Pub snappyads

Farna -  
Bonjour, depuis environ une semaine j'ai une fenêtre explorer qui s'ouvre. Elle porte le nom de RON ads by snappyads.
J'ai fait un hijack this voici le rapport log :

Logfile of random's system information tool 1.05 (written by random/random)
Run by Sandra Laurence at 2009-02-12 22:43:08
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 59 GB (77%) free of 76 GB
Total RAM: 1279 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:43:38, on 2009-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sandra Laurence\Bureau\RSIT.exe
C:\Program Files\trend micro\Sandra Laurence.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: snappyads browser enhancer - {9F725D00-0F3C-C285-E769-568FD41B7113} - C:\WINDOWS\system32\zjvuamsqcfhu.dll
O2 - BHO: snappyads - {b4445449-934e-a8a3-7165-56fafc3d7dd4} - C:\WINDOWS\system32\nst258C.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mkmlvbgqrpelq] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\zjvuamsqcfhu.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

--
End of file - 8494 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Sandra Laurence.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-22 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
CNisExtBho Class - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2004-08-31 103568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F725D00-0F3C-C285-E769-568FD41B7113}]
snappyads browser enhancer - C:\WINDOWS\system32\zjvuamsqcfhu.dll [2009-01-23 302080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b4445449-934e-a8a3-7165-56fafc3d7dd4}]
snappyads - C:\WINDOWS\system32\nst258C.dll [2009-02-04 698880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2005-01-10 218736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-22 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-22 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - Norton Internet Security - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2004-08-31 103568]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2005-01-10 218736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2003-05-30 585728]
"ccApp"=C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe [2008-01-17 58728]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe [2009-01-06 100056]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-22 136600]
"mkmlvbgqrpelq"=C:\WINDOWS\System32\regsvr32.exe [2006-03-02 12288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"SansaDispatch"=C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe [2009-01-29 79872]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Wireless Configuration Utility HW.51.lnk - C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-11-30 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-02-12 22:43:21 ----D---- C:\Program Files\trend micro
2009-02-12 22:43:08 ----D---- C:\rsit
2009-02-12 03:01:18 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-02-05 16:19:45 ----A---- C:\WINDOWS\system32\ptpusb.dll
2009-02-05 16:19:43 ----A---- C:\WINDOWS\system32\ptpusd.dll
2009-02-05 03:21:01 ----A---- C:\WINDOWS\system32\414ee295-9566-1070-5bde-bb57783c87be.exe
2009-02-05 03:00:58 ----D---- C:\Program Files\MSXML 6.0
2009-02-05 03:00:30 ----HDC---- C:\WINDOWS\$NtUninstallKB925720$
2009-02-04 17:23:29 ----A---- C:\MDL 2.0 Debug.txt
2009-02-04 17:23:17 ----D---- C:\Program Files\MessengerDiscovery
2009-02-04 09:13:48 ----A---- C:\WINDOWS\system32\nst258C.dll
2009-02-03 23:30:46 ----D---- C:\Program Files\AutoCAD 2009
2009-02-03 23:30:46 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2009-02-03 23:30:03 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2009-02-03 23:29:55 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-02-03 23:29:22 ----D---- C:\Program Files\Fichiers communs\Designer
2009-02-03 23:29:12 ----D---- C:\Program Files\Microsoft Office
2009-02-03 23:28:12 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-02-03 23:25:58 ----D---- C:\Program Files\MSBuild
2009-02-03 23:22:02 ----D---- C:\WINDOWS\system32\XPSViewer
2009-02-03 23:22:00 ----D---- C:\WINDOWS\system32\en-us
2009-02-03 23:20:16 ----D---- C:\Program Files\Fichiers communs\Autodesk Shared
2009-02-03 23:20:16 ----D---- C:\Program Files\Autodesk
2009-02-03 23:20:16 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Autodesk
2009-02-03 22:23:31 ----D---- C:\Program Files\Reference Assemblies
2009-02-03 22:22:53 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-02-03 22:16:33 ----RSD---- C:\WINDOWS\assembly
2009-02-03 22:15:06 ----D---- C:\WINDOWS\Microsoft.NET
2009-02-03 22:13:43 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
2009-02-03 22:11:56 ----D---- C:\09820e7398e0f4dcda8a
2009-02-03 22:02:47 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-02-02 14:18:15 ----A---- C:\WINDOWS\system32\d3dpmesh32.dll
2009-02-02 14:18:14 ----A---- C:\WINDOWS\system32\d3dim3232.dll
2009-02-02 14:18:14 ----A---- C:\WINDOWS\system32\d3dim32.dll
2009-02-02 00:55:45 ----A---- C:\WINDOWS\system32\ir32_3232.dll
2009-02-02 00:43:16 ----A---- C:\WINDOWS\system32\undefined-remove.exe
2009-02-02 00:43:00 ----A---- C:\WINDOWS\system32\yfypdoqmdorxivwme.exe
2009-02-01 09:46:20 ----D---- C:\WINDOWS\Sun
2009-01-29 14:24:44 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk
2009-01-29 12:37:41 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\WinRAR
2009-01-29 12:37:28 ----D---- C:\Program Files\WinRAR
2009-01-29 12:22:33 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\OpenOffice.org
2009-01-29 12:19:33 ----D---- C:\Program Files\OpenOffice.org 3
2009-01-29 03:01:18 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-01-29 03:00:57 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-01-29 03:00:42 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-01-28 01:26:49 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-01-28 01:26:43 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-01-28 01:26:20 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-01-28 01:26:09 ----D---- C:\Program Files\Windows Media Connect 2
2009-01-28 01:25:54 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-01-28 01:23:06 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-01-27 15:56:03 ----A---- C:\WINDOWS\system32\lfgif13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltkrn13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltimg13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltfil13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltefx13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltdis13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\lfcmp13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\lfbmp13n.dll
2009-01-23 21:11:22 ----A---- C:\WINDOWS\system32\zjvuamsqcfhu.dll
2009-01-22 04:13:13 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-01-22 04:12:26 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-01-22 04:11:41 ----D---- C:\Program Files\MSXML 4.0
2009-01-22 02:25:44 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\LimeWire
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\javaws.exe
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\javaw.exe
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\java.exe
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-01-22 02:24:31 ----D---- C:\Program Files\Java
2009-01-22 02:23:33 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Sun
2009-01-22 02:20:28 ----D---- C:\Program Files\LimeWire
2009-01-22 01:50:41 ----D---- C:\Program Files\Motorola
2009-01-22 01:49:58 ----D---- C:\Program Files\Common Files
2009-01-22 01:45:28 ----D---- C:\Program Files\Avanquest update
2009-01-22 01:45:11 ----A---- C:\WINDOWS\ModemLog_Motorola USB Modem.txt
2009-01-22 01:44:08 ----HDC---- C:\WINDOWS\$NtUninstallWdf01005$
2009-01-22 01:38:37 ----HDC---- C:\WINDOWS\$NtUninstallKB926239$
2009-01-22 01:37:48 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-01-22 01:36:39 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-01-22 01:34:41 ----D---- C:\Program Files\Fichiers communs\Motorola Shared
2009-01-22 01:34:36 ----D---- C:\Program Files\Motorola Phone Tools
2009-01-22 01:34:36 ----D---- C:\Documents and Settings\All Users\Application Data\BVRP Software
2009-01-22 01:34:04 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\InstallShield
2009-01-19 03:00:50 ----D---- C:\WINDOWS\ie7updates
2009-01-18 21:54:29 ----D---- C:\Program Files\PokerStars
2009-01-18 06:16:37 ----D---- C:\WINDOWS\WBEM
2009-01-18 06:16:35 ----D---- C:\WINDOWS\system32\fr-fr
2009-01-18 06:15:15 ----HDC---- C:\WINDOWS\ie7
2009-01-18 06:14:46 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-01-18 06:14:03 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-01-18 06:13:15 ----HDC---- C:\WINDOWS\$NtUninstallKB915865$
2009-01-18 06:13:02 ----N---- C:\WINDOWS\system32\xmllite.dll
2009-01-18 06:06:41 ----A---- C:\WINDOWS\system32\MRT.exe
2009-01-14 03:02:33 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-01-14 03:02:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-01-13 10:37:08 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Media Player Classic

======List of files/folders modified in the last 1 months======

2009-02-12 22:43:21 ----RD---- C:\Program Files
2009-02-12 22:43:21 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
2009-02-12 22:43:04 ----D---- C:\WINDOWS\Prefetch
2009-02-12 22:42:29 ----D---- C:\WINDOWS\Temp
2009-02-12 22:24:29 ----D---- C:\Program Files\Mozilla Firefox
2009-02-12 21:28:13 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-12 21:28:04 ----D---- C:\Program Files\Fichiers communs
2009-02-12 21:25:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-12 11:09:41 ----HD---- C:\WINDOWS\inf
2009-02-12 05:00:06 ----D---- C:\WINDOWS
2009-02-12 04:59:40 ----D---- C:\WINDOWS\system32
2009-02-12 04:59:40 ----D---- C:\Program Files\Internet Explorer
2009-02-12 03:01:17 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-12 03:01:13 ----A---- C:\WINDOWS\imsins.BAK
2009-02-12 03:01:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-02-11 23:26:12 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Azureus
2009-02-07 00:31:09 ----D---- C:\Program Files\MSN Messenger
2009-02-05 16:19:43 ----D---- C:\WINDOWS\system32\drivers
2009-02-05 03:01:01 ----SHD---- C:\WINDOWS\Installer
2009-02-03 23:42:33 ----RSD---- C:\WINDOWS\Fonts
2009-02-03 23:41:10 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-02-03 23:32:42 ----D---- C:\WINDOWS\Help
2009-02-03 23:30:08 ----D---- C:\WINDOWS\system32\DirectX
2009-02-03 23:29:15 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-02-03 23:28:01 ----D---- C:\WINDOWS\system32\mui
2009-02-03 23:26:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-02-03 22:23:15 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-02-03 22:23:13 ----D---- C:\WINDOWS\system32\spool
2009-02-03 22:16:36 ----D---- C:\WINDOWS\WinSxS
2009-01-30 06:30:46 ----D---- C:\Program Files\Norton Internet Security
2009-01-28 14:37:09 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-01-28 14:37:09 ----D---- C:\WINDOWS\system32\CatRoot
2009-01-28 01:26:22 ----A---- C:\WINDOWS\win.ini
2009-01-28 01:26:09 ----D---- C:\Program Files\Windows Media Player
2009-01-26 21:19:02 ----D---- C:\Program Files\Vuze
2009-01-23 21:07:43 ----D---- C:\WINDOWS\AppPatch
2009-01-22 01:49:29 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-01-22 01:45:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-22 01:36:51 ----D---- C:\WINDOWS\system32\LogFiles
2009-01-18 06:16:51 ----D---- C:\WINDOWS\system32\config
2009-01-18 06:16:26 ----D---- C:\WINDOWS\Media
2009-01-18 06:06:42 ----D---- C:\WINDOWS\Debug
2009-01-16 21:15:42 ----A---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 40320]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-03-28 266552]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-11-30 928256]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20090211.004\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20090211.004\NavEx15.Sys []
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-03-28 11480]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-03-28 171928]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-03-28 37016]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20090129.001\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-03-28 47192]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-03-28 18904]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-03-02 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-19 235100]
S3 motmodem;Motorola USB CDC ACM Driver; C:\WINDOWS\system32\DRIVERS\motmodem.sys []
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2006-03-02 5888]
S3 USB_RNDIS;Arris Remote NDIS Network Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2006-03-02 12672]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 W8335XP;IEEE 802.11g Wireless Cardbus/PCI Adapter HW51; C:\WINDOWS\system32\DRIVERS\Mrv8000c.sys [2004-12-24 253440]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-11-30 425984]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe [2008-01-17 197992]
R2 ccProxy;Symantec Network Proxy; C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe [2006-06-14 235168]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe [2008-01-17 181608]
R2 ISSVC;ISSvc; C:\Program Files\Norton Internet Security\ISSVC.exe [2005-04-18 83584]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-22 152984]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe [2005-01-10 177264]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe [2007-03-28 206552]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe [2004-07-21 173160]
R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2006-03-02 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-11-30 516096]
S2 SBService;ScriptBlocking Service; C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe [2005-01-10 67184]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2009-02-03 85096]
S3 ccPwdSvc;Symantec Password Validation; C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe [2008-01-17 79208]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 SAVScan;SAVScan; C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe [2004-12-10 198368]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

et le rapport info :

Logfile of random's system information tool 1.05 (written by random/random)
Run by Sandra Laurence at 2009-02-12 22:43:08
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 59 GB (77%) free of 76 GB
Total RAM: 1279 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:43:38, on 2009-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sandra Laurence\Bureau\RSIT.exe
C:\Program Files\trend micro\Sandra Laurence.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: snappyads browser enhancer - {9F725D00-0F3C-C285-E769-568FD41B7113} - C:\WINDOWS\system32\zjvuamsqcfhu.dll
O2 - BHO: snappyads - {b4445449-934e-a8a3-7165-56fafc3d7dd4} - C:\WINDOWS\system32\nst258C.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mkmlvbgqrpelq] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\zjvuamsqcfhu.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

--
End of file - 8494 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Sandra Laurence.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-22 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
CNisExtBho Class - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2004-08-31 103568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F725D00-0F3C-C285-E769-568FD41B7113}]
snappyads browser enhancer - C:\WINDOWS\system32\zjvuamsqcfhu.dll [2009-01-23 302080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b4445449-934e-a8a3-7165-56fafc3d7dd4}]
snappyads - C:\WINDOWS\system32\nst258C.dll [2009-02-04 698880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2005-01-10 218736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-22 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-22 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - Norton Internet Security - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2004-08-31 103568]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2005-01-10 218736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2003-05-30 585728]
"ccApp"=C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe [2008-01-17 58728]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe [2009-01-06 100056]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-22 136600]
"mkmlvbgqrpelq"=C:\WINDOWS\System32\regsvr32.exe [2006-03-02 12288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"SansaDispatch"=C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe [2009-01-29 79872]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Wireless Configuration Utility HW.51.lnk - C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-11-30 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-02-12 22:43:21 ----D---- C:\Program Files\trend micro
2009-02-12 22:43:08 ----D---- C:\rsit
2009-02-12 03:01:18 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-02-05 16:19:45 ----A---- C:\WINDOWS\system32\ptpusb.dll
2009-02-05 16:19:43 ----A---- C:\WINDOWS\system32\ptpusd.dll
2009-02-05 03:21:01 ----A---- C:\WINDOWS\system32\414ee295-9566-1070-5bde-bb57783c87be.exe
2009-02-05 03:00:58 ----D---- C:\Program Files\MSXML 6.0
2009-02-05 03:00:30 ----HDC---- C:\WINDOWS\$NtUninstallKB925720$
2009-02-04 17:23:29 ----A---- C:\MDL 2.0 Debug.txt
2009-02-04 17:23:17 ----D---- C:\Program Files\MessengerDiscovery
2009-02-04 09:13:48 ----A---- C:\WINDOWS\system32\nst258C.dll
2009-02-03 23:30:46 ----D---- C:\Program Files\AutoCAD 2009
2009-02-03 23:30:46 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2009-02-03 23:30:03 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2009-02-03 23:29:55 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-02-03 23:29:22 ----D---- C:\Program Files\Fichiers communs\Designer
2009-02-03 23:29:12 ----D---- C:\Program Files\Microsoft Office
2009-02-03 23:28:12 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-02-03 23:25:58 ----D---- C:\Program Files\MSBuild
2009-02-03 23:22:02 ----D---- C:\WINDOWS\system32\XPSViewer
2009-02-03 23:22:00 ----D---- C:\WINDOWS\system32\en-us
2009-02-03 23:20:16 ----D---- C:\Program Files\Fichiers communs\Autodesk Shared
2009-02-03 23:20:16 ----D---- C:\Program Files\Autodesk
2009-02-03 23:20:16 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Autodesk
2009-02-03 22:23:31 ----D---- C:\Program Files\Reference Assemblies
2009-02-03 22:22:53 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-02-03 22:16:33 ----RSD---- C:\WINDOWS\assembly
2009-02-03 22:15:06 ----D---- C:\WINDOWS\Microsoft.NET
2009-02-03 22:13:43 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
2009-02-03 22:11:56 ----D---- C:\09820e7398e0f4dcda8a
2009-02-03 22:02:47 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-02-02 14:18:15 ----A---- C:\WINDOWS\system32\d3dpmesh32.dll
2009-02-02 14:18:14 ----A---- C:\WINDOWS\system32\d3dim3232.dll
2009-02-02 14:18:14 ----A---- C:\WINDOWS\system32\d3dim32.dll
2009-02-02 00:55:45 ----A---- C:\WINDOWS\system32\ir32_3232.dll
2009-02-02 00:43:16 ----A---- C:\WINDOWS\system32\undefined-remove.exe
2009-02-02 00:43:00 ----A---- C:\WINDOWS\system32\yfypdoqmdorxivwme.exe
2009-02-01 09:46:20 ----D---- C:\WINDOWS\Sun
2009-01-29 14:24:44 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk
2009-01-29 12:37:41 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\WinRAR
2009-01-29 12:37:28 ----D---- C:\Program Files\WinRAR
2009-01-29 12:22:33 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\OpenOffice.org
2009-01-29 12:19:33 ----D---- C:\Program Files\OpenOffice.org 3
2009-01-29 03:01:18 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-01-29 03:00:57 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-01-29 03:00:42 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-01-28 01:26:49 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-01-28 01:26:43 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-01-28 01:26:20 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-01-28 01:26:09 ----D---- C:\Program Files\Windows Media Connect 2
2009-01-28 01:25:54 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-01-28 01:23:06 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-01-27 15:56:03 ----A---- C:\WINDOWS\system32\lfgif13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltkrn13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltimg13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltfil13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltefx13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\ltdis13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\lfcmp13n.dll
2009-01-27 15:56:02 ----A---- C:\WINDOWS\system32\lfbmp13n.dll
2009-01-23 21:11:22 ----A---- C:\WINDOWS\system32\zjvuamsqcfhu.dll
2009-01-22 04:13:13 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-01-22 04:12:26 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-01-22 04:11:41 ----D---- C:\Program Files\MSXML 4.0
2009-01-22 02:25:44 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\LimeWire
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\javaws.exe
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\javaw.exe
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\java.exe
2009-01-22 02:24:59 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-01-22 02:24:31 ----D---- C:\Program Files\Java
2009-01-22 02:23:33 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Sun
2009-01-22 02:20:28 ----D---- C:\Program Files\LimeWire
2009-01-22 01:50:41 ----D---- C:\Program Files\Motorola
2009-01-22 01:49:58 ----D---- C:\Program Files\Common Files
2009-01-22 01:45:28 ----D---- C:\Program Files\Avanquest update
2009-01-22 01:45:11 ----A---- C:\WINDOWS\ModemLog_Motorola USB Modem.txt
2009-01-22 01:44:08 ----HDC---- C:\WINDOWS\$NtUninstallWdf01005$
2009-01-22 01:38:37 ----HDC---- C:\WINDOWS\$NtUninstallKB926239$
2009-01-22 01:37:48 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-01-22 01:36:39 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-01-22 01:34:41 ----D---- C:\Program Files\Fichiers communs\Motorola Shared
2009-01-22 01:34:36 ----D---- C:\Program Files\Motorola Phone Tools
2009-01-22 01:34:36 ----D---- C:\Documents and Settings\All Users\Application Data\BVRP Software
2009-01-22 01:34:04 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\InstallShield
2009-01-19 03:00:50 ----D---- C:\WINDOWS\ie7updates
2009-01-18 21:54:29 ----D---- C:\Program Files\PokerStars
2009-01-18 06:16:37 ----D---- C:\WINDOWS\WBEM
2009-01-18 06:16:35 ----D---- C:\WINDOWS\system32\fr-fr
2009-01-18 06:15:15 ----HDC---- C:\WINDOWS\ie7
2009-01-18 06:14:46 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-01-18 06:14:03 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-01-18 06:13:15 ----HDC---- C:\WINDOWS\$NtUninstallKB915865$
2009-01-18 06:13:02 ----N---- C:\WINDOWS\system32\xmllite.dll
2009-01-18 06:06:41 ----A---- C:\WINDOWS\system32\MRT.exe
2009-01-14 03:02:33 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-01-14 03:02:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-01-13 10:37:08 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Media Player Classic

======List of files/folders modified in the last 1 months======

2009-02-12 22:43:21 ----RD---- C:\Program Files
2009-02-12 22:43:21 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
2009-02-12 22:43:04 ----D---- C:\WINDOWS\Prefetch
2009-02-12 22:42:29 ----D---- C:\WINDOWS\Temp
2009-02-12 22:24:29 ----D---- C:\Program Files\Mozilla Firefox
2009-02-12 21:28:13 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-12 21:28:04 ----D---- C:\Program Files\Fichiers communs
2009-02-12 21:25:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-12 11:09:41 ----HD---- C:\WINDOWS\inf
2009-02-12 05:00:06 ----D---- C:\WINDOWS
2009-02-12 04:59:40 ----D---- C:\WINDOWS\system32
2009-02-12 04:59:40 ----D---- C:\Program Files\Internet Explorer
2009-02-12 03:01:17 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-12 03:01:13 ----A---- C:\WINDOWS\imsins.BAK
2009-02-12 03:01:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-02-11 23:26:12 ----D---- C:\Documents and Settings\Sandra Laurence\Application Data\Azureus
2009-02-07 00:31:09 ----D---- C:\Program Files\MSN Messenger
2009-02-05 16:19:43 ----D---- C:\WINDOWS\system32\drivers
2009-02-05 03:01:01 ----SHD---- C:\WINDOWS\Installer
2009-02-03 23:42:33 ----RSD---- C:\WINDOWS\Fonts
2009-02-03 23:41:10 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-02-03 23:32:42 ----D---- C:\WINDOWS\Help
2009-02-03 23:30:08 ----D---- C:\WINDOWS\system32\DirectX
2009-02-03 23:29:15 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-02-03 23:28:01 ----D---- C:\WINDOWS\system32\mui
2009-02-03 23:26:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-02-03 22:23:15 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-02-03 22:23:13 ----D---- C:\WINDOWS\system32\spool
2009-02-03 22:16:36 ----D---- C:\WINDOWS\WinSxS
2009-01-30 06:30:46 ----D---- C:\Program Files\Norton Internet Security
2009-01-28 14:37:09 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-01-28 14:37:09 ----D---- C:\WINDOWS\system32\CatRoot
2009-01-28 01:26:22 ----A---- C:\WINDOWS\win.ini
2009-01-28 01:26:09 ----D---- C:\Program Files\Windows Media Player
2009-01-26 21:19:02 ----D---- C:\Program Files\Vuze
2009-01-23 21:07:43 ----D---- C:\WINDOWS\AppPatch
2009-01-22 01:49:29 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-01-22 01:45:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-22 01:36:51 ----D---- C:\WINDOWS\system32\LogFiles
2009-01-18 06:16:51 ----D---- C:\WINDOWS\system32\config
2009-01-18 06:16:26 ----D---- C:\WINDOWS\Media
2009-01-18 06:06:42 ----D---- C:\WINDOWS\Debug
2009-01-16 21:15:42 ----A---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 40320]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-03-28 266552]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-11-30 928256]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20090211.004\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20090211.004\NavEx15.Sys []
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-03-28 11480]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-03-28 171928]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-03-28 37016]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20090129.001\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-03-28 47192]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-03-28 18904]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-03-02 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-19 235100]
S3 motmodem;Motorola USB CDC ACM Driver; C:\WINDOWS\system32\DRIVERS\motmodem.sys []
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2006-03-02 5888]
S3 USB_RNDIS;Arris Remote NDIS Network Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2006-03-02 12672]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 W8335XP;IEEE 802.11g Wireless Cardbus/PCI Adapter HW51; C:\WINDOWS\system32\DRIVERS\Mrv8000c.sys [2004-12-24 253440]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-11-30 425984]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe [2008-01-17 197992]
R2 ccProxy;Symantec Network Proxy; C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe [2006-06-14 235168]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe [2008-01-17 181608]
R2 ISSVC;ISSvc; C:\Program Files\Norton Internet Security\ISSVC.exe [2005-04-18 83584]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-22 152984]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe [2005-01-10 177264]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe [2007-03-28 206552]
R2 SoundMAX Agent Service (default);

31 réponses

Résumé de la discussion

Une fenêtre Explorer apparaît sous le nom RON ads by snappyads, accompagnée d'un journal HijackThis montrant plusieurs extensions publicitaires et des entrées Run suspectes. Des éléments problématiques incluent des BHO liés à snappyads et des DLL dans system32, ainsi que des services et des entrées Run favorisant le démarrage et la redirection. Pour résoudre, il convient généralement d'éliminer les extensions indésirables, nettoyer les clés de registre, désactiver les démarrages douteux et lancer une analyse antivirus à jour. La présence de fichiers comme zjvuamsqcfhu.dll ou nst258C.dll dans system32 peut indiquer une infection complexe nécessitant suppression manuelle et vérification des comptes.

Bobot (l’IA à votre service)
  1. Farna
    Quand je réinitialise c'est google qui prend la place, je redémarrde et sa redevien yoog et non je n'est plus de snappyads
    1. anthony5151 Contributeur sécurité
      OK... Quand tu réinitialises la valeur, qu'est-ce qui se met à la place ?

      Des fenêtres de pub snappyads s'affichent encore ?

      1. Farna
        Ok, j'ai réinitialisé les valeur et j'ai redémarré mon ordi, mais quand j'y retourne y'a encore les 4 lignes. Et je n'ai plus d'autre problème.
        1. anthony5151 Contributeur sécurité
          Ok, réinitialise ces valeurs, et dis moi si ça fonctionne :)

          2. Farna
            Salut, je sais pas si c'est un problème ou si c'est normal mais je n'est que les quatre dernières lignes pour la recherche yoog, je n'est pas celle-ci :

            browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
            browser.search.selectedEngine - Yoog Search
            keyword.URL - hxxp://www15.yoog.com/search.php?q=

            Que dois-je faire ?
            1. Farna
              Voici le rapport de combo-fix:

              ComboFix 09-02-17.02 - Sandra Laurence 2009-02-18 22:30:36.2 - NTFSx86
              Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1279.720 [GMT -5:00]
              Lancé depuis: c:\documents and settings\Sandra Laurence\Bureau\ComboFix.exe
              Commutateurs utilisés :: c:\documents and settings\Sandra Laurence\Bureau\CFScript.txt
              AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
              FW: PC Tools Firewall Plus *disabled*
              * Un nouveau point de restauration a été créé

              FILE ::
              c:\windows\system32\nse26B.dll
              c:\windows\system32\nsw139E.dll
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              c:\program files\Microsoft Common
              c:\program files\Microsoft Common\svchost.exe
              c:\windows\system32\nse26B.dll

              .
              ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-19 au 2009-02-19 ))))))))))))))))))))))))))))))))))))
              .

              2009-02-18 21:19 . 2009-02-18 21:19 244 --ah----- C:\sqmnoopt04.sqm
              2009-02-18 21:19 . 2009-02-18 21:19 232 --ah----- C:\sqmdata04.sqm
              2009-02-18 14:38 . 2009-02-18 14:38 244 --ah----- C:\sqmnoopt03.sqm
              2009-02-18 14:38 . 2009-02-18 14:38 232 --ah----- C:\sqmdata03.sqm
              2009-02-18 07:22 . 2009-02-18 07:22 244 --ah----- C:\sqmnoopt02.sqm
              2009-02-18 07:22 . 2009-02-18 07:22 232 --ah----- C:\sqmdata02.sqm
              2009-02-18 01:06 . 2009-02-18 01:06 244 --ah----- C:\sqmnoopt01.sqm
              2009-02-18 01:06 . 2009-02-18 01:06 232 --ah----- C:\sqmdata01.sqm
              2009-02-16 23:36 . 2006-11-13 15:45 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll
              2009-02-16 23:36 . 2007-06-18 15:18 23,680 --a------ c:\windows\system32\drivers\motmodem.sys
              2009-02-16 23:35 . 2009-02-16 23:35 <REP> d-------- c:\program files\Common Files
              2009-02-16 03:00 . 2009-02-16 23:36 <REP> d-------- c:\windows\LastGood
              2009-02-15 04:13 . 2008-08-14 08:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
              2009-02-15 04:13 . 2008-08-14 08:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
              2009-02-15 04:13 . 2008-08-14 08:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
              2009-02-15 04:13 . 2008-08-14 08:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
              2009-02-15 04:13 . 2008-09-15 10:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
              2009-02-15 04:13 . 2008-04-11 14:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
              2009-02-15 04:13 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
              2009-02-15 04:13 . 2008-10-15 11:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
              2009-02-15 04:13 . 2008-12-11 05:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
              2009-02-15 04:13 . 2008-06-14 12:33 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
              2009-02-15 02:58 . 2009-02-15 02:58 <REP> d-------- c:\windows\system32\fr
              2009-02-15 02:58 . 2009-02-15 02:58 <REP> d-------- c:\windows\system32\bits
              2009-02-15 02:58 . 2009-02-15 02:58 <REP> d-------- c:\windows\l2schemas
              2009-02-15 02:56 . 2009-02-15 02:59 <REP> d-------- c:\windows\ServicePackFiles
              2009-02-15 02:50 . 2009-02-15 02:50 <REP> d-------- c:\windows\EHome
              2009-02-15 02:20 . 2009-02-15 02:20 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\PCToolsFirewallPlus
              2009-02-15 00:35 . 2009-02-15 02:20 <REP> d-------- c:\program files\PC Tools Firewall Plus
              2009-02-15 00:35 . 2009-02-15 00:35 <REP> d-------- c:\program files\Fichiers communs\PC Tools
              2009-02-15 00:35 . 2008-12-11 08:38 159,600 --a------ c:\windows\system32\drivers\pctgntdi.sys
              2009-02-15 00:35 . 2009-01-20 14:12 130,928 --a------ c:\windows\system32\drivers\PCTCore.sys
              2009-02-15 00:35 . 2008-09-22 12:29 97,408 --a------ c:\windows\system32\drivers\pctfw.sys
              2009-02-15 00:35 . 2009-01-21 10:38 95,640 --a------ c:\windows\system32\drivers\pctplfw.sys
              2009-02-15 00:35 . 2008-12-18 12:16 73,840 --a------ c:\windows\system32\drivers\PCTAppEvent.sys
              2009-02-13 11:13 . 2009-02-13 11:15 <REP> d-------- c:\program files\SpywareBlaster
              2009-02-13 11:13 . 2009-02-18 22:27 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
              2009-02-13 11:07 . 2009-02-13 11:35 <REP> d-------- c:\program files\NOS
              2009-02-13 11:07 . 2009-02-13 11:35 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
              2009-02-13 11:01 . 2009-02-13 11:01 <REP> d-------- c:\program files\Avira
              2009-02-13 11:01 . 2009-02-13 11:01 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
              2009-02-13 10:35 . 2009-02-13 10:35 <REP> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
              2009-02-12 23:58 . 2009-02-12 23:58 <REP> d-------- c:\windows\system32\Kaspersky Lab
              2009-02-12 23:19 . 2009-02-12 23:19 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
              2009-02-12 23:19 . 2009-02-12 23:19 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\Malwarebytes
              2009-02-12 23:19 . 2009-02-12 23:19 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
              2009-02-12 23:19 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
              2009-02-12 23:19 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
              2009-02-12 22:44 . 2009-02-12 22:48 <REP> d-------- C:\ToolBar SD
              2009-02-12 22:43 . 2009-02-12 22:43 <REP> d-------- C:\rsit
              2009-02-12 22:43 . 2009-02-16 00:48 <REP> d-------- c:\program files\trend micro
              2009-02-05 16:19 . 2004-08-19 16:09 159,232 --a------ c:\windows\system32\ptpusd.dll
              2009-02-05 16:19 . 2008-04-13 13:45 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
              2009-02-05 16:19 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll
              2009-02-05 03:21 . 2009-02-16 18:17 85,664 --a------ c:\windows\system32\414ee295-9566-1070-5bde-bb57783c87be.exe
              2009-02-05 03:00 . 2009-02-05 03:00 <REP> d-------- c:\program files\MSXML 6.0
              2009-02-04 20:56 . 2009-02-04 20:58 5,372,416 --a------ C:\Webcam Recording on 04.02.09 at 20.56.43.avi
              2009-02-04 18:00 . 2009-02-04 18:29 63,790,592 --a------ C:\Webcam Recording on 04.02.09 at 18.00.20.avi
              2009-02-04 18:00 . 2009-02-04 18:27 0 --a------ C:\temp14.bmp
              2009-02-04 17:56 . 2009-02-04 17:56 0 --a------ C:\Webcam Recording on 04.02.09 at 17.56.23.avi
              2009-02-04 17:56 . 2009-02-04 18:18 0 --a------ C:\temp8.bmp
              2009-02-04 17:23 . 2009-02-07 00:31 <REP> d-------- c:\program files\MessengerDiscovery
              2009-02-04 17:23 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx
              2009-02-04 00:07 . 2009-02-04 00:07 268 --ah----- C:\sqmdata00.sqm
              2009-02-04 00:07 . 2009-02-04 00:07 244 --ah----- C:\sqmnoopt00.sqm
              2009-02-03 23:30 . 2009-02-03 23:42 <REP> d-------- c:\program files\AutoCAD 2009
              2009-02-03 23:30 . 2009-02-10 01:05 <REP> d-------- c:\documents and settings\All Users\Application Data\Autodesk
              2009-02-03 23:30 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
              2009-02-03 23:25 . 2009-02-03 23:25 <REP> d-------- c:\program files\MSBuild
              2009-02-03 23:22 . 2009-02-03 23:27 <REP> d-------- c:\windows\system32\XPSViewer
              2009-02-03 23:20 . 2009-02-03 23:43 <REP> d-------- c:\program files\Fichiers communs\Autodesk Shared
              2009-02-03 23:20 . 2009-02-03 23:20 <REP> d-------- c:\program files\Autodesk
              2009-02-03 23:20 . 2009-02-10 01:05 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\Autodesk
              2009-02-03 22:23 . 2009-02-03 22:23 <REP> d-------- c:\program files\Reference Assemblies
              2009-02-03 22:22 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
              2009-02-03 22:11 . 2009-02-03 22:12 <REP> d-------- C:\[u]0/u9820e7398e0f4dcda8a
              2009-02-02 14:18 . 2009-02-02 14:18 135,168 --a------ c:\windows\system32\d3dim3232.dll
              2009-02-02 00:55 . 2009-02-02 00:55 135,168 --a------ c:\windows\system32\ir32_3232.dll
              2009-02-01 09:46 . 2009-02-01 09:46 <REP> d-------- c:\windows\Sun
              2009-01-29 15:11 . 2009-01-29 15:11 <REP> d-------- c:\documents and settings\NetworkService\Mes documents
              2009-01-29 14:24 . 2009-01-29 14:24 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\SanDisk
              2009-01-29 12:22 . 2009-01-29 12:22 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\OpenOffice.org
              2009-01-29 12:19 . 2009-01-29 12:19 <REP> d-------- c:\program files\OpenOffice.org 3
              2009-01-28 01:26 . 2009-01-28 01:26 <REP> d-------- c:\program files\Windows Media Connect 2
              2009-01-28 01:26 . 2006-03-02 07:00 221,184 --a------ c:\windows\system32\wmpns.dll
              2009-01-27 15:56 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
              2009-01-27 15:56 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
              2009-01-27 15:56 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
              2009-01-27 15:56 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
              2009-01-27 15:56 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
              2009-01-27 15:56 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
              2009-01-27 15:56 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
              2009-01-27 15:56 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
              2009-01-22 04:11 . 2009-01-22 04:11 <REP> d-------- c:\program files\MSXML 4.0
              2009-01-22 02:25 . 2009-02-18 22:27 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\LimeWire
              2009-01-22 02:24 . 2009-01-22 02:24 <REP> d-------- c:\program files\Java
              2009-01-22 02:24 . 2009-01-22 02:24 410,984 --a------ c:\windows\system32\deploytk.dll
              2009-01-22 02:24 . 2009-01-22 02:24 73,728 --a------ c:\windows\system32\javacpl.cpl
              2009-01-22 02:20 . 2009-01-22 02:21 <REP> d-------- c:\program files\LimeWire
              2009-01-22 01:50 . 2009-01-22 01:50 <REP> d-------- c:\program files\Motorola
              2009-01-22 01:45 . 2009-01-22 01:45 <REP> d-------- c:\program files\Avanquest update
              2009-01-22 01:44 . 2009-01-22 01:44 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
              2009-01-22 01:44 . 2009-01-22 01:44 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
              2009-01-22 01:38 . 2008-04-13 13:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys
              2009-01-22 01:36 . 2009-01-24 14:03 <REP> d-------- c:\windows\system32\drivers\UMDF
              2009-01-22 01:34 . 2009-02-16 23:36 <REP> d-------- c:\program files\Motorola Phone Tools
              2009-01-22 01:34 . 2009-01-22 01:34 <REP> d-------- c:\program files\Fichiers communs\Motorola Shared
              2009-01-22 01:34 . 2009-01-22 01:34 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\InstallShield
              2009-01-22 01:34 . 2009-01-22 01:44 <REP> d-------- c:\documents and settings\All Users\Application Data\BVRP Software

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2009-02-16 05:38 --------- d-----w c:\program files\MSN Messenger
              2009-02-14 18:29 --------- d-----w c:\documents and settings\Sandra Laurence\Application Data\Azureus
              2009-02-13 16:09 --------- d-----w c:\program files\Fichiers communs\Adobe
              2009-01-30 05:57 --------- d-----w c:\program files\PokerStars
              2009-01-27 02:19 --------- d-----w c:\program files\Vuze
              2009-01-22 06:45 --------- d--h--w c:\program files\InstallShield Installation Information
              2009-01-13 15:37 --------- d-----w c:\documents and settings\Sandra Laurence\Application Data\Media Player Classic
              2009-01-08 03:56 --------- d-----w c:\program files\Combined Community Codec Pack
              2009-01-07 19:49 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
              2009-01-07 19:48 --------- d-----w c:\program files\Fichiers communs\i4j_jres
              2009-01-06 08:09 --------- d-----w c:\program files\Marvell
              2009-01-06 07:33 --------- d-----w c:\program files\ATI Technologies
              2009-01-06 07:08 --------- d-----w c:\program files\Analog Devices
              2009-01-06 07:07 --------- d-----w c:\program files\Intel
              2009-01-06 07:07 --------- d-----w c:\program files\Fichiers communs\InstallShield
              2009-01-06 07:00 --------- d-----w c:\program files\802.11 Wireless LAN
              2009-01-06 06:49 --------- d-----w c:\program files\microsoft frontpage
              2009-01-06 06:47 --------- d-----w c:\program files\Services en ligne
              2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
              2008-12-12 17:35 3,081,216 ----a-w c:\windows\system32\SETCEE.tmp
              .

              ((((((((((((((((((((((((((((( SnapShot@2009-02-16_22.04.55,95 )))))))))))))))))))))))))))))))))))))))))
              .
              - 2009-02-16 05:36:11 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
              + 2009-02-18 16:50:16 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
              - 2009-02-16 05:36:11 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
              + 2009-02-18 16:50:16 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
              - 2009-02-16 05:36:11 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
              + 2009-02-18 16:50:16 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
              + 2008-08-21 23:49:22 18,688 -c--a-w c:\windows\system32\DRVSTORE\motccgp_4B8D9AB3A82A683595609FFF880F0EDF6139A96D\motccgp.sys
              + 2008-08-21 23:49:56 8,320 -c--a-w c:\windows\system32\DRVSTORE\motccgp_4B8D9AB3A82A683595609FFF880F0EDF6139A96D\motccgpfl.sys
              + 2007-11-02 20:51:28 6,400 -c--a-w c:\windows\system32\DRVSTORE\motccgp_4B8D9AB3A82A683595609FFF880F0EDF6139A96D\motswch.sys
              + 2006-11-13 20:45:54 1,419,232 -c--a-w c:\windows\system32\DRVSTORE\motccgp_4B8D9AB3A82A683595609FFF880F0EDF6139A96D\wdfcoinstaller01005.dll
              + 2007-06-18 20:18:26 23,680 -c--a-w c:\windows\system32\DRVSTORE\motmodem_8AAFC1213735C79BDDFE23749C53BFC0F01512CA\motmodem.sys
              + 2006-11-13 20:45:54 1,419,232 -c--a-w c:\windows\system32\DRVSTORE\motmodem_8AAFC1213735C79BDDFE23749C53BFC0F01512CA\wdfcoinstaller01005.dll
              + 2006-07-28 13:10:08 6,144 -c--a-w c:\windows\system32\DRVSTORE\motodrv_EBD40518FA36F6DD08A0EAF14AED13D857D9FFFC\mot_ci.dll
              + 2007-10-10 22:41:50 42,112 -c--a-w c:\windows\system32\DRVSTORE\motodrv_EBD40518FA36F6DD08A0EAF14AED13D857D9FFFC\motodrv.sys
              + 2007-01-24 03:36:20 6,016 -c--a-w c:\windows\system32\DRVSTORE\motousbnet_9F591433B82B0F093333CEA94EE84F00E7481D04\motfilt.sys
              + 2008-03-03 21:03:10 23,296 -c--a-w c:\windows\system32\DRVSTORE\motousbnet_9F591433B82B0F093333CEA94EE84F00E7481D04\Motousbnet.sys
              + 2007-11-02 20:51:28 6,400 -c--a-w c:\windows\system32\DRVSTORE\motousbnet_9F591433B82B0F093333CEA94EE84F00E7481D04\motswch.sys
              + 2006-11-13 20:45:54 1,419,232 -c--a-w c:\windows\system32\DRVSTORE\motousbnet_9F591433B82B0F093333CEA94EE84F00E7481D04\wdfcoinstaller01005.dll
              + 2007-06-18 20:18:26 23,680 -c--a-w c:\windows\system32\DRVSTORE\motport_50487F381F70FF5572305B1B459E22B860F1D8C7\motport.sys
              + 2006-11-13 20:45:54 1,419,232 -c--a-w c:\windows\system32\DRVSTORE\motport_50487F381F70FF5572305B1B459E22B860F1D8C7\wdfcoinstaller01005.dll
              - 2009-02-16 10:18:16 66,376 ----a-w c:\windows\system32\perfc009.dat
              + 2009-02-17 03:10:40 66,376 ----a-w c:\windows\system32\perfc009.dat
              - 2009-02-16 10:18:16 79,028 ----a-w c:\windows\system32\perfc00C.dat
              + 2009-02-17 03:10:40 79,028 ----a-w c:\windows\system32\perfc00C.dat
              - 2009-02-16 10:18:16 427,592 ----a-w c:\windows\system32\perfh009.dat
              + 2009-02-17 03:10:40 427,592 ----a-w c:\windows\system32\perfh009.dat
              - 2009-02-16 10:18:16 494,650 ----a-w c:\windows\system32\perfh00C.dat
              + 2009-02-17 03:10:40 494,650 ----a-w c:\windows\system32\perfh00C.dat
              .
              ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
              "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
              "SansaDispatch"="c:\documents and settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-01-29 79872]
              "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
              "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-22 136600]
              "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
              "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
              "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-01-21 2652056]

              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

              c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
              Wireless Configuration Utility HW.51.lnk - c:\program files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe [2004-12-14 454656]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
              "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

              [HKEY_LOCAL_MACHINE\software\microsoft\security center]
              "AntiVirusDisableNotify"=dword:00000001

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "c:\\Program Files\\Vuze\\Azureus.exe"=
              "c:\\Program Files\\LimeWire\\LimeWire.exe"=
              "c:\\WINDOWS\\system32\\sessmgr.exe"=
              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
              "%windir%\\system32\\sessmgr.exe"=
              "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
              "c:\\Program Files\\MSN Messenger\\livecall.exe"=

              R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-02-15 159600]
              R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-02-15 73840]
              R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009-02-15 95640]

              --- Autres Services/Pilotes en mémoire ---

              *NewlyCreated* - AEC
              .
              .
              ------- Examen supplémentaire -------
              .
              FF - ProfilePath - c:\documents and settings\Sandra Laurence\Application Data\Mozilla\Firefox\Profiles\v2orw9lo.default\
              FF - prefs.js: browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
              FF - prefs.js: browser.search.selectedEngine - Yoog Search
              FF - prefs.js: keyword.URL - hxxp://www15.yoog.com/search.php?q=

              ---- PARAMETRES FIREFOX ----
              FF - user.js: google.toolbar.linkdoctor.enabled - false
              FF - user.js: browser.search.defaultenginename - Yoog Search
              FF - user.js: browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
              FF - user.js: browser.search.selectedEngine - Yoog Search
              FF - user.js: keyword.URL - hxxp://www15.yoog.com/search.php?q=
              FF - user.js: keyword.enabled - true
              .

              **************************************************************************

              catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2009-02-18 22:32:21
              Windows 5.1.2600 Service Pack 3 NTFS

              Recherche de processus cachés ...

              Recherche d'éléments en démarrage automatique cachés ...

              HKCU\Software\Microsoft\Windows\CurrentVersion\Run
              SansaDispatch = c:\documents and settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?terInstall&platform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_content

              Recherche de fichiers cachés ...

              Scan terminé avec succès
              Fichiers cachés: 0

              **************************************************************************
              .
              --------------------- DLLs chargées dans les processus actifs ---------------------

              - - - - - - - > 'winlogon.exe'(912)
              c:\windows\system32\Ati2evxx.dll
              .
              Heure de fin: 2009-02-18 22:33:57
              ComboFix-quarantined-files.txt 2009-02-19 03:33:49
              ComboFix2.txt 2009-02-17 03:06:07

              Avant-CF: 63 804 141 568 octets libres
              Après-CF: 63,841,615,872 octets libres

              260 --- E O F --- 2009-02-16 08:02:13
              1. anthony5151 Contributeur sécurité
                Re,

                /!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour Farna, il n'est pas transposable sur un autre ordinateur !

                Toujours avec toutes les protections désactivées, fais ceci :

                • Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
                • Copie/colle le contenu de ce lien (à partir de File) dans le bloc-notes : https://www.cjoint.com/?cvbcACYibQ
                • Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
                • Quitte le Bloc Notes

                • Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien : http://apu.mabul.org/up/apu/2008/09/06/img-2258535my8h.gif

                • Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
                • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                • Si le fichier ne s'ouvre pas, il se trouve ici : C:\ComboFix.txt

                Ensuite :

                * Lance Firefox
                * Tape about:config dans la barre d'adresse et appuie sur le touche Entrée
                * Lis l'avertissement et clique sur "Je ferai attention, promis !"
                * Dans la barre Filtre située en haut de la page, tape yoog
                * Les lignes qui apparaitront devraient correspondre à celles-ci :

                browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
                browser.search.selectedEngine - Yoog Search
                keyword.URL - hxxp://www15.yoog.com/search.php?q=

                browser.search.defaultenginename - Yoog Search
                browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
                browser.search.selectedEngine - Yoog Search
                keyword.URL - hxxp://www15.yoog.com/search.php?q=

                * Si d'autres lignes comportent la valeur yoog, dis le moi avant de modifier quoi que ce soit).
                * S'il n'y a que ces lignes, fais un clic-droit sur chacune d'entre elles et clique sur Réinitialiser la valeur.
                * Ferme Firefox : Fichier --> Quitter
                * Fais redémarrer ton ordinateur, et dis moi si tu as encore des problèmes.

                1. Farna
                  Voila le résultat de combo-fix :

                  ComboFix 09-02-15.01 - Sandra Laurence 2009-02-16 22:02:53.1 - NTFSx86
                  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1279.798 [GMT -5:00]
                  Lancé depuis: c:\documents and settings\Sandra Laurence\Bureau\ComboFix.exe
                  AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
                  FW: PC Tools Firewall Plus *disabled*
                  * Un nouveau point de restauration a été créé
                  .

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  c:\program files\Mozilla Firefox\components\df0bdc27-eaf7-63a6-e810-9547cabdae90.dll
                  c:\program files\mozilla firefox\components\nssnappyads.dll

                  .
                  ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-17 au 2009-02-17 ))))))))))))))))))))))))))))))))))))
                  .

                  2009-02-16 03:00 . 2009-02-16 03:00 <REP> d-------- c:\windows\LastGood
                  2009-02-15 04:13 . 2008-08-14 08:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
                  2009-02-15 04:13 . 2008-08-14 08:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
                  2009-02-15 04:13 . 2008-08-14 08:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
                  2009-02-15 04:13 . 2008-08-14 08:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
                  2009-02-15 04:13 . 2008-09-15 10:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
                  2009-02-15 04:13 . 2008-04-11 14:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
                  2009-02-15 04:13 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
                  2009-02-15 04:13 . 2008-10-15 11:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
                  2009-02-15 04:13 . 2008-12-11 05:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
                  2009-02-15 04:13 . 2008-06-14 12:33 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
                  2009-02-15 02:58 . 2009-02-15 02:58 <REP> d-------- c:\windows\system32\fr
                  2009-02-15 02:58 . 2009-02-15 02:58 <REP> d-------- c:\windows\system32\bits
                  2009-02-15 02:58 . 2009-02-15 02:58 <REP> d-------- c:\windows\l2schemas
                  2009-02-15 02:56 . 2009-02-15 02:59 <REP> d-------- c:\windows\ServicePackFiles
                  2009-02-15 02:50 . 2009-02-15 02:50 <REP> d-------- c:\windows\EHome
                  2009-02-15 02:20 . 2009-02-15 02:20 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\PCToolsFirewallPlus
                  2009-02-15 00:35 . 2009-02-15 02:20 <REP> d-------- c:\program files\PC Tools Firewall Plus
                  2009-02-15 00:35 . 2009-02-15 00:35 <REP> d-------- c:\program files\Fichiers communs\PC Tools
                  2009-02-15 00:35 . 2008-12-11 08:38 159,600 --a------ c:\windows\system32\drivers\pctgntdi.sys
                  2009-02-15 00:35 . 2009-01-20 14:12 130,928 --a------ c:\windows\system32\drivers\PCTCore.sys
                  2009-02-15 00:35 . 2008-09-22 12:29 97,408 --a------ c:\windows\system32\drivers\pctfw.sys
                  2009-02-15 00:35 . 2009-01-21 10:38 95,640 --a------ c:\windows\system32\drivers\pctplfw.sys
                  2009-02-15 00:35 . 2008-12-18 12:16 73,840 --a------ c:\windows\system32\drivers\PCTAppEvent.sys
                  2009-02-13 11:13 . 2009-02-13 11:15 <REP> d-------- c:\program files\SpywareBlaster
                  2009-02-13 11:13 . 2009-02-16 09:15 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
                  2009-02-13 11:07 . 2009-02-13 11:35 <REP> d-------- c:\program files\NOS
                  2009-02-13 11:07 . 2009-02-13 11:35 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
                  2009-02-13 11:01 . 2009-02-13 11:01 <REP> d-------- c:\program files\Avira
                  2009-02-13 11:01 . 2009-02-13 11:01 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
                  2009-02-13 10:35 . 2009-02-13 10:35 <REP> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
                  2009-02-12 23:58 . 2009-02-12 23:58 <REP> d-------- c:\windows\system32\Kaspersky Lab
                  2009-02-12 23:19 . 2009-02-12 23:19 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
                  2009-02-12 23:19 . 2009-02-12 23:19 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\Malwarebytes
                  2009-02-12 23:19 . 2009-02-12 23:19 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
                  2009-02-12 23:19 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
                  2009-02-12 23:19 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
                  2009-02-12 22:44 . 2009-02-12 22:48 <REP> d-------- C:\ToolBar SD
                  2009-02-12 22:43 . 2009-02-12 22:43 <REP> d-------- C:\rsit
                  2009-02-12 22:43 . 2009-02-16 00:48 <REP> d-------- c:\program files\trend micro
                  2009-02-05 16:19 . 2004-08-19 16:09 159,232 --a------ c:\windows\system32\ptpusd.dll
                  2009-02-05 16:19 . 2008-04-13 13:45 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
                  2009-02-05 16:19 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll
                  2009-02-05 03:21 . 2009-02-16 18:17 85,664 --a------ c:\windows\system32\414ee295-9566-1070-5bde-bb57783c87be.exe
                  2009-02-05 03:00 . 2009-02-05 03:00 <REP> d-------- c:\program files\MSXML 6.0
                  2009-02-04 20:56 . 2009-02-04 20:58 5,372,416 --a------ C:\Webcam Recording on 04.02.09 at 20.56.43.avi
                  2009-02-04 18:00 . 2009-02-04 18:29 63,790,592 --a------ C:\Webcam Recording on 04.02.09 at 18.00.20.avi
                  2009-02-04 18:00 . 2009-02-04 18:27 0 --a------ C:\temp14.bmp
                  2009-02-04 17:56 . 2009-02-04 17:56 0 --a------ C:\Webcam Recording on 04.02.09 at 17.56.23.avi
                  2009-02-04 17:56 . 2009-02-04 18:18 0 --a------ C:\temp8.bmp
                  2009-02-04 17:23 . 2009-02-07 00:31 <REP> d-------- c:\program files\MessengerDiscovery
                  2009-02-04 17:23 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx
                  2009-02-04 09:13 . 2009-02-04 09:13 698,880 --a------ c:\windows\system32\nse26B.dll
                  2009-02-04 00:07 . 2009-02-04 00:07 268 --ah----- C:\sqmdata00.sqm
                  2009-02-04 00:07 . 2009-02-04 00:07 244 --ah----- C:\sqmnoopt00.sqm
                  2009-02-03 23:30 . 2009-02-03 23:42 <REP> d-------- c:\program files\AutoCAD 2009
                  2009-02-03 23:30 . 2009-02-10 01:05 <REP> d-------- c:\documents and settings\All Users\Application Data\Autodesk
                  2009-02-03 23:30 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
                  2009-02-03 23:25 . 2009-02-03 23:25 <REP> d-------- c:\program files\MSBuild
                  2009-02-03 23:22 . 2009-02-03 23:27 <REP> d-------- c:\windows\system32\XPSViewer
                  2009-02-03 23:20 . 2009-02-03 23:43 <REP> d-------- c:\program files\Fichiers communs\Autodesk Shared
                  2009-02-03 23:20 . 2009-02-03 23:20 <REP> d-------- c:\program files\Autodesk
                  2009-02-03 23:20 . 2009-02-10 01:05 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\Autodesk
                  2009-02-03 22:23 . 2009-02-03 22:23 <REP> d-------- c:\program files\Reference Assemblies
                  2009-02-03 22:22 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
                  2009-02-03 22:11 . 2009-02-03 22:12 <REP> d-------- C:\[u]0/u9820e7398e0f4dcda8a
                  2009-02-02 14:18 . 2009-02-02 14:18 135,168 --a------ c:\windows\system32\d3dim3232.dll
                  2009-02-02 00:55 . 2009-02-02 00:55 135,168 --a------ c:\windows\system32\ir32_3232.dll
                  2009-02-01 09:46 . 2009-02-01 09:46 <REP> d-------- c:\windows\Sun
                  2009-01-29 15:11 . 2009-01-29 15:11 <REP> d-------- c:\documents and settings\NetworkService\Mes documents
                  2009-01-29 14:24 . 2009-01-29 14:24 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\SanDisk
                  2009-01-29 12:22 . 2009-01-29 12:22 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\OpenOffice.org
                  2009-01-29 12:19 . 2009-01-29 12:19 <REP> d-------- c:\program files\OpenOffice.org 3
                  2009-01-28 01:26 . 2009-01-28 01:26 <REP> d-------- c:\program files\Windows Media Connect 2
                  2009-01-28 01:26 . 2006-03-02 07:00 221,184 --a------ c:\windows\system32\wmpns.dll
                  2009-01-27 15:56 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
                  2009-01-27 15:56 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
                  2009-01-27 15:56 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
                  2009-01-27 15:56 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
                  2009-01-27 15:56 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
                  2009-01-27 15:56 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
                  2009-01-27 15:56 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
                  2009-01-27 15:56 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
                  2009-01-22 04:11 . 2009-01-22 04:11 <REP> d-------- c:\program files\MSXML 4.0
                  2009-01-22 02:25 . 2009-02-02 00:53 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\LimeWire
                  2009-01-22 02:24 . 2009-01-22 02:24 <REP> d-------- c:\program files\Java
                  2009-01-22 02:24 . 2009-01-22 02:24 410,984 --a------ c:\windows\system32\deploytk.dll
                  2009-01-22 02:24 . 2009-01-22 02:24 73,728 --a------ c:\windows\system32\javacpl.cpl
                  2009-01-22 02:20 . 2009-01-22 02:21 <REP> d-------- c:\program files\LimeWire
                  2009-01-22 01:50 . 2009-01-22 01:50 <REP> d-------- c:\program files\Motorola
                  2009-01-22 01:49 . 2009-01-22 01:49 <REP> d-------- c:\program files\Common Files
                  2009-01-22 01:45 . 2009-01-22 01:45 <REP> d-------- c:\program files\Avanquest update
                  2009-01-22 01:44 . 2009-01-22 01:44 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
                  2009-01-22 01:44 . 2009-01-22 01:44 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
                  2009-01-22 01:38 . 2008-04-13 13:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys
                  2009-01-22 01:36 . 2009-01-24 14:03 <REP> d-------- c:\windows\system32\drivers\UMDF
                  2009-01-22 01:34 . 2009-01-22 01:50 <REP> d-------- c:\program files\Motorola Phone Tools
                  2009-01-22 01:34 . 2009-01-22 01:34 <REP> d-------- c:\program files\Fichiers communs\Motorola Shared
                  2009-01-22 01:34 . 2009-01-22 01:34 <REP> d-------- c:\documents and settings\Sandra Laurence\Application Data\InstallShield
                  2009-01-22 01:34 . 2009-01-22 01:44 <REP> d-------- c:\documents and settings\All Users\Application Data\BVRP Software
                  2009-01-18 21:54 . 2009-01-30 00:57 <REP> d-------- c:\program files\PokerStars
                  2009-01-18 20:03 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
                  2009-01-18 20:03 . 2007-03-08 00:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
                  2009-01-18 20:03 . 2008-12-20 17:46 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
                  2009-01-18 20:03 . 2008-12-20 17:46 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
                  2009-01-18 20:03 . 2008-12-19 04:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
                  2009-01-18 20:02 . 2008-12-20 17:46 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll
                  2009-01-18 20:02 . 2008-12-20 17:46 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
                  2009-01-18 20:02 . 2008-12-20 17:46 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
                  2009-01-18 20:02 . 2008-12-20 17:46 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
                  2009-01-18 06:16 . 2009-02-15 02:58 <REP> d-------- c:\windows\system32\fr-fr

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2009-02-16 05:38 --------- d-----w c:\program files\MSN Messenger
                  2009-02-14 18:29 --------- d-----w c:\documents and settings\Sandra Laurence\Application Data\Azureus
                  2009-02-13 16:09 --------- d-----w c:\program files\Fichiers communs\Adobe
                  2009-01-27 02:19 --------- d-----w c:\program files\Vuze
                  2009-01-22 06:45 --------- d--h--w c:\program files\InstallShield Installation Information
                  2009-01-13 15:37 --------- d-----w c:\documents and settings\Sandra Laurence\Application Data\Media Player Classic
                  2009-01-08 03:56 --------- d-----w c:\program files\Combined Community Codec Pack
                  2009-01-07 19:49 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
                  2009-01-07 19:48 --------- d-----w c:\program files\Fichiers communs\i4j_jres
                  2009-01-06 08:09 --------- d-----w c:\program files\Marvell
                  2009-01-06 07:33 --------- d-----w c:\program files\ATI Technologies
                  2009-01-06 07:08 --------- d-----w c:\program files\Analog Devices
                  2009-01-06 07:07 --------- d-----w c:\program files\Intel
                  2009-01-06 07:07 --------- d-----w c:\program files\Fichiers communs\InstallShield
                  2009-01-06 07:00 --------- d-----w c:\program files\802.11 Wireless LAN
                  2009-01-06 06:49 --------- d-----w c:\program files\microsoft frontpage
                  2009-01-06 06:47 --------- d-----w c:\program files\Services en ligne
                  2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
                  2008-12-12 17:35 3,081,216 ----a-w c:\windows\system32\SETCEE.tmp
                  .

                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b4445449-934e-a8a3-7165-56fafc3d7dd4}]
                  2009-02-04 09:13 698880 --a------ c:\windows\system32\nse26B.dll

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
                  "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
                  "SansaDispatch"="c:\documents and settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-01-29 79872]
                  "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
                  "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-22 136600]
                  "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
                  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
                  "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-01-21 2652056]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

                  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                  Wireless Configuration Utility HW.51.lnk - c:\program files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe [2004-12-14 454656]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                  "AntiVirusDisableNotify"=dword:00000001

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "c:\\Program Files\\Vuze\\Azureus.exe"=
                  "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                  "c:\\WINDOWS\\system32\\sessmgr.exe"=
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "%windir%\\system32\\sessmgr.exe"=
                  "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                  "c:\\Program Files\\MSN Messenger\\livecall.exe"=

                  R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-02-15 159600]
                  R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-02-15 73840]
                  R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009-02-15 95640]
                  .
                  .
                  ------- Examen supplémentaire -------
                  .
                  FF - ProfilePath - c:\documents and settings\Sandra Laurence\Application Data\Mozilla\Firefox\Profiles\v2orw9lo.default\
                  FF - prefs.js: browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
                  FF - prefs.js: browser.search.selectedEngine - Yoog Search
                  FF - prefs.js: keyword.URL - hxxp://www15.yoog.com/search.php?q=

                  ---- PARAMETRES FIREFOX ----
                  FF - user.js: google.toolbar.linkdoctor.enabled - false
                  FF - user.js: browser.search.defaultenginename - Yoog Search
                  FF - user.js: browser.search.defaulturl - hxxp://www15.yoog.com/search.php?q=
                  FF - user.js: browser.search.selectedEngine - Yoog Search
                  FF - user.js: keyword.URL - hxxp://www15.yoog.com/search.php?q=
                  FF - user.js: keyword.enabled - true
                  .

                  **************************************************************************

                  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2009-02-16 22:04:29
                  Windows 5.1.2600 Service Pack 3 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
                  SansaDispatch = c:\documents and settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?terInstall&platform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_content

                  Recherche de fichiers cachés ...

                  Scan terminé avec succès
                  Fichiers cachés: 0

                  **************************************************************************
                  .
                  --------------------- DLLs chargées dans les processus actifs ---------------------

                  - - - - - - - > 'winlogon.exe'(912)
                  c:\windows\system32\Ati2evxx.dll
                  .
                  Heure de fin: 2009-02-16 22:06:05
                  ComboFix-quarantined-files.txt 2009-02-17 03:05:58

                  Avant-CF: 62 574 669 824 octets libres
                  Après-CF: 63,947,726,848 octets libres

                  WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
                  [boot loader]
                  timeout=2
                  default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
                  [operating systems]
                  c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                  multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

                  229 --- E O F --- 2009-02-16 08:02:13
                  1. anthony5151 Contributeur sécurité
                    /!\ A l'attention de ceux qui passent sur ce sujet /!\
                    Le logiciel qui suit n'est pas à utiliser à la légère ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.

                    On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts... Fais exactement ce qui suit :

                    Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !). Pour cela, fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " et tape C-Fix dans dans la fenêtre qui s'ouvre, puis choisis le Bureau comme destination : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                    --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
                    ! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation qui pourraient gêner fortement l'outil...Tu les réactiveras donc après !

                    Dans ton cas, il s'agit d'Antivir (fais un clic-droit sur l'icone d'Antivir près de l'horloge et décoche « Activer Antivir Guard ») et de PCToolsFirewall (fais un clic-droit sur l'icone de PCTools près de l'horloge et clique sur « Désactiver le pare-feu »)

                    ==> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

                    Tuto ici pour installer la Console de récupération (important en cas de problème) : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
                    ---------------------------------------------------------------------------------------------------------------------------------

                    Ensuite :

                    Double-clique sur C-Fix.exe (= combofix.exe ) .

                    Appuie sur une touche pour démarrer le scan .

                    Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

                    Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

                    1. Farna
                      Dsl, le rapport RSIT que je t'es envoyer n'est pas bon voici celui après le redémarage :

                      Logfile of random's system information tool 1.05 (written by random/random)
                      Run by Sandra Laurence at 2009-02-16 00:39:08
                      Microsoft Windows XP Édition familiale Service Pack 3
                      System drive C: has 60 GB (78%) free of 76 GB
                      Total RAM: 1279 MB (64% free)

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 00:39:12, on 2009-02-16
                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16791)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\Ati2evxx.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Java\jre6\bin\jqs.exe
                      C:\Program Files\PC Tools Firewall Plus\FWService.exe
                      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\Ati2evxx.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                      C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
                      C:\Program Files\Java\jre6\bin\jusched.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                      C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
                      C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\MSN Messenger\MsnMsgr.Exe
                      C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
                      C:\Program Files\Windows Media Player\WMPNSCFG.exe
                      C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
                      C:\WINDOWS\system32\wuauclt.exe
                      C:\WINDOWS\system32\msiexec.exe
                      C:\Program Files\MSN Messenger\usnsvc.exe
                      C:\Documents and Settings\Sandra Laurence\Bureau\Dossier\Truc !\RSIT.exe
                      C:\Program Files\trend micro\Sandra Laurence.exe

                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                      O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O2 - BHO: snappyads - {b4445449-934e-a8a3-7165-56fafc3d7dd4} - C:\WINDOWS\system32\nsw139E.dll
                      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                      O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                      O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                      O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
                      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                      O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
                      O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
                      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
                      O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
                      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                      O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
                      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                      1. Farna
                        Non je ne vois rien d'autre et je ne suis pas capable de te l'envoyer par le site que tu m'as donné

                        et voici le rapport RSIT :
                        Logfile of random's system information tool 1.05 (written by random/random)
                        Run by Sandra Laurence at 2009-02-16 00:02:18
                        Microsoft Windows XP Édition familiale Service Pack 2
                        System drive C: has 60 GB (79%) free of 76 GB
                        Total RAM: 1279 MB (51% free)

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 00:03:57, on 2009-02-16
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16791)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                        C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
                        C:\Program Files\Java\jre6\bin\jusched.exe
                        C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\MSN Messenger\MsnMsgr.Exe
                        C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
                        C:\Program Files\Windows Media Player\WMPNSCFG.exe
                        C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Java\jre6\bin\jqs.exe
                        C:\Program Files\PC Tools Firewall Plus\FWService.exe
                        C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\MSN Messenger\usnsvc.exe
                        C:\WINDOWS\system32\wuauclt.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\Documents and Settings\Sandra Laurence\Bureau\Dossier\Truc !\RSIT.exe
                        C:\Program Files\trend micro\Sandra Laurence.exe

                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                        O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: snappyads - {b4445449-934e-a8a3-7165-56fafc3d7dd4} - C:\WINDOWS\system32\nsw139E.dll
                        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                        O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                        O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                        O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                        O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
                        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                        O4 - HKCU\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
                        O4 - HKCU\..\RunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
                        O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
                        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
                        O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                        O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
                        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                        O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
                        O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                        1. anthony5151 Contributeur sécurité
                          Ce sont des archives de la restauration du système, ce n'est pas dangereux (du moment que tu ne fais pas de restauration...)
                          Est-ce qu'il y en a ailleurs ?

                          1. Farna
                            La plupart des fichier sont situé là : C:\System Volume Information\_restore{3D879070-0751-46D8-B9B3-15A209B3A780}\RP60
                            1. anthony5151 Contributeur sécurité
                              Mets tout en quarantaine.

                              Tu as fais un scan avec Antivir ? Si oui, peux-tu m'envoyer le rapport de scan stp ? Pour ça, tu l'enregistres sur ton Bureau, tu l'envoies sur ce site et tu me donnes l'adresse qu'il te fournit.

                              Ou alors, dis moi où sont situés les fichiers infectés stp (pas tous évidemment, mais donne moi quelques exemples)

                              Et n'oublie pas le rapport RSIT.

                              1. Farna
                                peut tu me dire ce que je fais avec tout les tr/Spy.Gen que avira a trouvé, il y en a plus de 3000 ?

                                merci !!
                                1. anthony5151 Contributeur sécurité
                                  Redémarre ton ordinateur et poste un nouveau rapport RSIT stp

                                  1. Farna
                                    Voici le dernier résultat RSIT :

                                    Malwarebytes' Anti-Malware 1.34
                                    Version de la base de données: 1763
                                    Windows 5.1.2600 Service Pack 2

                                    2009-02-15 01:28:14
                                    mbam-log-2009-02-15 (01-28-14).txt

                                    Type de recherche: Examen rapide
                                    Eléments examinés: 72325
                                    Temps écoulé: 31 minute(s), 0 second(s)

                                    Processus mémoire infecté(s): 0
                                    Module(s) mémoire infecté(s): 0
                                    Clé(s) du Registre infectée(s): 2
                                    Valeur(s) du Registre infectée(s): 0
                                    Elément(s) de données du Registre infecté(s): 0
                                    Dossier(s) infecté(s): 0
                                    Fichier(s) infecté(s): 1

                                    Processus mémoire infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Module(s) mémoire infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Clé(s) du Registre infectée(s):
                                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b4445449-934e-a8a3-7165-56fafc3d7dd4} (Adware.BHO) -> Quarantined and deleted successfully.
                                    HKEY_CLASSES_ROOT\CLSID\{b4445449-934e-a8a3-7165-56fafc3d7dd4} (Adware.BHO) -> Quarantined and deleted successfully.

                                    Valeur(s) du Registre infectée(s):
                                    (Aucun élément nuisible détecté)

                                    Elément(s) de données du Registre infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Dossier(s) infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Fichier(s) infecté(s):
                                    C:\WINDOWS\system32\nsj9C.dll (Adware.BHO) -> Quarantined and deleted successfully.
                                    1. Farna
                                      Et aussi pk j'suis pas capable de faire de mise a jour pour antivir, il y a toujours une erreur qui se produit. est-tu capable de m'aider ?
                                      1. anthony5151 Contributeur sécurité
                                        Tu as raison, il y a une ligne concernant l'infection qui est réapparue dans le rapport...

                                        Essaye de mettre à jour MalwareBytes et de refaire un scan avec stp, puis poste le rapport ici

                                        1. Farna
                                          Ok, je vais garder antivir, mais pour le reste est-ce que c'Est ok ou bien j'ai encore quelque chose a faire. Parce que mon anti-virus arrete pas de sonner pour me dire que j'ai un cheval de troi, que dois-je faire ?
                                          • 1
                                          • 2

                                          Discussions similaires

                                          Ouvrir un fichier .pub sans Publisher
                                          baissaoui

                                          0 réponse
                                          Ouvrir document Publisher sans Publisher
                                          Curtis Hayes

                                          7 réponses
                                          Lire, afficher, exécuter un fichier *.pub sans Publisher
                                          jeannoellaurenti

                                          1 réponse
                                          Publicité "Bidru n'en peut plus"
                                          _Ritchi_

                                          5 réponses
                                          musique de pub
                                          zabou

                                          7 réponses