Problème Spyware / Virus

et voilà !
Logfile of random's system information tool 1.05 (written by random/random)
Run by Arnaud Meunier at 2009-01-26 11:29:15
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 57 GB (60%) free of 95 GB
Total RAM: 1023 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:29:40, on 26/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\umonit.exe
C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\RSIT.exe
C:\Program Files\trend micro\Arnaud Meunier.exe
C:\WINDOWS\system32\RunDll32.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.criticsonline.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PVE_Lite] "C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [iLike] C:\Program Files\iLike\1.2.11\ilikesidebar.exe /checkforupdate (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Lancer le Gestionnaire Internet.lnk = C:\Program Files\Wanadoo\GestMAJ.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O15 - Trusted Zone: http://webmail-lhr.expeditors.com
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} (F5 Networks Auto Update) -
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/selftest/fr/Prg/ESTPTest.cab
O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} - http://photos.wanadoo.fr/al/presentation/pc/resources/activex/Ephoto.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://livekuva.suomi.net/activex/AMC.cab
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} (F5 Networks OS Policy Agent) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\WINDOWS\system32\nslsvice.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Super Ad Blocker (SABSVC) - SuperAdBlocker.com - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

c'est fait, cela affiche (valeur non définie) maintenant à la place des lignes de commandes

Alors oui ds le regedit je retrouve bien ces deux commandes, exactement le même texte

c'est la poisse...

Voici le rapport :
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\IS\Programme d'installation d'Adobe Reader 9\Setup.exe moved successfully.
File/Folder E:\resycled\ntldr.com e: not found.
File/Folder E:\resycled not found.
========== REGISTRY ==========
Registry value HKEY_USERS\S-1-5-21-1957994488-484061587-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\AutoRun\command\\@ not found.
Registry value HKEY_USERS\S-1-5-21-1957994488-484061587-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\Open\command\\@ not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\ARNAUD~1.000\LOCALS~1\Temp\Perflib_Perfdata_b8c.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_778.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01262009_102228

bon l'aventure continue !

Voici le nouveau rapport Diag :
DiagHelp version v1.4 - http://www.malekal.com
excute le 26/01/2009 à 9:19:55,85

System information for \\ARNAUD-PC1:
Uptime: Error reading uptime
Kernel version: Microsoft Windows XP, Multiprocessor Free
Product type: Professional
Product version: 5.1
Service pack: 3
Kernel build number: 2600
Registered organization: Criticsonline
Registered owner: Arnaud Meunier
Install date: 26/03/2005, 15:14:13
Activation status: Error reading status
IE version: Unknown
System root: C:\WINDOWS
Processors: 2
Processor speed: 2.9 GHz
Processor type: Intel(R) Pentium(R) 4 CPU
Physical memory: 1024 MB
Video driver: NVIDIA GeForce PCX 5300
Volume Type Format Label Size Free Free
A: Removable 0.0%
C: Fixed NTFS BOOT 93.16 GB 56.53 GB 60.7%
D: Fixed NTFS BACKUP 90.22 GB 63.11 GB 70.0%
E: Fixed FAT32 RECOVER 2.93 GB 775.13 MB 25.9%
F: CD-ROM 0.0%
J: CD-ROM 0.0%
K: CD-ROM 0.0%
L: Removable 0.0%
M: Removable 0.0%
N: Removable 0.0%
O: Removable 0.0%

C:\WINDOWS\prefetch\PSINFO.EXE-17953D12.pf -->26/01/2009 09:20:05
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->26/01/2009 09:19:48
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->26/01/2009 09:19:28
C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->26/01/2009 09:18:52
C:\WINDOWS\prefetch\AVWSC.EXE-236190C6.pf -->26/01/2009 09:18:42
C:\WINDOWS\prefetch\HOSTSXPERT.EXE-089EA8D8.pf -->26/01/2009 09:17:43
C:\WINDOWS\prefetch\RUNDLL32.EXE-1C721030.pf -->26/01/2009 09:15:04
C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->26/01/2009 09:13:33
C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->26/01/2009 09:09:50
C:\WINDOWS\prefetch\WATCH.EXE-0DACDE18.pf -->26/01/2009 09:09:21

C:\WINDOWS\System32\drivers\USBCRFT.SYS -->26/01/2009 09:08:38
C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->14/01/2009 16:11:32
C:\WINDOWS\System32\drivers\mbam.sys -->14/01/2009 16:11:28
C:\WINDOWS\System32\drivers\srv.sys -->11/12/2008 11:57:09
C:\WINDOWS\System32\drivers\fssfltr_tdi.sys -->08/12/2008 17:01:56
C:\WINDOWS\System32\drivers\avipbb.sys -->26/11/2008 08:00:50
C:\WINDOWS\System32\drivers\mrxsmb.sys -->24/10/2008 12:21:09

C:\WINDOWS\System32\nvapps.xml -->26/01/2009 09:08:36
C:\WINDOWS\System32\wpa.dbl -->26/01/2009 09:08:26
C:\WINDOWS\System32\CF20400.exe -->25/01/2009 16:40:35
C:\WINDOWS\System32\amcompat.tlb -->24/01/2009 18:10:25
C:\WINDOWS\System32\nscompat.tlb -->24/01/2009 18:10:24
C:\WINDOWS\System32\FNTCACHE.DAT -->23/01/2009 22:10:22
C:\WINDOWS\System32\tmp.txt -->21/01/2009 21:38:43
C:\WINDOWS\System32\PerfStringBackup.INI -->21/01/2009 19:26:37
C:\WINDOWS\System32\perfh00C.dat -->21/01/2009 19:26:37
C:\WINDOWS\System32\perfh009.dat -->21/01/2009 19:26:37
C:\WINDOWS\System32\perfc00C.dat -->21/01/2009 19:26:37
C:\WINDOWS\System32\perfc009.dat -->21/01/2009 19:26:37
C:\WINDOWS\System32\mswinsck.ocx -->20/01/2009 20:10:24
C:\WINDOWS\System32\MRT.exe -->09/01/2009 17:35:30
C:\WINDOWS\System32\javaws.exe -->16/12/2008 13:32:41
C:\WINDOWS\System32\javaw.exe -->16/12/2008 13:32:41
C:\WINDOWS\System32\javacpl.cpl -->16/12/2008 13:32:41
C:\WINDOWS\System32\java.exe -->16/12/2008 13:32:41
C:\WINDOWS\System32\deploytk.dll -->16/12/2008 13:32:40
C:\WINDOWS\System32\mshtml.dll -->13/12/2008 07:37:56
C:\WINDOWS\System32\TZLog.log -->09/12/2008 23:17:22
C:\WINDOWS\System32\MRT.INI -->09/12/2008 23:15:37
C:\WINDOWS\System32\sirenacm.dll -->02/12/2008 22:37:20
C:\WINDOWS\System32\PVE_Lite.dll -->02/12/2008 20:22:41
C:\WINDOWS\System32\gdi32.dll -->23/10/2008 13:36:51

C:\WINDOWS\pfirewall.log -->26/01/2009 09:20:09
C:\WINDOWS\WindowsUpdate.log -->26/01/2009 08:01:34
C:\WINDOWS\wiadebug.log -->26/01/2009 07:59:41
C:\WINDOWS\wiaservc.log -->26/01/2009 07:59:37
C:\WINDOWS\bootstat.dat -->26/01/2009 07:58:37
C:\WINDOWS\SchedLgU.Txt -->25/01/2009 22:26:42
C:\WINDOWS\pfirewall.log.old -->23/01/2009 22:08:10
C:\WINDOWS\system.ini -->23/01/2009 15:43:27
C:\WINDOWS\wininit.ini -->20/01/2009 21:50:46
C:\WINDOWS\NeroDigital.ini -->31/12/2008 16:28:25
C:\WINDOWS\WLXPGSS.SCR -->05/12/2008 00:11:14
C:\WINDOWS\UninstVeetleTVPlayer.exe -->16/11/2008 19:45:14
C:\WINDOWS\kit.ini -->05/08/2008 21:53:52
C:\WINDOWS\PhotoSnapViewer.INI -->07/07/2008 20:02:14
C:\WINDOWS\winhlp32.exe -->14/04/2008 03:34:27

Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\WINDOWS

14/01/2009 07:49 <REP> $hf_mig$
15/04/2005 06:41 <REP> $MSI31Uninstall_KB893803$
18/05/2005 19:25 <REP> $MSI31Uninstall_KB893803v2$
20/09/2008 06:18 <REP> $NtServicePackUninstall$
19/12/2006 08:31 <REP> $NtServicePackUninstallIDNMitigationAPIs$
19/12/2006 08:31 <REP> $NtServicePackUninstallNLSDownlevelMapping$
14/01/2006 23:01 <REP> $NtUninstallbasecsp$
26/03/2005 15:45 <REP> $NtUninstallKB828741$
26/03/2005 15:51 <REP> $NtUninstallKB833987$
15/03/2005 18:55 <REP> $NtUninstallKB834707-IE6SP1-20040929.091901$
26/03/2005 15:52 <REP> $NtUninstallKB835732$
15/03/2005 18:55 <REP> $NtUninstallKB840987$
26/03/2005 15:52 <REP> $NtUninstallKB841356$
26/03/2005 15:38 <REP> $NtUninstallKB842773$
26/03/2005 16:39 <REP> $NtUninstallKB867282$
26/03/2005 15:51 <REP> $NtUninstallKB867282-IE6SP1-20050127.163319$
26/03/2005 15:51 <REP> $NtUninstallKB871250$
26/03/2005 15:52 <REP> $NtUninstallKB873333$
26/03/2005 15:53 <REP> $NtUninstallKB873333_0$
26/03/2005 15:50 <REP> $NtUninstallKB873339$
26/03/2005 15:53 <REP> $NtUninstallKB873339_0$
16/06/2005 05:35 <REP> $NtUninstallKB883939$
26/03/2005 15:52 <REP> $NtUninstallKB885250$
26/03/2005 15:53 <REP> $NtUninstallKB885250_0$
26/03/2005 15:51 <REP> $NtUninstallKB885835$
26/03/2005 15:53 <REP> $NtUninstallKB885835_0$
26/03/2005 15:50 <REP> $NtUninstallKB885836$
26/03/2005 15:53 <REP> $NtUninstallKB885836_0$
17/03/2005 12:44 <REP> $NtUninstallKB885884$
26/03/2005 16:39 <REP> $NtUninstallKB886185$
26/03/2005 15:53 <REP> $NtUninstallKB887742$
26/03/2005 15:52 <REP> $NtUninstallKB888113$
26/03/2005 15:53 <REP> $NtUninstallKB888113_0$
26/03/2005 15:51 <REP> $NtUninstallKB888302$
26/03/2005 15:53 <REP> $NtUninstallKB888302_0$
16/06/2005 05:35 <REP> $NtUninstallKB890046$
26/03/2005 15:51 <REP> $NtUninstallKB890047$
26/03/2005 15:53 <REP> $NtUninstallKB890047_0$
26/03/2005 15:51 <REP> $NtUninstallKB890175$
26/03/2005 15:53 <REP> $NtUninstallKB890175_0$
15/04/2005 06:41 <REP> $NtUninstallKB890859$
15/04/2005 06:41 <REP> $NtUninstallKB890923$
26/03/2005 15:51 <REP> $NtUninstallKB891711$
26/03/2005 15:51 <REP> $NtUninstallKB891781$
26/03/2005 15:53 <REP> $NtUninstallKB891781_0$
15/04/2005 06:41 <REP> $NtUninstallKB893066$
15/04/2005 06:41 <REP> $NtUninstallKB893086$
13/08/2005 06:29 <REP> $NtUninstallKB893756$
13/08/2005 06:27 <REP> $NtUninstallKB894391$
16/06/2005 05:35 <REP> $NtUninstallKB896358$
16/06/2005 05:35 <REP> $NtUninstallKB896422$
13/08/2005 06:28 <REP> $NtUninstallKB896423$
10/11/2005 20:00 <REP> $NtUninstallKB896424$
16/06/2005 05:35 <REP> $NtUninstallKB896428$
20/10/2005 19:39 <REP> $NtUninstallKB896688$
13/08/2005 06:28 <REP> $NtUninstallKB896727$
29/06/2005 05:29 <REP> $NtUninstallKB898461$
13/08/2005 06:29 <REP> $NtUninstallKB899587$
13/08/2005 06:28 <REP> $NtUninstallKB899588$
13/08/2005 06:29 <REP> $NtUninstallKB899591$
26/04/2006 06:38 <REP> $NtUninstallKB900485$
20/10/2005 19:39 <REP> $NtUninstallKB900725$
20/10/2005 19:40 <REP> $NtUninstallKB901017$
13/07/2005 07:27 <REP> $NtUninstallKB901214$
20/10/2005 19:39 <REP> $NtUninstallKB902400$
13/07/2005 07:27 <REP> $NtUninstallKB903235$
20/10/2005 19:39 <REP> $NtUninstallKB904706$
19/12/2006 08:29 <REP> $NtUninstallKB904942$
20/10/2005 19:39 <REP> $NtUninstallKB905414$
20/10/2005 19:39 <REP> $NtUninstallKB905749$
14/12/2005 07:57 <REP> $NtUninstallKB905915$
10/01/2006 19:39 <REP> $NtUninstallKB908519$
15/04/2006 07:16 <REP> $NtUninstallKB908531$
14/12/2005 07:57 <REP> $NtUninstallKB910437$
16/06/2006 06:50 <REP> $NtUninstallKB911280$
15/04/2006 07:16 <REP> $NtUninstallKB911562$
15/02/2006 06:56 <REP> $NtUninstallKB911564$
15/02/2006 06:55 <REP> $NtUninstallKB911565$
15/04/2006 07:15 <REP> $NtUninstallKB911567$
15/02/2006 06:56 <REP> $NtUninstallKB911927$
15/04/2006 07:16 <REP> $NtUninstallKB912812$
06/01/2006 07:59 <REP> $NtUninstallKB912919$
15/02/2006 06:55 <REP> $NtUninstallKB913446$
14/05/2006 16:55 <REP> $NtUninstallKB913580$
14/07/2006 21:21 <REP> $NtUninstallKB914388$
16/06/2006 06:50 <REP> $NtUninstallKB914389$
19/12/2006 08:30 <REP> $NtUninstallKB914440$
19/12/2006 08:30 <REP> $NtUninstallKB915865$
16/06/2006 06:50 <REP> $NtUninstallKB916281$
14/07/2006 21:20 <REP> $NtUninstallKB916595$
14/07/2006 21:21 <REP> $NtUninstallKB917159$
16/06/2006 06:51 <REP> $NtUninstallKB917344$
10/08/2006 21:38 <REP> $NtUninstallKB917422$
16/06/2006 06:51 <REP> $NtUninstallKB917734_WMP10$
16/06/2006 06:50 <REP> $NtUninstallKB917953$
14/02/2007 07:36 <REP> $NtUninstallKB918118$
16/06/2006 06:51 <REP> $NtUninstallKB918439$
10/08/2006 21:38 <REP> $NtUninstallKB918899$
15/09/2006 22:09 <REP> $NtUninstallKB919007$
14/11/2006 19:28 <REP> $NtUninstallKB920213$
10/08/2006 21:39 <REP> $NtUninstallKB920214$
10/08/2006 21:39 <REP> $NtUninstallKB920670$
10/08/2006 21:39 <REP> $NtUninstallKB920683$
15/09/2006 22:09 <REP> $NtUninstallKB920685$
15/09/2006 22:09 <REP> $NtUninstallKB920872$
10/08/2006 21:39 <REP> $NtUninstallKB921398$
14/08/2007 23:22 <REP> $NtUninstallKB921503$
10/08/2006 21:38 <REP> $NtUninstallKB921883$
15/09/2006 22:09 <REP> $NtUninstallKB922582$
10/08/2006 21:39 <REP> $NtUninstallKB922616$
14/11/2006 19:28 <REP> $NtUninstallKB922760$
12/10/2006 19:38 <REP> $NtUninstallKB922819$
12/10/2006 19:37 <REP> $NtUninstallKB923191$
12/10/2006 19:38 <REP> $NtUninstallKB923414$
13/12/2006 08:32 <REP> $NtUninstallKB923694$
14/11/2006 19:29 <REP> $NtUninstallKB923980$
12/10/2006 19:38 <REP> $NtUninstallKB924191$
14/11/2006 19:28 <REP> $NtUninstallKB924270$
12/10/2006 19:37 <REP> $NtUninstallKB924496$
14/02/2007 07:38 <REP> $NtUninstallKB924667$
13/12/2006 08:33 <REP> $NtUninstallKB925398_WMP64$
19/12/2006 08:30 <REP> $NtUninstallKB925454$
13/12/2006 08:33 <REP> $NtUninstallKB925454_0$
26/09/2006 19:07 <REP> $NtUninstallKB925486$
04/04/2007 07:06 <REP> $NtUninstallKB925902$
02/12/2006 19:26 <REP> $NtUninstallKB926239$
13/12/2006 08:32 <REP> $NtUninstallKB926255$
14/02/2007 07:36 <REP> $NtUninstallKB926436$
14/02/2007 07:39 <REP> $NtUninstallKB927779$
14/02/2007 07:39 <REP> $NtUninstallKB927802$
22/05/2007 22:38 <REP> $NtUninstallKB927891$
14/02/2007 07:38 <REP> $NtUninstallKB928255$
14/02/2007 07:35 <REP> $NtUninstallKB928843$
13/06/2007 06:10 <REP> $NtUninstallKB929123$
15/03/2007 22:08 <REP> $NtUninstallKB929338$
15/03/2007 22:09 <REP> $NtUninstallKB929399$
11/04/2007 06:53 <REP> $NtUninstallKB930178$
12/05/2007 17:42 <REP> $NtUninstallKB930916$
11/04/2007 06:54 <REP> $NtUninstallKB931261$
11/04/2007 06:54 <REP> $NtUninstallKB931784$
14/02/2007 07:37 <REP> $NtUninstallKB931836$
11/04/2007 06:53 <REP> $NtUninstallKB932168$
28/05/2008 17:59 <REP> $NtUninstallKB932823-v3$
28/08/2007 23:06 <REP> $NtUninstallKB933360$
09/10/2007 18:52 <REP> $NtUninstallKB933729$
13/06/2007 06:09 <REP> $NtUninstallKB935839$
13/06/2007 06:10 <REP> $NtUninstallKB935840$
14/08/2007 23:22 <REP> $NtUninstallKB936021$
11/07/2007 06:44 <REP> $NtUninstallKB936357$
14/08/2007 23:19 <REP> $NtUninstallKB936782_WMP11$
20/09/2008 06:29 <REP> $NtUninstallKB938464$
10/09/2008 06:18 <REP> $NtUninstallKB938464_0$
14/08/2007 23:22 <REP> $NtUninstallKB938828$
14/08/2007 23:21 <REP> $NtUninstallKB938829$
31/08/2007 05:33 <REP> $NtUninstallKB939683$
09/10/2007 18:50 <REP> $NtUninstallKB941202$
12/12/2007 19:12 <REP> $NtUninstallKB941568$
12/12/2007 19:13 <REP> $NtUninstallKB941569$
09/01/2008 08:12 <REP> $NtUninstallKB941644$
10/04/2008 21:11 <REP> $NtUninstallKB941693$
12/12/2007 19:13 <REP> $NtUninstallKB942763$
12/02/2008 19:41 <REP> $NtUninstallKB943055$
14/11/2007 11:36 <REP> $NtUninstallKB943460$
09/01/2008 08:12 <REP> $NtUninstallKB943485$
12/12/2007 19:12 <REP> $NtUninstallKB944653$
10/04/2008 21:09 <REP> $NtUninstallKB945553$
12/02/2008 19:42 <REP> $NtUninstallKB946026$
20/09/2008 06:29 <REP> $NtUninstallKB946648$
15/08/2008 23:07 <REP> $NtUninstallKB946648_0$
10/04/2008 21:10 <REP> $NtUninstallKB948590$
10/04/2008 21:11 <REP> $NtUninstallKB948881$
14/05/2008 20:49 <REP> $NtUninstallKB950749$
12/06/2008 17:58 <REP> $NtUninstallKB950760$
20/09/2008 06:29 <REP> $NtUninstallKB950762$
12/06/2008 17:58 <REP> $NtUninstallKB950762_0$
20/09/2008 06:30 <REP> $NtUninstallKB950974$
15/08/2008 23:06 <REP> $NtUninstallKB950974_0$
20/09/2008 06:30 <REP> $NtUninstallKB951066$
15/08/2008 23:03 <REP> $NtUninstallKB951066_0$
15/08/2008 23:04 <REP> $NtUninstallKB951072-v2$
20/09/2008 06:30 <REP> $NtUninstallKB951376$
20/09/2008 06:30 <REP> $NtUninstallKB951376-v2$
20/06/2008 18:25 <REP> $NtUninstallKB951376-v2_0$
12/06/2008 17:58 <REP> $NtUninstallKB951376_0$
20/09/2008 06:30 <REP> $NtUninstallKB951698$
12/06/2008 17:58 <REP> $NtUninstallKB951698_0$
20/09/2008 06:30 <REP> $NtUninstallKB951748$
09/07/2008 18:44 <REP> $NtUninstallKB951748_0$
20/09/2008 17:29 <REP> $NtUninstallKB951978$
09/12/2008 23:16 <REP> $NtUninstallKB952069_WM9$
20/09/2008 06:31 <REP> $NtUninstallKB952287$
15/08/2008 23:04 <REP> $NtUninstallKB952287_0$
20/09/2008 06:31 <REP> $NtUninstallKB952954$
15/08/2008 23:07 <REP> $NtUninstallKB952954_0$
15/08/2008 23:07 <REP> $NtUninstallKB953839$
10/09/2008 06:17 <REP> $NtUninstallKB954154_WM11$
16/10/2008 07:15 <REP> $NtUninstallKB954211$
12/11/2008 07:54 <REP> $NtUninstallKB954459$
09/12/2008 23:15 <REP> $NtUninstallKB954600$
12/11/2008 07:54 <REP> $NtUninstallKB955069$
09/12/2008 23:17 <REP> $NtUninstallKB955839$
16/10/2008 07:16 <REP> $NtUninstallKB956391$
09/12/2008 23:13 <REP> $NtUninstallKB956802$
16/10/2008 07:16 <REP> $NtUninstallKB956803$
16/10/2008 07:14 <REP> $NtUninstallKB956841$
16/10/2008 07:16 <REP> $NtUninstallKB957095$
12/11/2008 07:54 <REP> $NtUninstallKB957097$
24/10/2008 14:28 <REP> $NtUninstallKB958644$
14/01/2009 07:49 <REP> $NtUninstallKB958687$
02/12/2006 19:26 <REP> $NtUninstallMSCompPackV1$
01/03/2008 07:55 <REP> $NtUninstallWIC$
14/01/2006 23:01 <REP> $NtUninstallWMCSetup$
03/09/2006 17:10 <REP> $NtUninstallWMFDist11$
03/09/2006 17:12 <REP> $NtUninstallwmp11$
03/09/2006 17:11 <REP> $NtUninstallWudf01000$
03/03/2007 10:19 <REP> ie7
24/01/2009 12:58 <REP> inf
25/01/2009 14:14 <REP> Installer
20/03/2005 10:15 <REP> msdownld.tmp
26/09/2004 13:22 <REP> PIF
26/03/2005 17:21 <REP> ShellNew
24/04/2003 13:00 49 102 winnt.bmp
24/04/2003 13:00 49 102 winnt256.bmp
3 fichier(s) 98 953 octets
221 Rép(s) 60 694 765 568 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\WINDOWS\system32

24/01/2009 12:56 <REP> dllcache
7 fichier(s) 4 721 octets
1 Rép(s) 60 694 745 088 octets libres
winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Unsigned
ndis.sys
Verified: Signed
null.sys
Verified: Signed
userinit.exe
kernel32.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 2432
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76610000 0x84000 5.131.2600.5512 C:\WINDOWS\system32\CRYPTUI.dll
0x44080000 0xd0000 7.00.6000.16762 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16762 C:\WINDOWS\system32\iertutil.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\comctl32.dll
0x73e60000 0x5c000 5.03.2600.5512 C:\WINDOWS\system32\DSOUND.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
0x44360000 0x5cd000 7.00.6000.16762 C:\WINDOWS\system32\ieframe.dll
0x5f800000 0x16000 1.01.1593.0000 C:\PROGRA~1\WIFD1F~1\MpShHook.dll
0x78130000 0x9b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x7c420000 0x87000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x44160000 0x127000 7.00.6000.16762 C:\WINDOWS\system32\urlmon.dll
0x7d200000 0x2bc000 3.01.4001.5512 C:\WINDOWS\system32\msi.dll
0x442b0000 0x3c000 7.00.6000.16762 C:\WINDOWS\system32\webcheck.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
0x10000000 0x7000 1.00.0000.0001 C:\PROGRA~1\Wanadoo\Inactivity.dll
0x02ac0000 0x2e000 C:\Program Files\WinRAR\rarext.dll
0x03940000 0x1e2000 2.10.0001.0001 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll
0x7c140000 0x103000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\MFC71.DLL
0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\MSVCP71.dll
0x4eb80000 0x1a6000 5.01.3102.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c\gdiplus.dll
0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL
0x74da0000 0x6d000 5.30.0023.1230 C:\WINDOWS\system32\RICHED20.dll
0x02b20000 0x14000 4.64.0000.0000 C:\Program Files\7-Zip\7-zip.dll
0x02b40000 0x19000 2.10.0006.0001 C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
0x03b30000 0x102000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL
0x02da0000 0x12000 7.00.0000.0015 C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll
0x030b0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x030d0000 0xa000 1.00.0000.0000 C:\PROGRA~1\FICHIE~1\ArcSoft\ContextMenuExt.dll
0x04240000 0x1b0000 3.00.0000.0005 C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll
0x043f0000 0x5b000 9.00.0000.0332 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
0x04450000 0x4c000 9.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
0x32520000 0x12000 10.00.2609.0000 C:\Program Files\Microsoft Office\Office10\msohev.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 652
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x73e60000 0x5c000 5.03.2600.5512 C:\WINDOWS\system32\DSOUND.dll
0x01840000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll
0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\WINDOWS\Downloaded Program Files

25/01/2009 16:40 <REP> .
25/01/2009 16:40 <REP> ..
25/01/2009 14:01 <REP> CONFLICT.1
26/03/2005 15:11 65 desktop.ini
04/09/2008 12:39 352 888 f5InspectionHost.dll
04/09/2008 12:39 445 f5InspectionHost.inf
04/09/2008 12:51 238 200 f5instd.exe
04/09/2008 12:50 115 320 F5InstH.exe
04/09/2008 12:50 33 400 F5InstP.dll
04/09/2008 12:47 566 f5syschk.inf
04/09/2008 12:47 33 400 F5Win32CheckHelper.dll
04/09/2008 12:47 111 224 F5Win32CheckHelper.exe
04/10/2008 20:16 1 887 080 FP_AX_CAB_INSTALLER.exe
04/09/2008 12:39 82 552 ietrust.exe
04/09/2008 12:51 262 776 InstallerControl.dll
04/09/2008 12:51 571 InstallerControl.inf
13/08/2008 15:03 575 kavwebscan.inf
11/02/2008 09:39 1 864 OnlineScanner.inf
21/06/2006 00:00 299 890 tcscan8.dat
21/06/2006 00:00 614 328 tcscan9.dat
21/06/2006 00:00 453 tinf.dat
21/06/2006 00:00 148 tinfidx.dat
21/06/2006 00:00 1 957 tinfl.dat
21/06/2006 00:00 56 049 tscan1.dat
21/06/2006 00:00 3 027 tscan1hd.dat
21/06/2006 00:00 5 516 v.grd
21/06/2006 00:00 2 249 v.sig
21/06/2006 00:00 106 244 virscan.inf
21/06/2006 00:00 957 664 virscan1.dat
21/06/2006 00:00 569 646 virscan2.dat
21/06/2006 00:00 146 144 virscan3.dat
21/06/2006 00:00 320 105 virscan4.dat
21/06/2006 00:00 2 475 253 virscan5.dat
21/06/2006 00:00 388 892 virscan6.dat
21/06/2006 00:00 3 829 458 virscan7.dat
21/06/2006 00:00 1 556 214 virscan8.dat
21/06/2006 00:00 3 356 406 virscan9.dat
21/06/2006 00:00 32 virscant.dat
15/09/2005 15:32 95 840 VoxsyncX.dll
22/08/2005 14:31 392 VoxsyncX.inf
01/07/2006 20:27 2 072 vscanmsx.dat
04/09/2008 12:47 246 392 Win32SystemCheck.dll
03/08/2004 14:51 293 wuweb.inf
21/06/2006 00:00 224 zdone.dat
17/11/2004 21:44 114 728 ZIntro.ocx
42 fichier(s) 18 270 542 octets

Répertoire de C:\WINDOWS\Downloaded Program Files\CONFLICT.1

25/01/2009 14:01 <REP> .
25/01/2009 14:01 <REP> ..
04/10/2008 20:16 1 887 080 FP_AX_CAB_INSTALLER.exe
04/10/2008 20:08 247 swflash.inf
2 fichier(s) 1 887 327 octets

Total des fichiers listés :
44 fichier(s) 20 157 869 octets
5 Rép(s) 60 693 581 824 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"C:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe"="C:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe:*:Enabled:Fireworks MX"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Disabled:Windows Messenger"
"C:\\Program Files\\FileZilla\\FileZilla.exe"="C:\\Program Files\\FileZilla\\FileZilla.exe:*:Enabled:FileZilla"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\dxdiag.exe"="C:\\WINDOWS\\system32\\dxdiag.exe:*:Enabled:Outil de diagnostic Microsoft DirectX"
"C:\\Program Files\\Fichiers communs\\Ahead\\Nero Web\\SetupX.exe"="C:\\Program Files\\Fichiers communs\\Ahead\\Nero Web\\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\\Program Files\\Fichiers communs\\Adobe\\Calibration\\Adobe Gamma Loader.exe"="C:\\Program Files\\Fichiers communs\\Adobe\\Calibration\\Adobe Gamma Loader.exe:*:Enabled:Adobe Gamma Loader"
"C:\\Program Files\\sina\\SAP\\SAPlatform.exe"="C:\\Program Files\\sina\\SAP\\SAPlatform.exe:*:Enabled:SAPlatform.exe"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Disabled:µTorrent"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies
REGEDIT4

[System]
"dontdisplaylastusername"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"legalnoticecaption"=""
"legalnoticetext"=""

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-26 09:20:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
160 - svchost.exe
424 - mHotkey.exe
428 - wmpnetwk.exe
556 - umonit.exe
628 - csrss.exe
652 - winlogon.exe
700 - services.exe
712 - lsass.exe
876 - nslsvice.exe
960 - svchost.exe
1032 - svchost.exe
1128 - MsMpEng.exe
1168 - svchost.exe
1224 - svchost.exe
1344 - svchost.exe
1376 - SABSVC.EXE
1464 - spoolsv.exe
1752 - sched.exe
1764 - avguard.exe
1780 - CDAC11BA.EXE
1808 - Dit.exe
1812 - FTRTSVC.exe
1876 - svchost.exe
1912 - jqs.exe
1984 - LSSrvc.exe
2000 - mdm.exe
2016 - ntmulti.exe
2032 - nvsvc32.exe
2060 - cmd.exe
2124 - alg.exe
2168 - wmiapsrv.exe
2432 - explorer.exe
2728 - avgnt.exe
2888 - Inactivity.exe
2916 - PollingModule.e
2948 - SpyEraser.exe
2956 - SpeedUpMyPC.exe
2960 - NMIndexStoreSvr
2980 - PVE_GMMode_Lite
3012 - NMBgMonitor.exe
3016 - GestionnaireInt
3024 - wmpnscfg.exe
3048 - ctfmon.exe
3160 - NMIndexingServi
3516 - Toaster.exe
3560 - ComComp.exe
3636 - ALERTM~1.EXE
3792 - Watch.exe
3864 - iexplore.exe
4012 - iexplore.exe

Total number of processes = 51
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntoskrnl.exe
806FF000 - \WINDOWS\system32\hal.dll
F7AEE000 - \WINDOWS\system32\KDCOM.DLL
F79FE000 - \WINDOWS\system32\BOOTVID.dll
F759E000 - ACPI.sys
F7AF0000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
F758D000 - pci.sys
F75EE000 - isapnp.sys
F75FE000 - ohci1394.sys
F760E000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS
F7BB6000 - pciide.sys
F786E000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
F761E000 - MountMgr.sys
F756E000 - ftdisk.sys
F7876000 - PartMgr.sys
F762E000 - VolSnap.sys
F7556000 - atapi.sys
F763E000 - disk.sys
F764E000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
F7536000 - fltmgr.sys
F7524000 - sr.sys
F765E000 - avgntmgr.sys
F766E000 - PxHelp20.sys
F750D000 - KSecDD.sys
F7480000 - Ntfs.sys
F7453000 - NDIS.sys
F7439000 - Mup.sys
F769E000 - \SystemRoot\System32\DRIVERS\nic1394.sys
F6CD9000 - \SystemRoot\System32\DRIVERS\intelppm.sys
F692D000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
F6919000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F68F5000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
F7946000 - \SystemRoot\System32\DRIVERS\usbuhci.sys
F68D1000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
F794E000 - \SystemRoot\System32\DRIVERS\usbehci.sys
F6CC9000 - \SystemRoot\system32\DRIVERS\fetnd5b.sys
F7956000 - \SystemRoot\System32\DRIVERS\fdc.sys
F68C0000 - \SystemRoot\System32\DRIVERS\serial.sys
F7AD2000 - \SystemRoot\System32\DRIVERS\serenum.sys
F68AC000 - \SystemRoot\System32\DRIVERS\parport.sys
F6CB9000 - \SystemRoot\System32\DRIVERS\i8042prt.sys
F795E000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
F6CA9000 - \SystemRoot\System32\DRIVERS\imapi.sys
F7AD6000 - \SystemRoot\system32\drivers\pfc.sys
F6C99000 - \SystemRoot\System32\DRIVERS\cdrom.sys
F6C89000 - \SystemRoot\System32\DRIVERS\redbook.sys
F6889000 - \SystemRoot\System32\DRIVERS\ks.sys
F7C6F000 - \SystemRoot\System32\DRIVERS\audstub.sys
F6C79000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
F7ADE000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
F6872000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
F76BE000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
F76CE000 - \SystemRoot\System32\DRIVERS\raspptp.sys
F7966000 - \SystemRoot\System32\DRIVERS\TDI.SYS
F6861000 - \SystemRoot\System32\DRIVERS\psched.sys
F76DE000 - \SystemRoot\System32\DRIVERS\msgpc.sys
F796E000 - \SystemRoot\System32\DRIVERS\ptilink.sys
F7976000 - \SystemRoot\System32\DRIVERS\raspti.sys
F76EE000 - \SystemRoot\System32\DRIVERS\termdd.sys
F797E000 - \SystemRoot\System32\DRIVERS\mouclass.sys
F7B10000 - \SystemRoot\System32\DRIVERS\swenum.sys
F6803000 - \SystemRoot\System32\DRIVERS\update.sys
F7AEA000 - \SystemRoot\System32\DRIVERS\mssmbios.sys
F76FE000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F5587000 - \SystemRoot\system32\drivers\cmudax.sys
F5563000 - \SystemRoot\system32\drivers\portcls.sys
F770E000 - \SystemRoot\system32\drivers\drmk.sys
F771E000 - \SystemRoot\System32\DRIVERS\usbhub.sys
F7B2A000 - \SystemRoot\System32\DRIVERS\USBD.SYS
F79AE000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
F5550000 - \SystemRoot\SYSTEM32\DRIVERS\avgntdd.sys
F7B32000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7D1A000 - \SystemRoot\System32\Drivers\Null.SYS
F7B34000 - \SystemRoot\System32\Drivers\Beep.SYS
F79BE000 - \SystemRoot\System32\drivers\vga.sys
F7B36000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7B38000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F79C6000 - \SystemRoot\System32\Drivers\Msfs.SYS
F79CE000 - \SystemRoot\System32\Drivers\Npfs.SYS
F7AA2000 - \SystemRoot\System32\DRIVERS\rasacd.sys
F54F5000 - \SystemRoot\System32\DRIVERS\ipsec.sys
F549C000 - \SystemRoot\System32\DRIVERS\tcpip.sys
F5476000 - \SystemRoot\System32\DRIVERS\ipnat.sys
F544E000 - \SystemRoot\System32\DRIVERS\netbt.sys
F773E000 - \SystemRoot\System32\DRIVERS\wanarp.sys
F542C000 - \SystemRoot\System32\drivers\afd.sys
F774E000 - \SystemRoot\System32\DRIVERS\arp1394.sys
F775E000 - \SystemRoot\System32\DRIVERS\netbios.sys
F5361000 - \SystemRoot\System32\DRIVERS\rdbss.sys
F52F1000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
F777E000 - \SystemRoot\System32\Drivers\Fips.SYS
F52E0000 - \SystemRoot\system32\DRIVERS\avipbb.sys
F5294000 - \SystemRoot\System32\Drivers\Fastfat.SYS
F79DE000 - \SystemRoot\System32\DRIVERS\USBSTOR.SYS
F67EF000 - \??\C:\WINDOWS\system32\Drivers\USBCRFT.SYS
F67E7000 - \SystemRoot\System32\DRIVERS\hidusb.sys
F77BE000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
F79E6000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
F67E3000 - \SystemRoot\System32\DRIVERS\mouhid.sys
F527C000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7B58000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F7A82000 - \SystemRoot\System32\drivers\Dxapi.sys
F79F6000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F7C55000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\nv4_disp.dll
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
F4181000 - \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
F3654000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F7B50000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F37C5000 - \??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS
F3523000 - \SystemRoot\System32\Drivers\HTTP.sys
F799E000 - \??\C:\WINDOWS\System32\drivers\symlcbrd.sys
F3319000 - \SystemRoot\System32\DRIVERS\srv.sys
F3463000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F26CC000 - \SystemRoot\system32\drivers\wdmaud.sys
F3071000 - \SystemRoot\system32\drivers\sysaudio.sys
F1955000 - \??\C:\WINDOWS\system32\PCANDIS5.SYS
F7B3E000 - \??\C:\DOCUME~1\ARNAUD~1.000\LOCALS~1\Temp\mbr.sys
F7C03000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 121

Liste des programmes installes

7-Zip 4.64
ACDSee for PENTAX 2.0
Adobe Flash Player 10 ActiveX
Adobe Photoshop CS
Adobe Reader 9 - Français
Archiveur WinRAR
ASIO4ALL
Assistant de connexion Windows Live
Avira AntiVir Personal - Free Antivirus
AXIS Media Control Embedded
C-Media Azalia Audio Driver
ccCommon
CCleaner (remove only)
Choice Guard
Collab
Complément Microsoft Word pour Microsoft Works Suite
Correctif pour Lecteur Windows Media 11 (KB939683)
Correctif pour Windows Internet Explorer 7 (KB947864)
Correctif pour Windows XP (KB952287)
DivX 5.2.1 (Playback Only)
Encyclopédie Microsoft Encarta 2005
Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP
Final Draft 7
FL Studio 8
Galerie de photos Windows Live
Gestionnaire Internet
Hama Digital Software Suite
Hama USB Mass Storage Device
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
IL Download Manager
iLike Sidebar
Installation Windows Live
Installation Windows Live
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 11
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
Lecteur Windows Media 11
LightScribe 1.8.15.1
livebox
Lotus Notes 6.5.5
Macromedia Dreamweaver 8
Macromedia Extension Manager
Macromedia Fireworks 8
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Macromedia FreeHand 10
Malwarebytes' Anti-Malware
Medion Flash XL 2.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.3
Microsoft Office XP Professional with FrontPage
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Word 2002
Microsoft Works
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)
Mise à jour de sécurité pour Windows XP (KB938464)
Mise à jour de sécurité pour Windows XP (KB941569)
Mise à jour de sécurité pour Windows XP (KB946648)
Mise à jour de sécurité pour Windows XP (KB950760)
Mise à jour de sécurité pour Windows XP (KB950762)
Mise à jour de sécurité pour Windows XP (KB950974)
Mise à jour de sécurité pour Windows XP (KB951066)
Mise à jour de sécurité pour Windows XP (KB951376-v2)
Mise à jour de sécurité pour Windows XP (KB951376)
Mise à jour de sécurité pour Windows XP (KB951698)
Mise à jour de sécurité pour Windows XP (KB951748)
Mise à jour de sécurité pour Windows XP (KB952954)
Mise à jour de sécurité pour Windows XP (KB953839)
Mise à jour de sécurité pour Windows XP (KB954211)
Mise à jour de sécurité pour Windows XP (KB954459)
Mise à jour de sécurité pour Windows XP (KB954600)
Mise à jour de sécurité pour Windows XP (KB955069)
Mise à jour de sécurité pour Windows XP (KB956391)
Mise à jour de sécurité pour Windows XP (KB956802)
Mise à jour de sécurité pour Windows XP (KB956803)
Mise à jour de sécurité pour Windows XP (KB956841)
Mise à jour de sécurité pour Windows XP (KB957095)
Mise à jour de sécurité pour Windows XP (KB957097)
Mise à jour de sécurité pour Windows XP (KB958644)
Mise à jour de sécurité pour Windows XP (KB958687)
Mise à jour pour Windows XP (KB951072-v2)
Mise à jour pour Windows XP (KB951978)
Mise à jour pour Windows XP (KB955839)
Mise à niveau de Works
MSVCRT
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Multimedia Keyboard Driver Ver1.0 (KB-0108)
MUSICMATCH(R) Jukebox
Navigateur Orange
Nero 7 Essentials
Nero 7 Essentials
neroxml
NVIDIA Drivers
Outil de téléchargement Windows Live
Package de base Microsoft de service de chiffrement pour cartes à puce
PIF DESIGNER2.1
PoiZone
PrimoPDF
PrimoPDF Redistribution Package
Prodipe Virtual Expander Lite
Safari
SafeCast Shared Components
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Segoe UI
Shockwave
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
Sélecteur d'installation de Microsoft Works 2005
Synthesia (remove only)
Todae - Live Media
Toxic Biohazard
Uniblue RegistryBooster 2
Uniblue SpeedUpMyPC 3
Uniblue SpyEraser
USB Storage Driver
WebFldrs XP
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool
Windows Imaging Component
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Contrôle parental
Windows Live Mail
Windows Live Mail
Windows Live Messenger
Windows Live Sync
Windows Live Writer
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 9 Series Power Toy - Ratings Migration
Windows Support Tools
Windows XP Service Pack 3

Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\Program Files

25/01/2009 19:08 <REP> .
25/01/2009 19:08 <REP> ..
25/01/2009 09:14 939 698 7z464.exe
25/01/2009 09:14 <REP> 7-Zip
05/01/2008 10:14 <REP> ACD Systems
08/04/2007 13:05 <REP> activePDF
25/01/2009 11:01 <REP> Adobe CS4
11/09/2007 19:59 <REP> Advanced MP3 Converter
07/05/2003 13:52 657 Advanced MP3 Converter v1.81.txt
02/05/2003 17:15 1 616 269 advanced-mp3-converter.exe
29/03/2008 08:45 <REP> Ahead
18/12/2005 23:14 <REP> Andersson Technologies LLC
25/01/2009 18:32 <REP> AntiVir PersonalEdition Classic
13/12/2008 15:05 <REP> Apple Software Update
02/12/2008 21:25 <REP> ASIO4ALL v2
02/10/2006 19:28 <REP> Axis Communications
16/03/2005 21:16 <REP> CA
15/03/2005 22:32 <REP> Caphyon
23/01/2009 11:43 <REP> CCleaner
08/01/2006 18:36 <REP> Common Files
15/03/2005 16:26 <REP> ComPlus Applications
05/05/1999 14:49 463 872 Convert.exe
12/09/2008 20:55 137 399 CS4 Design Premium — Lisez-moi.pdf
25/06/2004 17:22 <REP> CyberLink
07/05/2006 08:03 <REP> DIFX
05/01/2005 22:30 <REP> DigiDesign
25/01/2009 09:12 <REP> DivX
21/01/2009 13:41 <REP> eMule
04/06/2005 14:25 <REP> Encarta
03/11/2007 19:20 <REP> epson
25/01/2009 09:25 <REP> EsetOnlineScanner
23/01/2009 15:42 <REP> Fichiers communs
26/03/2005 17:35 <REP> FileZilla
19/01/2009 11:52 <REP> Final Draft 7
03/04/2005 11:27 <REP> Final Draft Tagger
13/01/2007 12:49 <REP> Hama
25/06/2004 18:58 <REP> HighMAT CD Writing Wizard
03/11/2007 18:35 <REP> Home Cinema
21/01/2009 09:24 <REP> iLike
02/12/2008 21:25 <REP> Image-Line
21/11/2004 20:47 <REP> i-Media
25/06/2004 16:54 <REP> Intel
09/12/2008 23:17 <REP> Internet Explorer
03/11/2007 18:46 <REP> IrfanView
16/12/2008 13:32 <REP> Java
23/01/2009 11:46 <REP> Logitech
04/04/2007 20:28 <REP> lotus
25/01/2009 20:13 <REP> Macromedia
25/01/2009 09:12 <REP> Make bootable flashcards
21/01/2009 12:21 <REP> Malwarebytes' Anti-Malware
25/03/2007 11:16 <REP> Messagerie Internet Orange
25/01/2009 09:12 <REP> Messenger
29/12/2008 08:04 <REP> Microsoft
08/11/2004 07:27 <REP> Microsoft ActiveSync
25/03/2005 21:23 <REP> Microsoft Baseline Security Analyzer
12/05/2007 17:43 <REP> Microsoft CAPICOM 2.1.0.2
25/06/2004 16:14 <REP> microsoft frontpage
26/03/2005 17:54 <REP> Microsoft IntelliPoint
03/11/2007 18:43 <REP> Microsoft Money 2005
04/06/2005 14:15 <REP> microsoft Office
01/03/2008 07:55 <REP> Microsoft SQL Server Compact Edition
08/11/2004 07:27 <REP> Microsoft Visual Studio
11/12/2005 14:27 <REP> Microsoft Works
04/06/2005 14:07 <REP> Microsoft Works Suite 2005
02/10/2004 14:13 <REP> Mindscape
20/09/2008 06:25 <REP> Movie Maker
10/10/2007 06:21 <REP> Mozilla Firefox
20/09/2008 06:25 <REP> msn
06/11/2004 07:41 <REP> MSN Apps
25/06/2004 16:13 <REP> MSN Gaming Zone
14/10/2006 09:22 <REP> MSXML 4.0
25/06/2004 17:24 <REP> MUSICMATCH
29/03/2008 19:09 <REP> Nero
20/09/2008 06:22 <REP> NetMeeting
25/01/2009 16:40 <REP> NOS
26/03/2005 09:34 <REP> OfficeUpdate11
20/09/2008 06:22 <REP> Outlook Express
02/12/2008 21:25 <REP> Outsim
27/12/2004 21:12 <REP> php-5.0.3
23/05/2008 08:11 <REP> Picture It! Premium 10
19/01/2008 16:59 869 376 Printkey2000.exe
02/12/2008 20:20 <REP> Prodipe
21/01/2009 14:08 <REP> QuickTime
08/07/2004 16:00 <REP> Real
23/01/2009 12:58 <REP> RegCleaner
21/03/2005 21:29 <REP> Registry Mechanic
14/07/2008 10:31 <REP> Safari
05/08/2008 21:52 <REP> SAGEM
06/10/2007 09:10 <REP> SAGEM Wi-Fi USB 802.11g
04/10/2007 19:06 <REP> Securitoo
11/12/2005 14:27 <REP> Security Box
25/06/2004 16:13 <REP> Services en ligne
10/11/2008 08:06 <REP> Spybot - Search & Destroy
13/12/2008 15:07 <REP> SpywareBlaster
23/05/2008 08:09 <REP> Support Tools
16/11/2008 15:05 <REP> Synthesia
25/01/2009 19:13 <REP> Trend Micro
23/05/2008 08:01 <REP> Uniblue
04/11/2008 19:51 <REP> uTorrent
04/11/2008 19:50 270 128 utorrent.exe
02/12/2008 21:25 <REP> VstPlugins
26/01/2009 09:09 <REP> Wanadoo
22/03/2007 07:56 <REP> Windows Defender
25/06/2004 17:35 <REP> Windows Journal Viewer
29/12/2008 08:04 <REP> Windows Live
29/12/2008 08:01 <REP> Windows Live SkyDrive
25/01/2009 09:12 <REP> Windows Media Connect 2
25/01/2009 09:12 <REP> Windows Media Player
21/01/2009 13:52 <REP> Windows NT
03/03/2008 20:51 <REP> WinRAR
25/06/2004 16:14 <REP> xerox
03/11/2007 18:33 <REP> XVideoConverter
7 fichier(s) 4 297 399 octets
105 Rép(s) 60 679 307 264 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\Program Files\fichiers communs

23/01/2009 15:42 <REP> .
23/01/2009 15:42 <REP> ..
05/01/2008 10:14 <REP> ACD Systems
25/01/2009 14:13 <REP> Adobe
11/11/2004 16:57 <REP> Adobe Systems Shared
15/05/2008 16:51 <REP> Ahead
18/10/2004 06:07 <REP> AOL
13/01/2007 12:50 <REP> ArcSoft
08/11/2004 07:27 <REP> Designer
24/11/2004 07:49 <REP> Digidesign
16/10/2004 16:58 <REP> InstallShield
19/03/2005 16:09 <REP> Java
08/11/2004 07:26 <REP> L&H
30/03/2008 00:01 <REP> LightScribe
03/11/2007 22:42 <REP> Logitech
08/01/2006 23:47 <REP> Macromedia
06/11/2004 23:12 <REP> Macromedia Shared
22/01/2009 16:47 <REP> Macrovision Shared
29/12/2008 08:01 <REP> Microsoft Shared
25/06/2004 16:13 <REP> MSSoap
08/07/2004 16:01 <REP> Nullsoft
25/06/2004 17:11 <REP> ODBC
21/01/2009 17:57 <REP> Real
20/01/2009 23:46 <REP> Services
25/06/2004 17:11 <REP> SpeechEngines
30/03/2005 20:32 <REP> Symantec Shared
20/09/2008 06:22 <REP> System
03/11/2007 18:30 <REP> Teleca Shared
18/10/2008 07:13 <REP> Windows Live
28/12/2008 21:44 <REP> Wise Installation Wizard
08/07/2004 16:07 <REP> xing shared
0 fichier(s) 0 octets
31 Rép(s) 60 679 311 360 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

19/01/2006 15:47 <REP> .
19/01/2006 15:47 <REP> ..
08/11/2004 07:27 <REP> 1033
04/06/2005 14:16 <REP> 1036
25/03/2003 18:38 1 327 104 MSONSEXT.DLL
13/02/2001 00:23 58 784 MSOSV.DLL
03/06/1999 13:09 122 937 MSOWS409.DLL
07/03/2001 08:00 127 033 MSOWS40c.DLL
06/08/2000 09:04 401 462 MSVCP60.DLL
22/01/2001 03:25 69 632 PKMAXCTL.DLL
22/01/2001 03:25 872 448 PKMCDO.DLL
22/01/2001 03:25 159 744 PKMCORE.DLL
07/02/2001 09:59 106 496 PKMFORMS.DLL
22/01/2001 03:25 671 744 PKMRES.DLL
22/01/2001 03:25 28 672 PKMSSTLB.DLL
22/01/2001 03:25 40 960 PKMTEMPL.DLL
22/01/2001 03:25 24 576 PKMTRACE.DLL
22/01/2001 03:25 86 016 PKMWS.DLL
22/01/2001 03:25 237 568 PROMDEMO.DLL
22/01/2001 03:25 184 320 SECMGR.DLL
22/01/2001 03:25 323 584 VAIDDMGR.DLL
22/01/2001 03:25 32 768 VAIMEM.DLL
18 fichier(s) 4 875 848 octets
4 Rép(s) 60 679 307 264 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\Program Files\common files

08/01/2006 18:36 <REP> .
08/01/2006 18:36 <REP> ..
08/07/2004 16:58 <REP> System
08/07/2004 16:12 <REP> X10
0 fichier(s) 0 octets
4 Rép(s) 60 679 307 264 octets libres
Le volume dans le lecteur C s'appelle BOOT
Le numéro de série du volume est 646C-6A9F

Répertoire de C:\

24/05/2001 11:59 162 304 UNWISE.EXE
1 fichier(s) 162 304 octets
0 Rép(s) 60 679 307 264 octets libres

c:\Documents and Settings\All Users.WINDOWS\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\uninstaller.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D171.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D172.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D173.exe
c:\Documents and Settin

@CharliekSuite et fin du rapport (ça a coupé) :
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\Installer\{78D62D17-D970-42DA-B8CF-5E5576293B33}\Icon78D62D174.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\RSIT.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\ToolsCleaner2.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\WinRAR.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\mbr.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\Psinfo.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\HostsXpert\HostsXpert.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\IS\Programme d'installation d'Adobe Reader 9\Setup.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\DoctorWeb\Quarantine\A0177961.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\DoctorWeb\Quarantine\FindyKill.exe
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\DoctorWeb\Quarantine\Process.exe
c:\Documents and Settings\NetworkService.AUTORITE NT.001\Local Settings\Application Data\Apple\Apple Software Update\SetupAdmin.exe
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aecore.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aeemu.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aegen.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aehelp.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aeheur.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aeoffice.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aepack.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aerdl.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aescn.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aescript.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\aevdf.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\BACKUP\FAILSAFE\avewin32.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition classic\TEMP\AVUPDATE_45adc8b7\LicTest\avwinll.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Windows Defender\Definition Updates\{BB8DA457-6D12-4AB5-B64F-D13310AE5653}\mpengine.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
c:\Documents and Settings\All Users.WINDOWS\Application Data\Nero\DrWeb\Drweb32.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Dreamweaver 8\Configuration\Flash Player\FlashPlayerW.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Dreamweaver 8\Configuration\JSExtensions\PDFile.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Dreamweaver 8\Configuration\JSExtensions\PDZip.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Flash MX\Configuration\authplay.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Flash MX\Configuration\Importers\AIImport.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Flash MX\Configuration\Importers\FhDbRdr.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Flash MX\Configuration\Importers\Fireworks Importer.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Macromedia\Flash MX\Configuration\Importers\ToonboomStudioImportPlugin.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Mozilla\Firefox\Profiles\vwkagdu3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Mozilla\Firefox\Profiles\vwkagdu3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
c:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Local Settings\Application Data\Macromedia\Flash 8\en\Configuration\External Libraries\FLfile.dll
c:\Documents and Settings\LocalService.AUTORITE NT\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
c:\Documents and Settings\LocalService.AUTORITE NT.001\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

Alors voici les deux rapports :
Logfile of random's system information tool 1.05 (written by random/random)
Run by Arnaud Meunier at 2009-01-25 19:13:12
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 58 GB (60%) free of 95 GB
Total RAM: 1023 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:13:36, on 25/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\umonit.exe
C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Printkey2000.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\RSIT.exe
C:\Program Files\trend micro\Arnaud Meunier.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.criticsonline.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PVE_Lite] "C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [iLike] C:\Program Files\iLike\1.2.11\ilikesidebar.exe /checkforupdate (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Lancer le Gestionnaire Internet.lnk = C:\Program Files\Wanadoo\GestMAJ.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O15 - Trusted Zone: http://webmail-lhr.expeditors.com
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - https://login.orange.fr/captcha?return_url=https%3A%2F%2Fmescontacts.orange.fr
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} (F5 Networks Auto Update) -
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111847736609
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - https://www.epson.eu/support/
O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} - http://photos.wanadoo.fr/al/presentation/pc/resources/activex/Ephoto.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://livekuva.suomi.net/activex/AMC.cab
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} (F5 Networks OS Policy Agent) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\WINDOWS\system32\nslsvice.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Super Ad Blocker (SABSVC) - SuperAdBlocker.com - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

@CharliekPr info. j'ai fait tourner ce matin spyeraser (0 erreurs), pc non rebooté depuis et lors d'un nouveauscan voilà ce qui ressort (aucun de ces sites n'a été visité aujourd'hui)

Infected registry keys/values detected
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\198732
4.com\www\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\awmdab
est.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\blazef
ind.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\clicks
pring.net\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\crazyw
innings.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\elitem
ediagroup.net\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\master
69.biz\www\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\media-
motor.net\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\mt-dow
nload.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\scoobi
doo.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\search
miracle.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\sgrunt
.biz\www\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\skoobi
doo.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotch
.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotch
bar.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\topcon
verting.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\windup
dates.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoo
lbar.com\
hkey_current_user\software\microsoft\windows\currentversion\internet settings\zonemap\domains\ysbweb
.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\awmda
best.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\blaze
find.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\click
spring.net\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\crazy
winnings.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\mt-do
wnload.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\scoob
idoo.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\searc
hmiracle.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\skoob
idoo.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotc
h.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotc
hbar.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\topco
nverting.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\windu
pdates.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxto
olbar.com\
hkey_local_machine\software\microsoft\windows\currentversion\internet settings\zonemap\domains\ysbwe
b.com\

Je passe Ccleaner au démarrage systématiquement mais même en le repassant après ce fichier s'accroche et je ne peux pas l'effacer manuellement (utilisé par qqch).

J'attends de tes nouvelles !

Merci encore pr ton aide et le temps passé sur ces soucis difficiles !

Ok, pr info est-ce que ce truc Perflib c'est dangereux ? qu'est-ce qu'il fait ?

> Alors pr info ce matin, seul ce fichier est retrouvé par Windows :
Perflib_Perfdata_750.dat

> Et voilà le résultat de GenProc :
Rapport GenProc 2.346 [1] - 25/01/2009 - Windows XP

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
- C:\Program Files\EsetOnlineScanner\log.txt

__________________________________________________________________________________________________________

Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com

Salut,

Voici le rapport Otmoveit :
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_USERS\S-1-5-21-1957994488-484061587-725345543-1004\Sof­tware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2­\E\Shell\AutoRun\command not found.
Registry key HKEY_USERS\S-1-5-21-1957994488-484061587-725345543-1004\Sof­tware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2­\E\Shell\Open\command not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\ARNAUD~1.000\LOCALS~1\Temp\Perflib_Perfdata_a68.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_6a0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\TMP0000003DC73C853791B7E596 scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01242009_091424

Et voici le hijack this après reboot également :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:20:52, on 24/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\umonit.exe
C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.criticsonline.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PVE_Lite] "C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [iLike] C:\Program Files\iLike\1.2.11\ilikesidebar.exe /checkforupdate (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Lancer le Gestionnaire Internet.lnk = C:\Program Files\Wanadoo\GestMAJ.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O15 - Trusted Zone: http://webmail-lhr.expeditors.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - https://login.orange.fr/captcha?return_url=https%3A%2F%2Fmescontacts.orange.fr
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} (F5 Networks Auto Update) -
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111847736609
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - https://www.epson.eu/support/
O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} - http://photos.wanadoo.fr/al/presentation/pc/resources/activex/Ephoto.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://livekuva.suomi.net/activex/AMC.cab
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} (F5 Networks OS Policy Agent) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\WINDOWS\system32\nslsvice.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Super Ad Blocker (SABSVC) - SuperAdBlocker.com - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

ok je te tiens au courant (je pense que Dr web va bien tourner encore une heure)

@CharliekAlors fin du scan Dr Web. Les deux seuls fichiers avec icône sur lequel je peux agir sont les deux programmes Smitfraudfix.

Est-ce que je reboot pr le nettoyage ou je mets tout en quarantaine ?

RegUBP2b-Arnaud Meunier.reg C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy\Snapshots2 Trojan.StartPage.1505 Supprimé.

FindyKill.exe\data011 C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\FindyKill.exe Tool.Prockill

FindyKill.exe C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau L'archive contient des éléments infectés Quarantaine.

Process.exe C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\IS\SmitfraudFix Tool.Prockill

restart.exe C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\IS\SmitfraudFix Tool.ShutDown.14

A0177960.reg C:\System Volume Information\_restore{06F68E53-00BC-4B00-AF56-317698F0D65B}\RP1348 Trojan.StartPage.1505 Supprimé.

A0177961.exe\data011 C:\System Volume Information\_restore{06F68E53-00BC-4B00-AF56-317698F0D65B}\RP1348\A0177961.exe Tool.Prockill

A0177961.exe C:\System Volume Information\_restore{06F68E53-00BC-4B00-AF56-317698F0D65B}\RP1348 L'archive contient des éléments infectés Quarantaine.

A0021919.reg C:\System Volume Information\_restore{A61B6F04-AF7F-45C2-99EF-530A20F7F002}\RP65 Trojan.StartPage.1505 Supprimé.

@Charliekbon j'ai mis en quarantaine ce qui pouvait l'être, j'ai rebooté ms pc bloqué sur fermeture windows,alors j'ai éteint et rallumé.

Voici le rapport Hijack this :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:18:44, on 23/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\umonit.exe
C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Arnaud Meunier.ARNAUD-PC1.000\Bureau\launch.exe
C:\DOCUME~1\ARNAUD~1.000\LOCALS~1\Temp\RarSFX0\_start.exe
C:\DOCUME~1\ARNAUD~1.000\LOCALS~1\Temp\RarSFX0\setup.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.criticsonline.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PVE_Lite] "C:\Program Files\Prodipe\Prodipe\PVE_Lite\PVE_GMMode_Lite.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [iLike] C:\Program Files\iLike\1.2.11\ilikesidebar.exe /checkforupdate (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Lancer le Gestionnaire Internet.lnk = C:\Program Files\Wanadoo\GestMAJ.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O15 - Trusted Zone: http://webmail-lhr.expeditors.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - https://login.orange.fr/captcha?return_url=https%3A%2F%2Fmescontacts.orange.fr
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} (F5 Networks Auto Update) -
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111847736609
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - https://www.epson.eu/support/
O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} - http://photos.wanadoo.fr/al/presentation/pc/resources/activex/Ephoto.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://livekuva.suomi.net/activex/AMC.cab
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} (F5 Networks OS Policy Agent) - http://webmail-lhr.expeditors.com/...
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\WINDOWS\system32\nslsvice.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Super Ad Blocker (SABSVC) - SuperAdBlocker.com - D:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

effectivement, je pensais qu'il les fallait. Voici le nouveau rapport.

23/01/2009 ---- 18:39:11,32

----------------------------------
§§§§§§ [resycled] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

[HKEY_USERS\S-1-5-21-1957994488-484061587-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\AutoRun\command]
@="C:\\WINDOWS\\system32\\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\\ntldr.com e:"

[HKEY_USERS\S-1-5-21-1957994488-484061587-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\Open\command]
@="E:\\resycled\\ntldr.com e:"

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

Je fais tourner en ce moment Cureit en analyse complète

Pr info Spyeraser trouve ces pb de registres dt un "disableregistrytools"

Category: Malware (General)
Infected registry keys/values detected
hkey_current_user\software\wget\
hkey_local_machine\software\microsoft\windows\currentversion\control panel\load\
hkey_local_machine\software\microsoft\windows\currentversion\policies\system\disableregistrytools\

Ok, là Cureit tourne je le laisse aller au bout avant de repasser à Combo?

Voilà déjà le premier rapport OAD :
23/01/2009 ---- 15:13:01,64

----------------------------------
§§§§§§ [: resycled ] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

Aucune entrée détectée

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

@Charliek2nd rapport OAD :
23/01/2009 ---- 15:20:03,98

----------------------------------
§§§§§§ [c:\windows\system32\drivers\7c5c634b.sys] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

Aucune entrée détectée

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

Je passe à Drweb cureit