Win32:Adware-gen [Adw]

bon voila j'ai fais le test combofix... kevin05 lache l'affaire, vous disputez pas pr rien, ca fera pas avancer les choses: j'suis sur que t'es plein de ne volonté mais je vais écouter boulepate62.....

ComboFix 08-12-15.08 - Xx......mAx......xX 2008-12-16 20:25:59.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.1919.1070 [GMT 1:00]
Lancé depuis: c:\downloads\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~2\Microsoft\Network\Downloader\qmgr0.dat
c:\progra~2\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\awtqqpOE.dll
c:\windows\system32\badMonmp.ini
c:\windows\system32\badMonmp.ini2
c:\windows\system32\byXPGYSI.dll
c:\windows\system32\CLUDLkkj.ini
c:\windows\system32\CLUDLkkj.ini2
c:\windows\system32\fcccbaAT.dll
c:\windows\system32\fccccDtq.dll
c:\windows\system32\ffflgmjl.ini
c:\windows\system32\geBrsSJa.dll
c:\windows\system32\geBuUlKE.dll
c:\windows\system32\hgGwUkJD.dll
c:\windows\system32\jkkLDULC.dll
c:\windows\system32\mlJDvUkH.dll
c:\windows\system32\pmnmmJaX.dll
c:\windows\system32\pmnmnKDS.dll
c:\windows\system32\pmnnKETk.dll
c:\windows\system32\pmnoMdab.dll
c:\windows\system32\qngqodig.ini
c:\windows\system32\qoMdEVnN.dll
c:\windows\system32\qoMgddAR.dll
c:\windows\system32\rqRHyaYS.dll
c:\windows\system32\rqRLcYPJ.dll
c:\windows\system32\ssqNDuUM.dll
c:\windows\system32\ssqPgGWQ.dll
c:\windows\system32\tuvUMeFx.dll
c:\windows\system32\wvUkKdec.dll
c:\windows\system32\xxyxWOhF.dll
c:\windows\system32\ygknyvkk.ini

----- BITS: Il y a peut-être des sites infectés -----

hxxp://childhe.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
.

2008-12-16 20:20 . 2008-12-16 20:21 <REP> d-------- C:\ToolBar SD
2008-12-15 21:42 . 51,792 c:\windows\System32\drivers\SET24FE.tmp
2008-12-15 21:42 . 2008-11-26 18:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
2008-12-15 17:56 . 2008-12-15 17:56 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-12-15 17:56 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-12-15 17:56 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\program files\iTunes
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\iPod
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\Bonjour
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\users\All Users\Apple Computer
2008-12-15 17:53 . 2008-12-15 17:54 <REP> d-------- c:\program files\QuickTime
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\progra~2\Apple Computer
2008-12-15 17:52 . 2008-12-15 17:52 <REP> d-------- c:\program files\Apple Software Update
2008-12-15 17:50 . 2008-12-15 17:55 <REP> d-------- c:\program files\Common Files\Apple
2008-12-14 13:05 . 2008-12-15 19:00 1,025 --a------ C:\noi.MSNFix
2008-12-13 20:48 . 2008-12-13 01:16 52,786 --a------ c:\windows\fxstaller.MSNFix
2008-12-12 03:03 . 2008-10-22 00:31 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-11 03:08 . 2008-11-01 00:38 4,247,552 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-11 03:08 . 2008-11-01 04:33 1,687,040 --a------ c:\windows\System32\gameux.dll
2008-12-11 03:08 . 2008-10-21 06:16 297,472 --a------ c:\windows\System32\gdi32.dll
2008-12-11 03:08 . 2008-11-01 04:33 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2008-12-11 03:07 . 2008-10-29 07:20 2,923,520 --a------ c:\windows\explorer.exe
2008-12-11 03:06 . 2008-06-23 02:52 2,855,424 --a------ c:\windows\System32\mf.dll
2008-12-11 03:06 . 2008-06-23 02:52 996,352 --a------ c:\windows\System32\WMNetMgr.dll
2008-12-11 03:06 . 2008-06-23 02:52 98,816 --a------ c:\windows\System32\mfps.dll
2008-12-11 03:06 . 2008-06-23 02:52 94,720 --a------ c:\windows\System32\logagent.exe
2008-12-11 03:06 . 2008-06-23 02:52 52,736 --a------ c:\windows\System32\rrinstaller.exe
2008-12-11 03:06 . 2008-06-23 02:52 24,576 --a------ c:\windows\System32\mfpmp.exe
2008-12-11 03:06 . 2008-06-22 23:34 2,048 --a------ c:\windows\System32\mferror.dll
2008-12-07 15:06 . 2008-12-07 15:06 <REP> d-------- c:\users\XXMAX~1.XX\AppData\Roaming\gtopala
2008-11-26 16:57 . 2008-10-21 06:16 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 16:57 . 2008-08-28 04:24 712,192 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 16:57 . 2008-08-28 04:24 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 16:57 . 2008-08-28 04:24 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 16:57 . 2008-10-22 04:43 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-26 16:57 . 2008-10-22 04:43 160,768 --a------ c:\windows\System32\PortableDeviceTypes.dll
2008-11-26 16:57 . 2008-10-22 04:43 95,232 --a------ c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-23 17:21 . 2008-11-23 17:21 268 --ah----- C:\sqmdata07.sqm
2008-11-23 17:21 . 2008-11-23 17:21 244 --ah----- C:\sqmnoopt07.sqm
2008-11-22 15:53 . 2008-11-22 15:53 <REP> d-------- c:\program files\Common Files\Adobe AIR
2008-11-17 18:15 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-17 18:15 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-17 18:15 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-17 18:15 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-17 18:14 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-17 18:14 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-17 18:14 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-17 18:14 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-17 18:14 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 19:04 59,033 ----a-w c:\users\XXMAX~1.XX\AppData\Roaming\nvModes.dat
2008-12-15 19:41 --------- d-----w c:\program files\Google
2008-12-15 18:02 --------- d-----w c:\users\XXMAX~1.XX\AppData\Roaming\LimeWire
2008-12-15 17:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-15 17:30 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-15 17:27 --------- d-----w c:\program files\PDF Editeur 2
2008-12-15 17:24 --------- d-----w c:\program files\Microsoft Works
2008-12-15 17:18 --------- d-----w c:\users\XXMAX~1.XX\AppData\Roaming\Corel
2008-12-15 17:17 --------- d-----w c:\program files\Corel
2008-12-14 22:12 5,322 ----a-w c:\users\XXMAX~1.XX\AppData\Roaming\wklnhst.dat
2008-12-12 02:14 174 --sha-w c:\program files\desktop.ini
2008-12-12 02:12 --------- d-----w c:\program files\Windows Mail
2008-12-12 02:06 --------- d-----w c:\progra~2\Microsoft Help
2008-12-03 18:08 88 --sh--r c:\users\All Users\5886914F93.sys
2008-12-03 18:08 88 --sh--r c:\progra~2\5886914F93.sys
2008-12-03 18:08 2,828 --sha-w c:\users\All Users\KGyGaAvL.sys
2008-12-03 18:08 2,828 --sha-w c:\progra~2\KGyGaAvL.sys
2008-11-11 15:28 43,520 ----a-w c:\windows\System32\CmdLineExt03.dll
2008-11-11 15:25 --------- d-----w c:\program files\KONAMI
2008-11-10 19:10 --------- d-----w c:\program files\MSBuild
2008-11-10 19:05 --------- d-----w c:\program files\Microsoft.NET
2008-11-10 18:59 --------- d-----w c:\program files\Microsoft Visual Studio 8
2008-11-09 10:57 --------- d-----w c:\program files\DAEMON Tools Toolbar
2008-11-09 10:57 --------- d-----w c:\program files\DAEMON Tools Lite
2008-11-09 10:52 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-09 10:51 --------- d-----w c:\users\XXMAX~1.XX\AppData\Roaming\DAEMON Tools
2008-11-08 22:05 --------- d-----w c:\program files\Songbeat
2008-11-01 03:33 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:33 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:33 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:33 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:33 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-31 23:23 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-21 20:34 --------- d-----w c:\program files\eMule
2008-10-21 20:34 --------- d-----w c:\progra~2\eMule
2008-10-16 04:40 826,368 ----a-w c:\windows\System32\wininet.dll
2008-10-16 04:40 56,320 ----a-w c:\windows\System32\iesetup.dll
2008-10-16 04:40 26,624 ----a-w c:\windows\System32\ieUnatt.exe
2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 04:35 3,505,208 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 04:35 3,470,904 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 02:03 2,027,520 ----a-w c:\windows\System32\win32k.sys
2008-01-29 20:38 67,840 ----a-w c:\users\XXMAX~1.XX\AppData\Roaming\GDIPFONTCACHEV1.DAT
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-07-30 13:02 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-12-15 217088]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-10 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-10 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-10 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\pmnoMdab

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-08-08 13:11 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-07-04 12:09 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
--a------ 2007-05-31 08:21 648072 c:\windows\WindowsMobile\wmdc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EAF24220-0648-49F1-B22A-BDB42D5FA48F}"= Disabled:UDP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{47395BA4-7149-4322-B34F-461667949A4D}"= Disabled:TCP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{46C4F2D3-1DAB-4638-A430-9B3C502597CC}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{E253A437-483F-40B6-AC0A-9CDEA528B6ED}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{EC828024-2095-48FF-8146-EB83AD66C584}"= Disabled:UDP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{E835FF41-B059-4790-A3D6-291B8A159830}"= Disabled:TCP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"TCP Query User{8B27D9B6-F97F-4CBB-AE5A-434212197D3E}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{278FBE5E-DAC2-4CD6-8706-1A67B85228E4}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{0172AF2D-A2EF-4914-8734-39DFC8AE2EF5}c:\\valve lan\\hl.exe"= UDP:c:\valve lan\hl.exe:Half-Life Launcher
"UDP Query User{C3E170CB-CCE0-4206-BF38-79789644BA7A}c:\\valve lan\\hl.exe"= TCP:c:\valve lan\hl.exe:Half-Life Launcher
"{6C7BE8F3-4E99-487B-99B5-EF640BCC909E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{A270CE00-EF5C-41B9-9F20-ADC0AF0857AC}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{F7DFD37E-8BCF-4D9B-A05F-0A0EF7B8068B}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{E6DFF8CE-A8F9-4C51-9135-2C31C49000A5}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B85079B7-728C-4571-A2FC-FCF6F6586798}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{97DFB7C7-91FA-46D3-BF35-59AA4D76BD98}"= UDP:24259:BitComet 24259 TCP
"{AE8AE518-B26A-49CB-8407-153786CEB97E}"= TCP:24259:BitComet 24259 UDP
"{F92A58BD-C1B2-4119-B0FA-B466C2493136}"= UDP:24259:BitComet 24259 TCP
"{C6A51DEA-CD9A-444E-BFFD-E69676BFDAD5}"= TCP:24259:BitComet 24259 UDP
"TCP Query User{5482295B-FFB9-40D1-B1E3-34ACE820CA6D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{EE188824-9567-49BF-9BBA-D58D6A088BA1}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{C280CDD2-CDE8-4D1C-8BA7-F6AE70023157}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{05BBF25A-7313-46A9-9259-734098AC1D0F}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{9CBF060D-F410-45E3-898F-F036499AA6CA}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{457B4BF5-C6E7-4247-BC06-CE82A605D846}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"TCP Query User{594168E9-BB65-420D-8978-74C4688129E2}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= UDP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"UDP Query User{2F60D74D-55F0-454E-8C82-D4FCBDFEC99E}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= TCP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"{81D44A1C-DB04-4591-883B-01A82A6A2161}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{8770B3FB-217C-4CB7-8136-712AF8C3E682}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{86B98EAD-7ABD-47A5-8DD5-D5C5EF1CA623}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{E1B2A5FD-E3F0-40CA-A745-472431412CA7}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"{61BAD372-73EF-468B-B595-5F21CE80FF32}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8090290D-ED7E-4281-8AD5-CC9FD4DB4E3B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C339FF6D-B1BD-4E3B-B643-4F9797799AFD}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{86D267D4-A4E3-48CC-823A-FFEB61696E9A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{DFFAB77E-336B-4AED-80A3-074C85C042A4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-15 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-15 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-15 51792]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-08-24 24576]
R3 StkCMini;Syntek AVStream USB2.0 VGA WebCam;c:\windows\system32\Drivers\StkCMini.sys [2007-08-24 1132544]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2007-08-20 240128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\wdsync.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29c22a4e-a353-11dd-945b-806e6f6e6963}]
\shell\AutoRun\command - E:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e750105-3d19-11dd-b9d0-001bfc2481db}]
\shell\AutoRun\command - F:\wdsync.exe
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{362DF5FC-0DCC-42B5-A82E-EFF6AA706828} - c:\windows\system32\pmnoMdab.dll
HKCU-Run-fsm - (no file)
HKLM-Run-b014d537 - c:\windows\system32\kkvynkgy.dll
MSConfigStartUp-Corel File Shell Monitor - c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
MSConfigStartUp-Corel Photo Downloader - c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-Magentic - c:\progra~1\Magentic\bin\Magentic.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
MSConfigStartUp-VoipDiscount - c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 20:31:47
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\ATK0100\ATKOSD.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Heure de fin: 2008-12-16 20:40:40 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-16 19:40:30

Avant-CF: 25 295 728 640 octets libres
Après-CF: 25,016,012,800 octets libres

282 --- E O F --- 2008-12-12 02:06:58

Prends Combofix ici
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Oublie ce kevin05 qui fait nimp :-)

Pour le moment je vois pas pourquoi faire l'usage de Navilog (quel rapport ?!) , apparemment la mode de ce joujou n'est pas retombée et encore moins S&D (idem ?!).

Vu le rapport posté, Combofix est pour moi plus approprié.

black_biker :
Pour désactiver l'UAC regarde là

oulalala .. apparemment on a pas la même priorité des choses et encore moins la même façon de fonctionner :-)
Tu as besoin de passer 36 outils pour virer une barre d'outil ? Tu l'as fait sauter avec Combofix ça suffit amplement.

"tu fait tes scanned speach !!"

Lol, je les ai toujours fait comme ça et c'est pas un noob qui c'est pas rechercher sur un moteur de recherche l'origine d'un processus nvidia qui va me donner des conseils.

Le problème n'est pas celui qui ta formé, mais le mouton qui mange l'herbe que l'on lui donne.

Maintenant, point barre va donner des conseils à d'autres, provenant de toi, j'en ai pas besoin et je crois qu'après plusieurs années ici j'ai jamais eu un problème hormis des jeux téléchargés qui ont sautés. Toi tu fais ton badboy c'est bien, bravo grand garçon vachement impressionnant. (ô_0)

Et bah au lieu d'écouter "tout le monde" fais toi ton propre avis sur les choses, n'écoutent pas ceux qui disent oui mais non fais ceci ou fais cela parce que avec des si on referait le monde et dans la vie mieux vaut avoir son propre avis sur les choses que de manger ceux que les autres veulent bien te donner à manger.

Et quitte à faire des conneries, je préfére les faire, car c'est en faisant des erreurs que l'on apprend à ce qu'il parait ?

Bonjour

Tu peux jeter ta version Hijackthis qui est obsolète.

Ensuite, désactivel'UAC
**

Télécharge ComboFix sur ton bureau.
---> http://download. bleepingcomputer.com/sUBs/ComboFix.exe

Ferme ton navigateur web, logiciel de protection et connexion internet avant d'exécuter ce programme
Double-clic dessus et appuye sur "1" pour continuer et suis ce qui est indiqué à l'écran.

Un rapport va s'ouvrir enregistre son contenu, puis copie et colle le ici stp

Salut pour ma part j'utiliserais plutôt navilog et toolbar S&D que combofix

Au faite pourquoi combofix ?

regarde ceci

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

infection toolbar

Oui mais avec combofix tu peux faire sauter une machine aussi ;)

surtout de la façon dont tu as fait ton scanned speach ;)

eeeuuuuuuuh dsl mais le lien pr combofix ne fonctionne pas...pourrais tu m'en renvoyer un?

Fait ceci stp

Télécharges ToolBar S&D de Eric_71/Team IDN :

Tuto

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

* double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
* Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
* Choisis l'option 1 ( "recherche") et tapes "entrée" .
* Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
de son contenu dans ta prochaine réponse ...
( le rapport est en outre sauvegardé ici -> C:\TB.txt )

oki boulepate62 je vais suivre ta méthode.... je vien de télécharger combofix et vais l'executer

Bah ecoute c'est un helpeur qui me fait ma formation je sais ce que je dit ;)

et puis trouve un autre poste ou j'ai fait une connerie pour voir !!!

ça arrive a tout le monde surtout toi de la façon dont tu fait tes scanned speach !!

Bah ecoute je m'excuse ;) parce que beaucoup de monde me dise d'evité combofix parce que je pourrais planter un machine voilà pourquoi j'ai reagis comme ça

Oui t'as pas tord ^^

car c'est en faisant des erreurs que l'on apprend à ce qu'il parait ?

Ouais mais la c'est la pc de quelqu'un qui et en jeu ;)

Oui, mais me concernant ça fait un moment que j'ai testé sur des cobayes vu l'infection là (Vundo), il n'y a pas de risques, même une "astuce" a été écrite la-dessus .. et même si toi, tu croirais qu'il y aurait un risque pourquoi l'utiliserais-tu ? C'est que t'aimes jouer avec le risque ? ;-)

Il y a quelques temps de ça, il ne fallait pas dévoiller Combofix aux yeux de tout le monde, maintenant tu regardes ici dans les astuces ou sur n'importe quel forum les gens l'utilisent d'eyx-même pour régler leur problème et qu'il y a un risque ou pas, très peu doivent s'en soucier.

Les temps changent.

je sais pas je suis entrain d'apprendre et tu men as appris un peut plus :))))

la deuxieme analyse de combo fix m'a donné cela...

ComboFix 08-12-15.08 - Xx......mAx......xX 2008-12-16 21:06:40.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.1919.1164 [GMT 1:00]
Lancé depuis: c:\users\Xx......mAx......xX\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Xx......mAx......xX\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\noi.msnfix\
c:\program files\DAEMON Tools Toolbar
c:\program files\DAEMON Tools Toolbar\_DTLite.xml
c:\program files\DAEMON Tools Toolbar\DTToolbar.dll
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\chrome.manifest
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.xpt
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\install.rdf
c:\program files\DAEMON Tools Toolbar\Resources\about.ico
c:\program files\DAEMON Tools Toolbar\Resources\AboutWindow.ico
c:\program files\DAEMON Tools Toolbar\Resources\as.ico
c:\program files\DAEMON Tools Toolbar\Resources\as.png
c:\program files\DAEMON Tools Toolbar\Resources\astro.ico
c:\program files\DAEMON Tools Toolbar\Resources\b1.bmp
c:\program files\DAEMON Tools Toolbar\Resources\b1.png
c:\program files\DAEMON Tools Toolbar\Resources\BurnImage.ico
c:\program files\DAEMON Tools Toolbar\Resources\buy.ico
c:\program files\DAEMON Tools Toolbar\Resources\cond000.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond001.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond003.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond004.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond005.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond006.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond007.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond008.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond009.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond010.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond011.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond019.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond020.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond021.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond022.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond023.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond024.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond025.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond026.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond037.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond038.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond039.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond040.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond041.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond046.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond048.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond050.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond051.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond052.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond053.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond054.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond055.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond056.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond057.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond058.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond059.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond060.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond061.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond062.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond063.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond064.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond065.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond066.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond067.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond068.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond069.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond075.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond076.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond077.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond078.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond079.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond080.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond084.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond085.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond086.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond087.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond088.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond089.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond090.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond091.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond092.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond093.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond094.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond095.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond108.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond109.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond110.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond111.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond112.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond113.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond120.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond121.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond122.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond126.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond127.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond128.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond129.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond130.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond131.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond132.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond133.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond134.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond135.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond136.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond137.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond138.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond140.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond141.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond142.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond143.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond148.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond149.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond152.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond154.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond155.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond156.gif
c:\program files\DAEMON Tools Toolbar\Resources\cond157.gif
c:\program files\DAEMON Tools Toolbar\Resources\Config.ico
c:\program files\DAEMON Tools Toolbar\Resources\d.ico
c:\program files\DAEMON Tools Toolbar\Resources\d2.ico
c:\program files\DAEMON Tools Toolbar\Resources\daemon.ico
c:\program files\DAEMON Tools Toolbar\Resources\ds.ico
c:\program files\DAEMON Tools Toolbar\Resources\dsearch.ico
c:\program files\DAEMON Tools Toolbar\Resources\dt.ico
c:\program files\DAEMON Tools Toolbar\Resources\DTPro.ico
c:\program files\DAEMON Tools Toolbar\Resources\Dwnl.ico
c:\program files\DAEMON Tools Toolbar\Resources\emulation.ico
c:\program files\DAEMON Tools Toolbar\Resources\features.ico
c:\program files\DAEMON Tools Toolbar\Resources\gd.ico
c:\program files\DAEMON Tools Toolbar\Resources\genre.xml
c:\program files\DAEMON Tools Toolbar\Resources\globe.ico
c:\program files\DAEMON Tools Toolbar\Resources\GrabImage.ico
c:\program files\DAEMON Tools Toolbar\Resources\hb.bmp
c:\program files\DAEMON Tools Toolbar\Resources\hb.ico
c:\program files\DAEMON Tools Toolbar\Resources\help.ico
c:\program files\DAEMON Tools Toolbar\Resources\ip.ico
c:\program files\DAEMON Tools Toolbar\Resources\lang.xml
c:\program files\DAEMON Tools Toolbar\Resources\lingvo.ico
c:\program files\DAEMON Tools Toolbar\Resources\m.ico
c:\program files\DAEMON Tools Toolbar\Resources\mail.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mail_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioConfig.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioStation.ico
c:\program files\DAEMON Tools Toolbar\Resources\MenuTr.ico
c:\program files\DAEMON Tools Toolbar\Resources\next.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\next_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\none.bmp
c:\program files\DAEMON Tools Toolbar\Resources\none_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\noW.gif
c:\program files\DAEMON Tools Toolbar\Resources\op.ico
c:\program files\DAEMON Tools Toolbar\Resources\play.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play.ico
c:\program files\DAEMON Tools Toolbar\Resources\play_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\play_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\pragma.ico
c:\program files\DAEMON Tools Toolbar\Resources\prev.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prev_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\prod.ico
c:\program files\DAEMON Tools Toolbar\Resources\Radio.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioBg.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioBgMask.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.ico
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioError.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioError_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioSmallDisp.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioSmallDisp_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioWait.bmp
c:\program files\DAEMON Tools Toolbar\Resources\RadioWait_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Rss.ico
c:\program files\DAEMON Tools Toolbar\Resources\Rss1.ico
c:\program files\DAEMON Tools Toolbar\Resources\rssClose.ico
c:\program files\DAEMON Tools Toolbar\Resources\rssL.bmp
c:\program files\DAEMON Tools Toolbar\Resources\rssOpen.ico
c:\program files\DAEMON Tools Toolbar\Resources\size.bmp
c:\program files\DAEMON Tools Toolbar\Resources\size_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\skins.ico
c:\program files\DAEMON Tools Toolbar\Resources\spt.ico
c:\program files\DAEMON Tools Toolbar\Resources\stop.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop.ico
c:\program files\DAEMON Tools Toolbar\Resources\stop_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\stop_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
c:\program files\DAEMON Tools Toolbar\Resources\time.ico
c:\program files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
c:\program files\DAEMON Tools Toolbar\Resources\toolbar.xml
c:\program files\DAEMON Tools Toolbar\Resources\trans.ico
c:\program files\DAEMON Tools Toolbar\Resources\Trash.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\u.ico
c:\program files\DAEMON Tools Toolbar\Resources\vol.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol.ico
c:\program files\DAEMON Tools Toolbar\Resources\vol_back.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_dott.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_dott_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\vol_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wb.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
c:\program files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
c:\program files\DAEMON Tools Toolbar\Resources\wi.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi0.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi1.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi10.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi11.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi12.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi13.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi2.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi3.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi4.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi5.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi6.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi7.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi8.ico
c:\program files\DAEMON Tools Toolbar\Resources\wi9.ico
c:\program files\DAEMON Tools Toolbar\uninst.exe
C:\ToolBar SD
c:\toolbar sd\AutrInf.cmd
c:\toolbar sd\Back.cmd
c:\toolbar sd\Changelog ToolBar.txt
c:\toolbar sd\Crack.txt
c:\toolbar sd\DemP.cmd
c:\toolbar sd\DirectFix.cmd
c:\toolbar sd\Discl_en.vbs
c:\toolbar sd\Discl_fr.vbs
c:\toolbar sd\Discl_sp.vbs
c:\toolbar sd\Doss.tbsd
c:\toolbar sd\DossKill.txt
c:\toolbar sd\Fich.cmd
c:\toolbar sd\FichKill.txt
c:\toolbar sd\FixExt.cmd
c:\toolbar sd\iNv.exe
c:\toolbar sd\Kill.cmd
c:\toolbar sd\Langues.cmd
c:\toolbar sd\Orph.egd
c:\toolbar sd\OsV.exe
c:\toolbar sd\paths.bat
c:\toolbar sd\pv.exe
c:\toolbar sd\Rech.cmd
c:\toolbar sd\RegP2.txt
c:\toolbar sd\RegP3.txt
c:\toolbar sd\RegP4.txt
c:\toolbar sd\RegP5.txt
c:\toolbar sd\RegPCU.txt
c:\toolbar sd\RegPLM.txt
c:\toolbar sd\RegTBSD.reg
c:\toolbar sd\Rkeys.txt
c:\toolbar sd\RKit.lsd
c:\toolbar sd\RoGUeS.lsd
c:\toolbar sd\RunTool.txt
c:\toolbar sd\sed.exe
c:\toolbar sd\setpath.exe
c:\toolbar sd\TB_1.txt
c:\toolbar sd\ToolBarSD.cmd
c:\toolbar sd\ToolBarSD.ico
c:\toolbar sd\Uninstal.exe
c:\toolbar sd\VUN.txt
c:\windows\fxstaller.MSNFix\

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
.

2008-12-15 21:42 . 2008-11-26 18:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
2008-12-15 17:56 . 2008-12-15 17:56 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-12-15 17:56 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-12-15 17:56 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\program files\iTunes
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\iPod
2008-12-15 17:55 . 2008-12-15 17:55 <REP> d-------- c:\program files\Bonjour
2008-12-15 17:55 . 2008-12-15 17:56 <REP> d-------- c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\users\All Users\Apple Computer
2008-12-15 17:53 . 2008-12-15 17:54 <REP> d-------- c:\program files\QuickTime
2008-12-15 17:53 . 2008-12-15 17:55 <REP> d-------- c:\progra~2\Apple Computer
2008-12-15 17:52 . 2008-12-15 17:52 <REP> d-------- c:\program files\Apple Software Update
2008-12-15 17:50 . 2008-12-15 17:55 <REP> d-------- c:\program files\Common Files\Apple
2008-12-14 13:05 . 2008-12-15 19:00 1,025 --a------ C:\noi.MSNFix
2008-12-13 20:48 . 2008-12-13 01:16 52,786 --a------ c:\windows\fxstaller.MSNFix
2008-12-12 03:03 . 2008-10-22 00:31 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-11 03:08 . 2008-11-01 00:38 4,247,552 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-11 03:08 . 2008-11-01 04:33 1,687,040 --a------ c:\windows\System32\gameux.dll
2008-12-11 03:08 . 2008-10-21 06:16 297,472 --a------ c:\windows\System32\gdi32.dll
2008-12-11 03:08 . 2008-11-01 04:33 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2008-12-11 03:07 . 2008-10-29 07:20 2,923,520 --a------ c:\windows\explorer.exe
2008-12-11 03:06 . 2008-06-23 02:52 2,855,424 --a------ c:\windows\System32\mf.dll
2008-12-11 03:06 . 2008-06-23 02:52 996,352 --a------ c:\windows\System32\WMNetMgr.dll
2008-12-11 03:06 . 2008-06-23 02:52 98,816 --a------ c:\windows\System32\mfps.dll
2008-12-11 03:06 . 2008-06-23 02:52 94,720 --a------ c:\windows\System32\logagent.exe
2008-12-11 03:06 . 2008-06-23 02:52 52,736 --a------ c:\windows\System32\rrinstaller.exe
2008-12-11 03:06 . 2008-06-23 02:52 24,576 --a------ c:\windows\System32\mfpmp.exe
2008-12-11 03:06 . 2008-06-22 23:34 2,048 --a------ c:\windows\System32\mferror.dll
2008-11-26 16:57 . 2008-10-21 06:16 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 16:57 . 2008-08-28 04:24 712,192 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 16:57 . 2008-08-28 04:24 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 16:57 . 2008-08-28 04:24 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 16:57 . 2008-10-22 04:43 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-26 16:57 . 2008-10-22 04:43 160,768 --a------ c:\windows\System32\PortableDeviceTypes.dll
2008-11-26 16:57 . 2008-10-22 04:43 95,232 --a------ c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-23 17:21 . 2008-11-23 17:21 268 --ah----- C:\sqmdata07.sqm
2008-11-23 17:21 . 2008-11-23 17:21 244 --ah----- C:\sqmnoopt07.sqm
2008-11-22 15:53 . 2008-11-22 15:53 <REP> d-------- c:\program files\Common Files\Adobe AIR
2008-11-17 18:15 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-17 18:15 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-17 18:15 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-17 18:15 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-17 18:14 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-17 18:14 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-17 18:14 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-17 18:14 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-17 18:14 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-15 19:41 --------- d-----w c:\program files\Google
2008-12-15 17:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-15 17:30 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-15 17:27 --------- d-----w c:\program files\PDF Editeur 2
2008-12-15 17:24 --------- d-----w c:\program files\Microsoft Works
2008-12-15 17:17 --------- d-----w c:\program files\Corel
2008-12-12 02:14 174 --sha-w c:\program files\desktop.ini
2008-12-12 02:12 --------- d-----w c:\program files\Windows Mail
2008-12-12 02:06 --------- d-----w c:\progra~2\Microsoft Help
2008-12-03 18:08 88 --sh--r c:\users\All Users\5886914F93.sys
2008-12-03 18:08 88 --sh--r c:\progra~2\5886914F93.sys
2008-12-03 18:08 2,828 --sha-w c:\users\All Users\KGyGaAvL.sys
2008-12-03 18:08 2,828 --sha-w c:\progra~2\KGyGaAvL.sys
2008-11-11 15:25 --------- d-----w c:\program files\KONAMI
2008-11-10 19:10 --------- d-----w c:\program files\MSBuild
2008-11-10 19:05 --------- d-----w c:\program files\Microsoft.NET
2008-11-10 18:59 --------- d-----w c:\program files\Microsoft Visual Studio 8
2008-11-09 10:57 --------- d-----w c:\program files\DAEMON Tools Lite
2008-11-09 10:52 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-08 22:05 --------- d-----w c:\program files\Songbeat
2008-11-01 03:33 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:33 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:33 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:33 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:33 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-31 23:23 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-21 20:34 --------- d-----w c:\program files\eMule
2008-10-21 20:34 --------- d-----w c:\progra~2\eMule
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-07-30 13:02 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-07-30 13:02 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-16_20.34.56.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-16 19:31:42 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-12-16 19:31:41 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-16 20:11:30 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-12-16 18:03:54 107,614 ----a-w c:\windows\System32\perfc009.dat
+ 2008-12-16 19:37:25 107,614 ----a-w c:\windows\System32\perfc009.dat
- 2008-12-16 18:03:55 122,020 ----a-w c:\windows\System32\perfc00C.dat
+ 2008-12-16 19:37:25 122,020 ----a-w c:\windows\System32\perfc00C.dat
- 2008-12-16 18:03:55 618,470 ----a-w c:\windows\System32\perfh009.dat
+ 2008-12-16 19:37:25 618,470 ----a-w c:\windows\System32\perfh009.dat
- 2008-12-16 18:03:55 700,222 ----a-w c:\windows\System32\perfh00C.dat
+ 2008-12-16 19:37:25 700,222 ----a-w c:\windows\System32\perfh00C.dat
- 2008-12-16 17:59:04 9,654 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-808816023-62131175-2614681958-1000_UserData.bin
+ 2008-12-16 19:33:13 9,924 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-808816023-62131175-2614681958-1000_UserData.bin
- 2008-12-16 17:59:04 49,232 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-12-16 19:33:13 49,448 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-12-16 18:04:15 40,194 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-12-16 19:33:07 40,410 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-12-15 217088]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-10 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-10 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-10 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-08-08 13:11 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-07-04 12:09 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
--a------ 2007-05-31 08:21 648072 c:\windows\WindowsMobile\wmdc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EAF24220-0648-49F1-B22A-BDB42D5FA48F}"= Disabled:UDP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{47395BA4-7149-4322-B34F-461667949A4D}"= Disabled:TCP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{46C4F2D3-1DAB-4638-A430-9B3C502597CC}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{E253A437-483F-40B6-AC0A-9CDEA528B6ED}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{EC828024-2095-48FF-8146-EB83AD66C584}"= Disabled:UDP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{E835FF41-B059-4790-A3D6-291B8A159830}"= Disabled:TCP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"TCP Query User{8B27D9B6-F97F-4CBB-AE5A-434212197D3E}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{278FBE5E-DAC2-4CD6-8706-1A67B85228E4}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{0172AF2D-A2EF-4914-8734-39DFC8AE2EF5}c:\\valve lan\\hl.exe"= UDP:c:\valve lan\hl.exe:Half-Life Launcher
"UDP Query User{C3E170CB-CCE0-4206-BF38-79789644BA7A}c:\\valve lan\\hl.exe"= TCP:c:\valve lan\hl.exe:Half-Life Launcher
"{6C7BE8F3-4E99-487B-99B5-EF640BCC909E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{A270CE00-EF5C-41B9-9F20-ADC0AF0857AC}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{F7DFD37E-8BCF-4D9B-A05F-0A0EF7B8068B}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{E6DFF8CE-A8F9-4C51-9135-2C31C49000A5}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B85079B7-728C-4571-A2FC-FCF6F6586798}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{97DFB7C7-91FA-46D3-BF35-59AA4D76BD98}"= UDP:24259:BitComet 24259 TCP
"{AE8AE518-B26A-49CB-8407-153786CEB97E}"= TCP:24259:BitComet 24259 UDP
"{F92A58BD-C1B2-4119-B0FA-B466C2493136}"= UDP:24259:BitComet 24259 TCP
"{C6A51DEA-CD9A-444E-BFFD-E69676BFDAD5}"= TCP:24259:BitComet 24259 UDP
"TCP Query User{5482295B-FFB9-40D1-B1E3-34ACE820CA6D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{EE188824-9567-49BF-9BBA-D58D6A088BA1}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{C280CDD2-CDE8-4D1C-8BA7-F6AE70023157}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{05BBF25A-7313-46A9-9259-734098AC1D0F}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{9CBF060D-F410-45E3-898F-F036499AA6CA}"= UDP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"{457B4BF5-C6E7-4247-BC06-CE82A605D846}"= TCP:c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe:VoipDiscount
"TCP Query User{594168E9-BB65-420D-8978-74C4688129E2}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= UDP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"UDP Query User{2F60D74D-55F0-454E-8C82-D4FCBDFEC99E}c:\\program files\\jeyo\\jmc_windowsmobile\\jmc_wm.exe"= TCP:c:\program files\jeyo\jmc_windowsmobile\jmc_wm.exe:Jeyo Mobile Companion
"{81D44A1C-DB04-4591-883B-01A82A6A2161}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{8770B3FB-217C-4CB7-8136-712AF8C3E682}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{86B98EAD-7ABD-47A5-8DD5-D5C5EF1CA623}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{E1B2A5FD-E3F0-40CA-A745-472431412CA7}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"{61BAD372-73EF-468B-B595-5F21CE80FF32}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8090290D-ED7E-4281-8AD5-CC9FD4DB4E3B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C339FF6D-B1BD-4E3B-B643-4F9797799AFD}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{86D267D4-A4E3-48CC-823A-FFEB61696E9A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{DFFAB77E-336B-4AED-80A3-074C85C042A4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-15 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-15 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-15 51792]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-08-24 24576]
R3 StkCMini;Syntek AVStream USB2.0 VGA WebCam;c:\windows\system32\Drivers\StkCMini.sys [2007-08-24 1132544]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2007-08-20 240128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\wdsync.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29c22a4e-a353-11dd-945b-806e6f6e6963}]
\shell\AutoRun\command - E:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e750105-3d19-11dd-b9d0-001bfc2481db}]
\shell\AutoRun\command - F:\wdsync.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 21:11:32
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ATK0100\ATKOSD.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Heure de fin: 2008-12-16 21:19:50 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-16 20:19:46
ComboFix2.txt 2008-12-16 19:40:41

Avant-CF: 24 958 726 144 octets libres
Après-CF: 24,588,500,992 octets libres

539 --- E O F --- 2008-12-12 02:06:58