Infection par rootkit-gen

Bonsoir Jacques et merci pour ta réponse rapide

voici le rapport généré

SmitFraudFix v2.385

Rapport fait à 23:17:04,25, 14/12/2008
Executé à partir de C:\Documents and Settings\Propri‚taire\Bureau\nettoyage_pc\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

C:\WINDOWS\system\svchost.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire\Application Data

C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 360.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\A360\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://membres.lycos.fr/cimetierehorreur/carrie/0.jpg"
"SubscribedURL"="http://membres.lycos.fr/cimetierehorreur/carrie/0.jpg"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="wepvgd.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

j'attends tes instructions,
Cordialement

Jondy Medjouri

bonjour Jacques,

Voici le rapport après nettoyage

SmitFraudFix v2.385

Rapport fait à 15:15:06,04, 15/12/2008
Executé à partir de C:\Documents and Settings\Propri‚taire\Bureau\nettoyage_pc\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost



»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Je vais mainteant passer à Malwarebytes

Pas trop fatigué j'espère,
Bonne après midi et j'attends tes instructions

Cordialement,
Jondy Medjouri

bonsoir jacques,

voici le rapport après nettoyage avec SDfix



[b]SDFix: Version 1.240 [/b]
Run by Propri‚taire on 16/12/2008 at 17:07

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\ADWARE.EXE - Deleted
C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\TMPB.tmp - Deleted
C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\TMPF.tmp - Deleted
C:\adware.exe - Deleted
C:\WINDOWS\system\d - Deleted





Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 17:17:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\WINDOWS\\system32\\spools.exe"="C:\\WINDOWS\\system32\\spools.exe:*:Enabled:Managing Services"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sat 11 Jun 2005 196 A.SHR --- "C:\BOOT.BAK"
Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Fri 3 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\a0011.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\a0012.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\a0013.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\FOR3B.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\FOR3D.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\FOR3F.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\FOR41.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\FOR43.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\FOR45.tmp"
Sat 16 Apr 2005 22,608 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\ZTR3A.tmp"
Sat 16 Apr 2005 13,744 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\ZTR3C.tmp"
Sat 16 Apr 2005 19,272 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\ZTR3E.tmp"
Sat 16 Apr 2005 4,992 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\ZTR40.tmp"
Sat 16 Apr 2005 11,860 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\ZTR42.tmp"
Sat 16 Apr 2005 5,880 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\ZTR44.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\a0011.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\a0012.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\a0013.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\FOR3B.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\FOR3D.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\FOR3F.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\FOR41.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\FOR43.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\FOR45.tmp"
Sat 16 Apr 2005 22,608 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\ZTR3A.tmp"
Sat 16 Apr 2005 13,744 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\ZTR3C.tmp"
Sat 16 Apr 2005 19,272 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\ZTR3E.tmp"
Sat 16 Apr 2005 4,992 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\ZTR40.tmp"
Sat 16 Apr 2005 11,860 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\ZTR42.tmp"
Sat 16 Apr 2005 5,880 A..H. --- "C:\Documents and Settings\Default User\Local Settings\Temp\ZTR44.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1a79d286b69e512b23d951bb64a72265\BIT25.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\299d8333b0b5f75c41264b2d951282b6\BIT2A.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2f92d48fd4dd6c3e29f57417ec6cf1d9\BIT30.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3122aad9cdf04a0b04178159cb27b809\BIT2C.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\37cc3320d848589a26c262a19e379099\BIT34.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\396049922280871121dbde1adcfa780a\BIT35.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\652b09610a9a6bd22b6ad2a142256bc6\BIT32.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\870d6779549b04d883b960d23ee70cec\BIT37.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8c581c8fec97076352bfe9cacef351a4\BIT2B.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8cd85f12420c94f4e35f4e73c4f6941c\BIT39.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\987c3b688890de8e02e30776ca6934c0\BIT2E.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9b0f9ae87ca3aec341fe4670654daf22\BIT2F.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9de4903f01b4008e08b567e41ba8107e\BIT31.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a839252010b2a3660b4ca84580ecd8c3\BIT38.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ac5815fa510f50193f327ee29d539b6c\BIT26.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\adfeed9c54076be35af21edea11595cd\BIT29.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cf01d7b1921ef7d671a5d462dc6dd9f3\BIT27.tmp"
Tue 16 Dec 2008 5,687,304 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\deb185b7c3743a27be869545db996079\BIT24.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ef3ec9e913ae29480457dbf484419923\BIT33.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fc379404d05b26b2f6ffb6c71844aaf2\BIT36.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fc44aea4cbcccddf2d546590bca3caf7\BIT2D.tmp"
Tue 16 Dec 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fcf5cd6cb2fc221b406515dd1d2eb26b\BIT28.tmp"
Fri 18 Jul 2008 20,752 A..H. --- "C:\Documents and Settings\Propri‚taire\Local Settings\Temp\100000010000b7ae760032\IPCONFIG.exe"
Fri 3 Nov 2006 4,348 ...H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Fri 3 Nov 2006 20 A..H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 3 Nov 2006 400 ...H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Fri 3 Nov 2006 1,536 A..H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"
Fri 5 May 2006 6,838 A..H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Office\Shortcut Bar\Off27.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\a0011.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\a0012.tmp"
Sat 4 Jun 2005 1,351,680 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\a0013.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\FOR3B.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\FOR3D.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\FOR3F.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\FOR41.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\FOR43.tmp"
Sat 16 Apr 2005 1,409 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\FOR45.tmp"
Sat 16 Apr 2005 22,608 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ZTR3A.tmp"
Sat 16 Apr 2005 13,744 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ZTR3C.tmp"
Sat 16 Apr 2005 19,272 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ZTR3E.tmp"
Sat 16 Apr 2005 4,992 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ZTR40.tmp"
Sat 16 Apr 2005 11,860 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ZTR42.tmp"
Sat 16 Apr 2005 5,880 A..H. --- "C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ZTR44.tmp"

[b]Finished![/b]

j'attends tes instructions

cordialement,
jondy medjouri

bonsoir Jacques
ci-dessous rapport malwarebytes
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1501
Windows 5.1.2600 Service Pack 2

15/12/2008 18:55:24
mbam-log-2008-12-15 (18-55-23).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 178713
Temps écoulé: 1 hour(s), 55 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 15
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 5
Fichier(s) infecté(s): 45

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\wepvgd.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5d0e435a-331f-47ed-837f-4f9e4e271227} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5d0e435a-331f-47ed-837f-4f9e4e271227} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gebqoevl (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5d0e435a-331f-47ed-837f-4f9e4e271227} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\206e51ee (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Service (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Process (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDLL (tmp.exe) (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mmsass (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\mmsass (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Network Firewall (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nl2plwrk (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nl2plwrk (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winamp agent (Backdoor.Bot) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\ErrorKiller (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\WINDOWS\system\download (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Menu Démarrer\Antivirus 360 (Rogue.A360Antivirus) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\wepvgd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\geBqOEVL.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xcaqtphr.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rhptqacx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temp\IXP001.TMP\burimi.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP840\A0253131.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP840\A0253132.exe (Trojan.SpamBot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP840\A0253152.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP840\A0253176.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP840\A0253191.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP840\A0253215.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP841\A0253221.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D2B56700-B650-4C30-8071-D5EC1FCE58BB}\RP842\A0255248.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\afwodnls.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtqRjii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\biwlhepe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\byXQHXnm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbXNHYoO.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcCUomj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGvvvuv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGYSIAQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\icycwq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfFYPFX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljJCsttq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMggdba.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvUljKcc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyxVoLb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yaywuvWM.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\ErrorKiller.exe (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Errors.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Results.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2006_11_20_08_33_47.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2006_11_20_08_33_48.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2006-11-20_08-48-43.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Menu Démarrer\Antivirus 360\Antivirus 360.lnk (Rogue.A360Antivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Menu Démarrer\Antivirus 360\Help.lnk (Rogue.A360Antivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Menu Démarrer\Antivirus 360\Registration.lnk (Rogue.A360Antivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mldmm.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\waxx.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\fxstaller.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system\mirc.ini (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svscs.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winamp.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Bureau\Antivirus 360.lnk (Rogue.A360Antivirus) -> Quarantined and deleted successfully.


Je poste à suivre le rapport hijackthis

merci et bonne soirée

Jondy

re moi avec le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:15, on 15/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Trust_CR-1200_16-in-1_USB2_CARD_READER\shwicon2k.exe
C:\Program Files\DS-3200 Wireless Optical Slimline Deskset\MouseDrv.exe
C:\Program Files\DS-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe
C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe
C:\Program Files\Mouse Driver\StartAutorun.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Mouse Driver\KMConfig.exe
C:\Program Files\Mouse Driver\KMWDSrv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Mouse Driver\KMProcess.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://fr10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {409284C8-531D-4D5D-A531-AA730FA3A36D} - C:\WINDOWS\system32\vtUkLDtS.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {BBC50877-1BA2-4415-A22D-ED65DFC438F2} - C:\WINDOWS\system32\geBuuuVO.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Trust_CR-1200_16-in-1_USB2_CARD_READER\shwicon2k.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WireLessMouse] C:\Program Files\DS-3200 Wireless Optical Slimline Deskset\MouseDrv.exe
O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\DS-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\system32\logon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_S109.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - S-1-5-18 Startup: Watch.lnk = C:\WINDOWS\twain_32\A4S2600X\WATCH.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Watch.lnk = C:\WINDOWS\twain_32\A4S2600X\WATCH.exe (User 'Default user')
O4 - .DEFAULT User Startup: Watch.lnk = C:\WINDOWS\twain_32\A4S2600X\WATCH.exe (User 'Default user')
O4 - Startup: Registration .LNK = C:\Program Files\Ubisoft\Dark Messiah of Might and Magic\RegistrationReminder.exe
O4 - Startup: Registration Heroes of Might & Magic 5.LNK = C:\Program Files\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wepvgd.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Mouse Driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe