TCP
"9122:UDP"= 9122:UDP:BitComet 9122 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SandBox;Outpost Firewall Sandbox Driver;\??\c:\program files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2007-03-11 244667]
R2 PTK License-FIGHTERS-297811811;PTK License-FIGHTERS-297811811;c:\program files\Fighters\licenseservice.exe [2008-09-26 283272]
R2 PTK Live Update-FIGHTERS-297811811;PTK Live Update-FIGHTERS-297811811;c:\program files\Fighters\updateservice.exe [2008-09-26 307848]
R2 PTK Scanner-FIGHTERS-297811811;PTK Scanner-FIGHTERS-297811811;c:\program files\Fighters\ScannerService.exe [2008-09-26 311944]
R2 PTK SharedAccess-FIGHTERS-297811811;PTK SharedAccess-FIGHTERS-297811811;c:\program files\Fighters\configservice.exe [2008-09-26 139912]
R2 UxTuneUp;TuneUp Extension de thème;c:\windows\System32\svchost.exe -k netsvcs [2005-07-10 23040]
R3 Vfscan;Vfscan;c:\windows\system32\DRIVERS\vffilter.sys [2008-09-26 15496]
S0 fvdscsi;fvdscsi;c:\windows\system32\DRIVERS\fvdscsi.sys []
S2 DVC120;Dazzle DVC120;c:\windows\system32\Drivers\dvc120.sys [2006-01-29 31893]
S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2007-03-11 33568]
S3 archbus;NEC WMC USB_BJ1 Composite Device driver (WDM);c:\windows\system32\DRIVERS\archbus.sys [2005-12-14 52480]
S3 archmdfl;NEC WMC USB_BJ1 Modem Filter;c:\windows\system32\DRIVERS\archmdfl.sys [2005-12-14 6032]
S3 archmdm;NEC WMC USB_BJ1 Modem Drivers;c:\windows\system32\DRIVERS\archmdm.sys [2005-12-14 87360]
S3 archobex;NEC WMC USB_BJ1 OBEX Interface Drivers (WDM);c:\windows\system32\DRIVERS\archobex.sys [2005-12-14 76976]
S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2007-03-11 17408]
S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2007-03-11 4896]
S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2007-03-11 14464]
S3 fbxusb;FreeBox USB Network Adapter;c:\windows\system32\DRIVERS\fbxusb.sys [2002-12-11 18953]
S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2007-03-11 9248]
S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2007-03-11 11552]
S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2007-03-11 13216]
S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2007-03-11 7168]
S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2007-03-11 14880]
S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2007-03-11 6752]
S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2007-03-11 10048]
S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2007-03-11 15200]
S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);\??\c:\program files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2007-03-11 12928]
S3 SmartCd;SmartCd;c:\windows\system32\Drivers\SmartCd.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2008-10-24 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-27 06:51]

2008-11-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\jmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-26 09:59]

2008-10-02 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2008-01-09 04:08]

2008-11-16 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
URLSearchHooks-{bc4be15d-6a34-4356-9e97-79e43da32b1d} - (no file)
BHO-{22B801C4-C555-442D-AC65-7FA466B1578C} - (no file)
BHO-{24E0BE74-5BE5-4AD1-A5DF-671E2FC9BB19} - (no file)
BHO-{28A2911F-2741-401B-BDF0-DFB8803AC1B9} - (no file)
BHO-{4A839A1F-57D5-2C0F-8C3F-2CC00B51D0B9} - (no file)
BHO-{4C168E24-CF34-411B-A0D5-B504C7607BFC} - (no file)
BHO-{578BB304-514A-4357-9E6A-F99D463A9B88} - (no file)
BHO-{6c56583e-f88c-404f-803c-8bacab9f9b2b} - (no file)
BHO-{79117664-7A50-429C-B3AF-6CDF9E1886CE} - (no file)
BHO-{7dead720-eb7b-4fb0-b130-9c09eaa49d74} - (no file)
BHO-{8F80EB61-825E-40CE-BBEF-2537D5F8B300} - (no file)
BHO-{A9A221CD-4C20-4CA0-B866-0D725A3FF15A} - (no file)
BHO-{C7CD4D29-2281-4F52-A949-E0EE6DF8D2DA} - (no file)
BHO-{caee0d65-9871-4647-8189-df109b208dfd} - (no file)
BHO-{E95D2D0E-B832-4BC9-87D7-00AA61AE69FA} - (no file)
Toolbar-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
Toolbar-{bc4be15d-6a34-4356-9e97-79e43da32b1d} - (no file)
HKLM-Run-Antivirus Pro 2009 - c:\program files\AntivirusPro2009\AntivirusPro2009.exe
HKLM-Run-504cf7e0 - c:\windows\system32\skudkcai.dll
HKLM-Run-AntiSpywareExpert - c:\program files\AntiSpywareExpert\ase.exe
Notify-klogon - (no file)
Notify-nnnkJYpO - (no file)


.
------- Supplementary Scan -------
.
uStart Page = www.google.com
uInternet Settings,ProxyOverride = <local>;*.local
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Download all links using BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download link using &BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d5570c17e444408b9f382a9ed3fecdbc
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d5570c17e444408b9f382a9ed3fecdbc
WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {7F8C8173-AD80-4807-AA75-5672F22B4582}

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF}

O16 -: {88764F69-3831-4EC1-B40B-FF21D8381345}
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 15:00:26
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-16 15:02:15
ComboFix-quarantined-files.txt 2008-11-16 14:01:36
ComboFix2.txt 2008-11-08 13:33:20

Pre-Run: 128 145 264 640 octets libres
Post-Run: 128,159,248,384 octets libres

385 --- E O F --- 2008-11-16 13:07:01

je n'ai pas ligne 04 ... dans HIJAK

puis je te contacter j'ai du mal as uivre entre mpn pc boulot et celui infecte

Merci par avance