virus non détecté Résolu

Question

Bonjour,
j'ai 2 partition C,D : un virus fait multiplier mes fichier en créant une sorte d'application ".exe" dans le disque C du coup la mémoire est toujours pleine même si j'en supprime tous mes dossier et fichier. un dossier n'arrête pas de se créer "winfiles". 
aucun antivirus ne la détecté( avg, avira, avast)

pate · Answer

sé encore pate ce virus et très dure a enlever !!! il faut un autre certificat  que l'on trouve en Angleterre il s'appelle  xa1582m a bientot

Utilisateur anonyme · Answer

Bonjour morenas31

Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau. 

-> http://images.malwareremoval.com/random/RSIT.exe 

! Déconnecte toi et ferme toutes tes applications en cours ! 

Double-clique sur " RSIT.exe " pour le lancer . 

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 2 months 

* clique ensuite sur " Continue " pour lancer l'analyse ... 


-> laisse faire le scan et ne touche pas au PC ... 


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note). 

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ... 

Important : poste un rapport, puis l'autre dans la réponse suivante 
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum 


( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

Merci

morenas31 · Answer

pour se qui concerne le bloc-note log.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by Adel at 2009-06-06 21:22:37
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 6 GB (20%) free of 30 GB
Total RAM: 990 MB (50% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS	asks\AED9E13392F696A7.job
C:\WINDOWS	asks\AppleSoftwareUpdate.job
C:\WINDOWS	asks\Check Updates for Windows Live Toolbar.job
C:\WINDOWS	asks\GoogleUpdateTaskUserS-1-5-21-1417001333-1085031214-682003330-1004.job
C:\WINDOWS	asks\GoogleUpdateTaskUserS-1-5-21-1417001333-1085031214-682003330-1005.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\Ibtissem\Mes documentspbrowserrecordplugin.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D023EBF-70B8-45A6-9ED5-556515FA0FE4}]
UrlHelper Class - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-05 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-20 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-20 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-07-07 493856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-05-20 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-05 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-05 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-07-07 493856]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL []
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-20 259696]
{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - BearShare MediaBar - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll []
{0BF43445-2F28-4351-9252-17FE6E806AA0}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"windows drivers"=C:\WINDOWS\system32\win drivers [2009-06-04 1426169]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-11-05 68856]
"msnmsgr"=C:\Program Files\MSN Messenger\msnmsgr.exe [2007-01-19 5674352]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"Yahoo Messengger"=C:\WINDOWS\system32\winfiles.exe [2009-05-24 456442]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdslTaskBar]
stmctrl.dll,TaskBar []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Amok Eggs Four Web]
C:\Documents and Settings\All Users\Application Data\part dead amok eggs	itle real.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
C:\Program Files\BearShare\BearShare.exe /pause []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus D78 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE [2006-02-23 131072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Ibtissem\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HiYo]
C:\Program Files\HiYo\bin\HiYo.exe [2009-01-11 300336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hp 1000 firmware]
C:\Program Files\hp LaserJet 1000\fwdl.exe [2001-04-18 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-03 208952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kamsoft]
C:\WINDOWS\system32\kamsoft.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kava]
C:\WINDOWS\system32\kavo.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\memo site kind that]
C:\Documents and Settings\All Users\Application Data\Grid Blue Memo Site\about bird.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsmqIntCert]
regsvr32 /s mqrt.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-03 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Plugin]
rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2007-06-29 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock]
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-05-01 843776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2005-03-24 94770]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-05 136600]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperCopier2.exe]
C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\SweetIM\Messenger\SweetIM.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-11-05 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thsys]
D:\WINDOWS\system32\winrun.sys.pif []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToniArts EasyCleaner]
C:\Documents and Settings\Adel\Mes documents\moh\ToniArts\EasyCleaner\EasyClea.exe [2003-12-02 1994240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIUCU]
C:\DOCUME~1\Adel\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vamsoft]
C:\WINDOWS\system32\vamsoft.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vga Copy]
C:\DOCUME~1\Ibtissem\APPLIC~1\LIESRE~1\Plan Program.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo Messengger]
C:\WINDOWS\system32\winfiles.exe [2009-05-24 456442]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\ROCKET~1\ROCKET~1.EXE [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\TransBar\TransBar.exe [2005-06-01 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\UberIcon\UBERIC~1.EXE [2006-05-21 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Accélérateur de démarrage AutoCAD.lnk]
C:\PROGRA~1\FICHIE~1\AUTODE~1\ACSTAR~1.EXE [2005-03-05 10872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE  []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\ROCKET~1\ROCKET~1.EXE [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\TransBar\TransBar.exe [2005-06-01 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\UberIcon\UBERIC~1.EXE [2006-05-21 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\ROCKET~1\ROCKET~1.EXE [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\TransBar\TransBar.exe [2005-06-01 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\UberIcon\UBERIC~1.EXE [2006-05-21 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\WINDOWS\System32\dmime32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\64613806530]
C:\WINDOWS\System32\dmime32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-12-17 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-04 240128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m.sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1
"DisableTaskMgr"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\LimeWire\LimeWire.exe"="D:\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"D:\asmaa\Vids\uTorrent.exe"="D:\asmaa\Vids\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\Documents and Settings\Ibtissem\Local Settings\Temp\ImInstaller\HiYo_Installer.exe"="C:\Documents and Settings\Ibtissem\Local Settings\Temp\ImInstaller\HiYo_Installer.exe:*:Enabled:IncrediMail Installer"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\LimeWire\LimeWire.exe"="D:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"D:\asmaa\uTorrent.exe"="D:\asmaa\uTorrent.exe:*:Enabled:µTorrent"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Documents and Settings\Ibtissem\Bureau\asmaa\uTorrent.exe"="C:\Documents and Settings\Ibtissem\Bureau\asmaa\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Graphisoft\ArchiCAD 10\ArchiCAD.exe"="C:\Program Files\Graphisoft\ArchiCAD 10\ArchiCAD.exe:*:Enabled:ArchiCAD 10.0.0 Component"
"C:\Documents and Settings\Amira\Bureau\Skype.exe"="C:\Documents and Settings\Amira\Bureau\Skype.exe:*:Enabled:Skype"
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
"C:\Documents and Settings\Ibtissem\Mes documentsealplay.exe"="C:\Documents and Settings\Ibtissem\Mes documentsealplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{136c9f91-832a-11db-be48-00188b8eca68}]
shell\AutoRun\command - H:\winfiles.exe
shell\Open\command - H:\winfiles.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2373d6c8-be3b-11dd-a67e-00188b8eca68}]
shell\AutoRun\command - F:\winfiles.exe
shell\Open\command - F:\winfiles.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25e1bf0e-831b-11db-be1d-00188b8eca68}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3455c7f8-833c-11db-86dd-0013eff142ed}]
shell\AutoRun\command - o3n9k.com
shell\open\command - o3n9k.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65ac91ff-c135-11dd-a687-00188b8eca68}]
shell\AutoRun\command - F:\winfiles.exe
shell\Open\command - F:\winfiles.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d0e58b8-bfc8-11dd-a682-00188b8eca68}]
shell\AutoRun\command - F:\winfiles.exe
shell\Open\command - F:\winfiles.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f795b6e-c47f-11dd-a697-00188b8eca68}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95ee5538-cb98-11dd-a6d1-00188b8eca68}]
shell\AutoRun\command - I:\mnl6on3.com
shell\explore\command - I:\mnl6on3.com
shell\open\command - I:\mnl6on3.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a464d42-adb4-11dd-a64d-00188b8eca68}]
shell\AutoRun\command - winfiles.exe
shell\Open\command - winfiles.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b17a5b1a-aa9d-11dd-a644-00188b8eca68}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b17a655c-aa9d-11dd-a644-00188b8eca68}]
shell\AutoRun\command - mnl6on3.com
shell\explore\command - mnl6on3.com
shell\open\command - mnl6on3.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc60cdb7-ca03-11dd-a6c1-00188b8eca68}]
shell\AutoRun\command - H:\fn20.exe
shell\explore\command - H:\fn20.exe
shell\open\command - H:\fn20.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb96245e-d37e-11dd-a6f5-00188b8eca68}]
shell\AutoRun\command - wscript.exe .\.vbs
shell\open\command - wscript.exe .\.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cecf7edd-ab5a-11dd-a647-00188b8eca68}]
shell\AutoRun\command - J:\winfiles.exe
shell\Open\command - J:\winfiles.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf0fc0a6-ac01-11dd-a648-00188b8eca68}]
shell\AuTOpLAy\command - uuol.pif
shell\AutoRun\command - uuol.pif
shell\eXpLoRe\command - uuol.pif
shell\OPen\command - uuol.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf0fc0a7-ac01-11dd-a648-00188b8eca68}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb979534-2efd-11de-bdeb-00188b8eca68}]
shell\AutoRun\command - H:\winfiles.exe
shell\Open\command - H:\winfiles.exe


======File associations======

.scr - open - C:\WINDOWS\NOTEPAD.EXE "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 2 months======

2009-12-04 23:45:52 ----D---- C:\Program Files\Xilisoft
2009-06-06 21:22:43 ----D---- C:\Program Files	rend micro
2009-06-06 21:22:37 ----D---- C:sit
2009-06-06 20:38:33 ----RASH---- C:\WINDOWS\system32\autorun.ini
2009-06-06 20:38:29 ----RASH---- C:\WINDOWS\system32\winfiles.exe
2009-05-28 18:58:05 ----D---- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2009-05-28 18:44:54 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-05-27 17:30:51 ----D---- C:\Documents and Settings\Adel\Application Data\BearShare
2009-05-27 11:14:26 ----D---- C:\Avenger
2009-05-27 11:14:26 ----A---- C:\avenger.txt
2009-05-26 01:00:09 ----A---- C:\mbam-setup.exe
2009-05-24 08:41:36 ----RASH---- C:\WINDOWS\system32\setting.ini
2009-05-24 08:41:33 ----RASH---- C:\WINDOWS\winfiles.exe
2009-05-24 01:43:31 ----D---- C:\Program Files\UNO Freeware
2009-05-24 01:43:17 ----A---- C:\WINDOWS\GPInstall.exe
2009-05-23 13:13:47 ----D---- C:\Documents and Settings\Adel\Application Data\Real
2009-05-23 12:56:15 ----D---- C:\My Downloads
2009-05-23 12:23:53 ----D---- C:\Documents and Settings\Adel\Application Data\skypePM
2009-05-22 01:26:54 ----D---- C:\Program Files\Lies Ref Iso
2009-05-21 18:51:27 ----D---- C:\Program Files\Messenger Plus! Live
2009-05-21 13:19:23 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-05-20 17:43:11 ----D---- C:\Documents and Settings\Adel\Application Data\DMCache
2009-05-20 12:46:32 ----A---- C:\WINDOWS\IDMan.INI
2009-05-19 23:02:55 ----D---- C:\save2pc
2009-05-16 22:21:34 ----D---- C:\Program Files\WIBU-SYSTEMS
2009-05-16 22:13:58 ----D---- C:\Program Files\Graphisoft
2009-05-10 17:02:37 ----D---- C:\Documents and Settings\Adel\Application Data\Apple Computer
2009-04-17 19:00:00 ----C---- C:\WINDOWS\system32\isutil.dll
2009-04-17 18:59:57 ----A---- C:\WINDOWS\system32\zstatus.exe
2009-04-17 18:59:57 ----A---- C:\WINDOWS\system32\ZSHP1000.dll
2009-04-17 18:59:57 ----A---- C:\WINDOWS\apptune.ini
2009-04-17 18:59:57 ----A---- C:\WINDOWS\apptune.exe
2009-04-17 18:59:56 ----A---- C:\WINDOWS\system32\hpflash1.exe
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZUNINST.EXE
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZTAG32.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZSPOOL.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZPP.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\zPJL.dll
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\zlmhp1.dll
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\zlm.dll
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZLANG.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZGDI32.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\VSETUP.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\SDhp1000.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\IMF32.DLL
2009-04-17 18:59:54 ----A---- C:\WINDOWS\system32\zpppcl.dll
2009-04-17 18:59:54 ----A---- C:\WINDOWS\system32\PCLDLL6L.DLL
2009-04-17 18:59:53 ----D---- C:\Program Files\hp LaserJet 1000
2009-04-17 15:51:41 ----D---- C:\Config.Msi
2009-04-16 11:39:22 ----D---- C:\Program Files\Canon

======List of files/folders modified in the last 2 months======

2009-06-06 21:22:43 ----D---- C:\Program Files
2009-06-06 21:22:30 ----D---- C:\WINDOWS\Prefetch
2009-06-06 21:20:27 ----D---- C:\WINDOWS\system32
2009-06-06 20:39:33 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-06 20:34:17 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-06 20:34:12 ----SHD---- C:\System Volume Information
2009-06-06 20:34:12 ----D---- C:\WINDOWS\system32\Restore
2009-06-06 20:34:07 ----D---- C:\WINDOWS\Temp
2009-06-06 17:36:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-06 15:26:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-06-06 15:14:23 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-05 22:52:49 ----AC---- C:\WINDOWS\NeroDigital.ini
2009-06-05 22:11:11 ----HD---- C:\WINDOWS\inf
2009-06-05 22:10:42 ----D---- C:\Program Files\Fichiers communs\Autodesk Shared
2009-06-05 22:08:26 ----D---- C:\WINDOWS\system32\DirectX
2009-06-05 22:08:25 ----RSD---- C:\WINDOWS\assembly
2009-05-31 13:11:33 ----SH---- C:\boot.ini
2009-05-31 13:11:33 ----AC---- C:\WINDOWS\SYSTEM.INI
2009-05-31 13:11:33 ----A---- C:\WINDOWS\win.ini
2009-05-31 13:11:32 ----D---- C:\WINDOWS\pss
2009-05-29 19:08:06 ----D---- C:\Documents and Settings\All Users\Application Data\part dead amok eggs
2009-05-28 18:51:52 ----D---- C:\WINDOWS\system32\CatRoot
2009-05-27 14:48:35 ----D---- C:\Program Files\SuperCopier2
2009-05-24 01:26:42 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-05-24 00:11:18 ----D---- C:\Program Files\Fichiers communs\Real
2009-05-23 02:31:58 ----A---- C:\WINDOWS\system32\msvcr71.dll
2009-05-22 01:26:58 ----D---- C:\Documents and Settings\All Users\Application Data\Grid Blue Memo Site
2009-05-20 20:09:39 ----A---- C:\WINDOWS\ModemLog_Bluetooth Fax Modem.txt
2009-05-20 20:09:39 ----A---- C:\WINDOWS\ModemLog_Bluetooth DUN Modem.txt
2009-05-20 12:50:33 ----D---- C:\WINDOWS\Debug
2009-05-13 19:27:16 ----RSD---- C:\WINDOWS\Fonts
2009-05-10 16:26:11 ----D---- C:\WINDOWS\system32\NtmsData
2009-04-26 23:20:58 ----A---- C:\WINDOWS\system32\Read Me.txt
2009-04-26 23:20:48 ----D---- C:\WINDOWS\system32\Death Note
2009-04-17 15:52:43 ----D---- C:\WINDOWS\system32\config
2009-04-17 15:52:21 ----D---- C:\WINDOWS\system32\wbem
2009-04-17 15:52:20 ----D---- C:\WINDOWS\Registration
2009-04-12 20:00:39 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-04-10 19:19:09 ----AC---- C:\WINDOWS\hwsolii.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-03-22 278728]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-03-22 25416]
R2 NwlnkIpx;Protocole de transport compatible NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS
wlnkipx.sys [2004-08-04 88448]
R2 NwlnkNb;NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS
wlnknb.sys [2001-10-02 63232]
R2 NwlnkSpx;Protocole NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS
wlnkspx.sys [2001-10-02 55936]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [1997-05-30 64512]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2006-05-22 230400]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-05-17 44544]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-08-12 137728]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-02 9600]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-02 12288]
R3 MQAC;Message Queuing access control; \??\C:\WINDOWS\system32\drivers\mqac.sys []
R3 RMCAST;Reliable Multicast Protocol driver; \??\C:\WINDOWS\system32\drivers\RMCast.sys []
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-02 5888]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2005-05-31 20480]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2005-04-30 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-05-31 23000]
S3 BthEnum;Pilote de bloc de demande Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-04 17024]
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-04-30 11860]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992]
S3 BTHPORT;Pilote de port Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-04 274944]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-04 18944]
S3 BTNetFilter;Bluetooth Network Filter; \??\C:\WINDOWS\system32\drivers\BTNetFilter.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 FXDrv32;FXDrv32; \??\E:\FXDrv32.sys []
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-01-31 22016]
S3 Msfotlk;Msfotlk; C:\WINDOWS\system32\driversdbss.sys [2004-08-04 176512]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2005-01-31 211712]
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\WINDOWS\system32\DRIVERSfcomm.sys [2004-08-04 59648]
S3 sermouse;Pilote pour souris sur port série; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-08-23 18432]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2005-03-25 82148]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-12-17 434176]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-05 152984]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NwSapAgent;Agent SAP; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-12-20 520192]
S2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe []
S2 MSMQ;Message Queuing; C:\WINDOWS\system32\mqsvc.exe [2004-08-04 4608]
S2 MSMQTriggers;Message Queuing Triggers; C:\WINDOWS\system32\mqtgsvc.exe [2004-08-04 117248]
S2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe []
S2 SNMP;Service SNMP; C:\WINDOWS\System32\snmp.exe []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-11-06 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2009-01-30 77944]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-20 182768]
S3 LPDSVC;Serveur d'impression TCP/IP; C:\WINDOWS\system32	cpsvcs.exe [2001-10-02 19456]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SNMPTRAP;Service d'interruption SNMP; C:\WINDOWS\System32\snmptrap.exe []
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

-----------------EOF-----------------

morenas31 · Answer

j'ai installé usbfix mais il démarre même pas quand je click

morenas31 · Answer

sa ne veut toujours pas (l'instalation c'est même pas fait)
j'ai même désinstallé mon antivirus et rien non plus

morenas31 · Answer

le probleme c'est qu'il y a rien juste 2 seconde puis rien

morenas31 · Answer

la fenêtre d'instalation apparait pendant 2 seconde puis rien

jacques.gache · Answer

morenas31 bonjour, si Guillaume5188 ni vois pas d'inconvéniant tu vires combofix de sur ton bureau et tu télécharge depuis ce lien jacombo qui est combofix renommé cela permet de contrer certaine infection , tu le mets sur ton bureau et tu suis les explications donner par Guillaume5188 dans sa procédure de combofix
http://sd-1.archive-host.com/membres/up/89820622056365782/jacombo.exe

morenas31 · Answer

ok merci je vais l'essayer

morenas31 · Answer

voila le rapport suivant Combofix car jacombo na meme pas voulu s'installer 

ComboFix 09-06-05.09 - Adel 09/06/2009 17:01.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.990.645 [GMT 2:00]
Lancé depuis: C:\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Adel\Application Data\[u]0/u2000000ed0f3438530C.manifest
c:\documents and settings\Adel\Application Data\[u]0/u2000000ed0f3438530O.manifest
c:\documents and settings\Adel\Application Data\[u]0/u2000000ed0f3438530P.manifest
c:\documents and settings\Adel\Application Data\[u]0/u2000000ed0f3438530S.manifest
c:\windows\system32\autorun.ini
c:\windows\system32\setting.ini
c:\windows\winnt.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_KAVSYS
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_AVPsys


(((((((((((((((((((((((((((((   Fichiers créés du 2006-11-03 au 2006-12-03  ))))))))))))))))))))))))))))))))))))
.

2009-12-04 21:45 . 2009-12-04 21:45	--------	d-----w-	c:\program files\Xilisoft
2009-06-08 13:53 . 2009-06-08 13:53	--------	d-----w-	c:\documents and settings\Adel\Application Data\Malwarebytes
2009-06-08 13:53 . 2009-06-08 13:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-07 23:01 . 2006-12-03 23:01	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-06-07 16:40 . 2009-06-07 16:40	--------	d-----w-	c:\documents and settings\Miss Cullen\Local Settings\Application Data\Adobe
2009-06-06 20:35 . 2009-06-06 20:36	--------	d-----w-	C:\Lop SD
2009-06-06 20:10 . 2009-06-06 20:08	715721	----a-w-	C:\UsbFix.exe
2009-06-06 19:22 . 2009-06-06 19:22	--------	d-----w-	c:\program files\trend micro
2009-05-28 16:58 . 2006-12-03 23:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-05-28 16:44 . 2006-12-03 23:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee
2009-05-27 15:30 . 2009-05-27 15:30	--------	d-----w-	c:\documents and settings\Adel\Application Data\BearShare
2009-05-25 23:00 . 2009-05-25 22:27	2967800	----a-w-	C:\mbam-setup.exe
2009-05-24 19:06 . 2009-03-24 14:07	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-05-24 06:41 . 2009-05-24 07:11	456442	--sha-r-	c:\windows\winfiles.exe
2009-05-23 23:43 . 2009-05-23 23:43	--------	d-----w-	c:\program files\UNO Freeware
2009-05-23 23:43 . 2009-05-23 23:43	796672	----a-w-	c:\windows\GPInstall.exe
2009-05-23 10:56 . 2009-05-23 10:56	--------	d-----w-	C:\My Downloads
2009-05-23 10:23 . 2009-05-24 10:21	--------	d-----w-	c:\documents and settings\Adel\Application Data\skypePM
2009-05-21 23:26 . 2009-05-21 23:26	--------	d-----w-	c:\program files\Lies Ref Iso
2009-05-21 16:51 . 2009-05-21 17:18	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-05-21 11:19 . 2009-05-21 11:20	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-05-20 15:43 . 2009-05-21 08:34	--------	d-----w-	c:\documents and settings\Adel\Application Data\DMCache
2009-05-19 21:02 . 2009-05-19 21:02	--------	d-----w-	C:\save2pc
2009-05-16 20:21 . 2009-05-16 20:21	--------	d-----w-	c:\program files\WIBU-SYSTEMS
2009-05-16 20:13 . 2009-05-16 20:13	--------	d-----w-	c:\program files\Graphisoft
2009-05-10 15:02 . 2009-05-30 22:07	--------	d-----w-	c:\documents and settings\Adel\Application Data\Apple Computer
2009-04-28 20:40 . 2009-04-28 20:40	923339	-c--a-w-	c:\windows\Zidane_Screensaver.scr
2009-04-17 17:00 . 2001-07-10 17:16	233525	-c----w-	c:\windows\system32\isutil.dll
2009-04-17 13:52 . 2009-04-17 13:52	--------	d-----w-	c:\windows\system32\wbem\Repository
2009-04-16 09:39 . 2009-04-16 09:39	--------	d-----w-	c:\program files\Canon
2009-04-04 20:57 . 2006-05-17 09:03	44544	-c--a-r-	c:\windows\system32\drivers\bcm4sbxp.sys
2009-04-04 17:56 . 2009-04-04 17:56	--------	d-----w-	C:\TempCG
2009-04-04 17:48 . 2002-12-17 16:45	52736	-c--a-w-	c:\windows\system32\dllcache\mspmsnsv.dll
2009-04-04 17:48 . 2002-12-17 16:45	52736	----a-w-	c:\windows\system32\mspmsnsv.dll
2009-04-04 17:48 . 2002-11-27 01:03	159232	----a-w-	c:\windows\system32\CEWMDM.dll
2009-04-04 17:48 . 2002-11-27 01:03	27136	-c--a-w-	c:\windows\system32\wmdmlog.dll
2009-04-04 17:48 . 2002-11-27 01:03	27136	-c--a-w-	c:\windows\system32\dllcache\wmdmlog.dll
2009-04-04 17:48 . 2002-11-27 01:03	23552	-c--a-w-	c:\windows\system32\wmdmps.dll
2009-04-04 17:48 . 2002-11-27 01:03	23552	-c--a-w-	c:\windows\system32\dllcache\wmdmps.dll
2009-04-04 17:48 . 2002-11-27 01:03	159232	-c--a-w-	c:\windows\system32\dllcache\CEWMDM.dll
2009-04-04 17:48 . 2002-12-14 15:41	246272	-c--a-w-	c:\windows\system32\mswmdm.dll
2009-04-04 17:48 . 2002-12-14 15:41	246272	-c--a-w-	c:\windows\system32\dllcache\mswmdm.dll
2009-03-31 17:42 . 2009-03-31 17:42	--------	d-----w-	c:\windows\Downloaded Installations
2009-03-31 13:18 . 2009-03-31 13:18	--------	d-----w-	c:\documents and settings\LocalService\Bureau
2009-03-31 09:25 . 2009-04-04 12:59	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-03-31 09:09 . 2001-10-02 18:19	139264	-c--a-w-	c:\windows\system32\sndvol32.exe
2009-03-31 09:09 . 2001-10-02 18:19	139264	-c--a-w-	c:\windows\system32\dllcache\sndvol32.exe
2009-03-31 08:58 . 2004-08-03 23:54	72192	-c--a-w-	c:\windows\system32\dllcache\fxscom.dll
2009-03-31 08:58 . 2004-08-03 23:54	72192	----a-w-	c:\windows\system32\fxscom.dll
2009-03-31 08:56 . 2004-08-03 23:54	452096	-c--a-w-	c:\windows\system32\dllcache\fxsapi.dll
2009-03-31 08:56 . 2004-08-03 23:54	452096	----a-w-	c:\windows\system32\fxsapi.dll
2009-03-31 08:56 . 2009-03-31 09:00	--------	d-----w-	c:\windows\system32\msmq
2009-03-31 08:56 . 2009-03-31 09:01	--------	d-----w-	C:\Inetpub
2009-03-30 14:06 . 2009-03-30 14:06	--------	d-----w-	c:\documents and settings\All Users\Application Data\Nero
2009-03-27 13:04 . 2009-03-27 13:06	--------	d-----w-	c:\program files\Microsoft Encarta
2009-03-27 12:55 . 2009-03-27 12:56	--------	d-----w-	c:\program files\AnswerWorks 4.0
2009-03-27 12:19 . 2009-03-27 12:58	--------	d-----w-	c:\program files\AutoCAD 2006
2009-03-27 12:16 . 2009-03-27 12:16	--------	d-----w-	c:\program files\Autodesk
2009-03-24 11:43 . 2008-03-22 00:16	1347584	-c--a-w-	c:\documents and settings\All Users\Application Data\Nero\DrWeb\DRWEB32.DLL
2009-03-24 11:42 . 2006-03-17 13:49	368640	----a-w-	c:\windows\system32\TwnLib4.dll
2009-03-24 11:42 . 2009-04-01 13:34	--------	d-----w-	c:\program files\Fichiers communs\Nero
2009-03-24 11:40 . 2006-10-30 00:40	--------	d-----w-	c:\documents and settings\Default User\Menu Démarrer
2009-03-24 11:40 . 2008-05-27 21:42	--------	d-----r-	c:\documents and settings\Default User\Favoris
2009-03-22 07:25 . 2009-03-22 07:25	--------	d-----w-	C:\ATI
2009-03-22 07:08 . 2009-03-22 07:08	278728	-c--a-w-	c:\windows\system32\drivers\atksgt.sys
2009-03-22 07:08 . 2009-03-22 07:08	25416	-c--a-w-	c:\windows\system32\drivers\lirsgt.sys
2009-02-23 23:22 . 2009-02-23 23:22	--------	d-----w-	c:\documents and settings\Adel\Application Data\Free Spider TreeCardGames
2009-02-19 23:43 . 2006-12-03 23:47	--------	d-----w-	C:\Temp
2009-02-19 19:41 . 2009-02-19 19:41	--------	d-----w-	c:\program files\Spider
2009-02-19 13:34 . 2009-02-19 13:34	--------	d-----w-	c:\windows\system32\LogFiles
2009-02-19 11:51 . 2009-02-19 11:51	--------	d-----w-	c:\program files\Fichiers communs\Java
2009-02-19 11:46 . 2009-02-19 11:46	--------	d-----w-	c:\windows\system32\vmm32
2009-02-19 11:46 . 2009-02-19 11:46	--------	d-----w-	c:\program files\Dell
2009-02-19 10:17 . 2009-02-20 09:57	--------	d-----w-	c:\program files\Microsoft Référence
2009-02-18 20:58 . 2009-02-18 20:58	--------	d-----w-	c:\program files\uTorrent
2009-02-17 19:37 . 2009-02-17 19:37	595144	-c--a-w-	c:\documents and settings\Adel\Application Data\HiYo\Data\hiyo_install.exe
2009-02-15 17:59 . 2004-08-03 23:54	25600	----a-w-	c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-02-15 11:13 . 2004-08-03 23:54	54784	----a-w-	c:\windows\system32\vfwwdm32.dll
2009-02-15 11:07 . 2005-07-19 16:31	53248	-c--a-r-	c:\windows\system32\InstMed.exe
2009-02-14 23:45 . 2005-05-27 09:23	2180096	----a-r-	c:\windows\system32\drivers\lvsvf2.sys
2009-02-14 23:45 . 2005-01-31 10:20	211712	----a-r-	c:\windows\system32\drivers\LV561AV.SYS
2009-02-14 23:45 . 2005-01-31 10:18	372736	----a-r-	c:\windows\system32\LVUI2RC.dll
2009-02-14 23:45 . 2005-01-31 10:12	22016	-c--a-r-	c:\windows\system32\drivers\LVUSBSta.sys
2009-02-14 23:45 . 2005-01-31 10:10	204800	----a-r-	c:\windows\system32\LVUI2.dll
2009-02-14 23:45 . 2005-01-31 10:08	204800	-c--a-r-	c:\windows\system32\lvcodec2.dll
2009-02-14 23:45 . 2005-01-31 10:00	106496	----a-r-	c:\windows\system32\lvcoinst.dll
2009-02-14 19:30 . 2009-02-14 19:30	--------	d--h--w-	c:\windows\PIF
2009-02-13 17:38 . 2009-02-13 17:38	--------	d-----w-	c:\program files\QuickTime
2009-02-13 17:37 . 2009-02-13 17:37	--------	d-----w-	c:\program files\Apple Software Update
2009-02-13 17:37 . 2009-02-13 17:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2009-02-13 17:35 . 2009-02-13 17:36	--------	d-----w-	c:\program files\hkSFV
2009-02-12 12:26 . 2007-08-12 15:17	--------	d-----w-	c:\documents and settings\Default User
2009-02-12 09:29 . 2009-02-12 09:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-02-11 22:24 . 2009-02-11 22:24	--------	d-----w-	c:\program files\Yahoo!
2009-02-11 22:23 . 2009-02-11 22:29	--------	d-----w-	c:\program files\CCleaner
2009-02-10 17:55 . 2009-05-21 23:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\Grid Blue Memo Site
2009-02-06 19:50 . 1997-06-13 09:05	57344	-c--a-w-	c:\windows\system32\smooths.dll
2009-02-06 19:50 . 1997-04-17 18:40	254976	-c--a-w-	c:\windows\system32\SMSEQ.DLL
2009-02-06 19:01 . 1999-01-27 08:18	89360	-c--a-w-	c:\windows\system32\VB5DB.DLL
2009-02-06 19:01 . 1997-02-26 23:00	94992	-c--a-w-	c:\windows\system32\Vb5fr.dll
2009-02-06 19:01 . 1999-01-27 08:18	407312	-c--a-w-	c:\windows\system32\MSREPL35.DLL
2009-02-06 19:01 . 1999-01-27 08:18	252176	-c--a-w-	c:\windows\system32\MSRD2X35.DLL
2009-02-06 19:01 . 1999-01-27 08:18	24848	-c--a-w-	c:\windows\system32\Msjter35.dll
2009-02-06 19:01 . 1999-01-27 08:18	123664	-c--a-w-	c:\windows\system32\Msjint35.dll
2009-02-06 19:01 . 1999-01-27 08:18	1045776	-c--a-w-	c:\windows\system32\Msjet35.dll
2009-02-06 19:01 . 1999-01-27 08:18	107008	-c--a-w-	c:\windows\system32\fxtls432.dll
2009-02-06 19:01 . 1999-01-27 08:18	570128	-c--a-w-	c:\windows\system32\DAO350.DLL
2009-02-06 19:01 . 1997-11-11 13:10	28160	-c--a-w-	c:\windows\system32\atx32ole.dll
2009-02-06 19:01 . 1997-10-24 13:19	78336	-c--a-w-	c:\windows\system32\Atx32pic.dll
2009-02-06 19:01 . 1996-07-15 08:03	739328	-c--a-w-	c:\windows\system32\IR41_32.DLL
2009-02-06 12:30 . 2004-08-03 23:55	444928	-c--a-w-	c:\program files\paint.exe
2009-01-30 11:00 . 1997-05-30 09:26	41984	-c--a-w-	c:\windows\system32\ADIMON.DLL
2009-01-30 10:42 . 2009-03-27 12:19	--------	d-----w-	c:\documents and settings\All Users\Application Data\Autodesk
2009-01-29 19:30 . 2009-06-05 20:10	--------	d-----w-	c:\program files\Fichiers communs\Autodesk Shared
2009-01-22 18:43 . 1996-07-12 23:00	92208	-c--a-w-	c:\windows\system32\WING.DLL
2009-01-22 18:43 . 1996-07-12 23:00	12800	-c--a-w-	c:\windows\system32\WING32.DLL
2009-01-18 21:08 . 2009-02-19 11:14	--------	d-----w-	c:\windows\Lhsp
2009-01-18 21:08 . 2009-02-19 11:13	--------	d-----w-	c:\windows\speech
2009-01-15 23:53 . 2009-01-15 23:53	--------	d-----w-	c:\windows\Emulator ePSXe
2009-01-09 22:20 . 2004-08-03 21:58	100992	-c--a-w-	c:\windows\system32\drivers\bthpan.sys
2009-01-09 22:20 . 2004-08-03 21:58	100992	-c--a-w-	c:\windows\system32\dllcache\bthpan.sys
2009-01-09 22:18 . 2004-08-03 21:58	5504	-c--a-w-	c:\windows\system32\drivers\MSTEE.sys
2009-01-09 22:18 . 2004-08-03 21:58	5504	-c--a-w-	c:\windows\system32\dllcache\mstee.sys
2009-01-09 22:18 . 2004-08-03 22:10	10880	-c--a-w-	c:\windows\system32\drivers\NdisIP.sys
2009-01-09 22:18 . 2004-08-03 22:10	10880	-c--a-w-	c:\windows\system32\dllcache\ndisip.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-09 01:26 . 2006-12-04 00:14	3018864	----a-w-	C:\jacombo.exe
2009-06-06 22:34 . 2006-12-03 23:07	3018761	----a-r-	C:\ComboFix.exe
2009-05-27 12:48 . 2008-11-04 12:51	--------	d-----w-	c:\program files\SuperCopier2
2009-05-24 07:11 . 2006-12-03 23:01	456442	--sha-r-	c:\windows\system32\winfiles.exe
2009-05-23 00:31 . 2004-04-05 02:31	348160	----a-w-	c:\windows\system32\msvcr71.dll
2009-05-21 11:22 . 2009-05-21 11:22	32	----a-w-	c:\documents and settings\All Users\Application Data\ezsid.dat
2009-04-17 16:59 . 2009-04-17 16:59	--------	d-----w-	c:\program files\hp LaserJet 1000
2009-04-11 19:14 . 2009-06-08 15:26	11344	----a-w-	c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1036.dat
2009-04-04 20:57 . 2008-11-04 12:23	--------	d-----w-	c:\program files\Broadcom
2009-02-19 10:17 . 2009-02-19 10:17	5607	-c--a-w-	c:\windows\~GLH0001.TMP
2009-02-19 10:17 . 2009-02-19 10:17	104640	-c--a-w-	c:\windows\~GLC0002.TMP
2009-02-19 10:11 . 2009-02-19 10:11	5607	-c--a-w-	c:\windows\~GLH0000.TMP
2009-02-19 10:11 . 2009-02-19 10:11	104640	-c--a-w-	c:\windows\~GLC0001.TMP
2009-02-19 10:01 . 2009-02-19 10:01	104640	-c--a-w-	c:\windows\~GLC0000.TMP
2009-02-15 12:57 . 2009-02-15 11:05	--------	d-----w-	c:\program files\Logitech
2009-02-15 11:05 . 2009-02-15 11:05	--------	d-----w-	c:\program files\Fichiers communs\Logitech
2009-02-11 21:34 . 2008-11-04 12:30	--------	d-----w-	c:\program files\ATI Technologies
2009-01-09 22:17 . 2009-01-09 22:17	--------	d-----w-	c:\program files\IVT Corporation
2008-11-07 10:54 . 2008-11-04 12:26	--------	d-----w-	c:\program files\Fichiers communs\InstallShield
2008-11-05 17:55 . 2008-11-04 12:11	86331	-c--a-w-	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2008-11-04 12:50 . 2008-11-04 12:50	--------	d-----w-	c:\program files\Ahead
2008-11-04 12:50 . 2008-11-04 12:50	--------	d-----w-	c:\program files\Fichiers communs\Ahead
2008-11-04 12:48 . 2008-11-04 12:48	64419	-c--a-w-	c:\windows\BricoPackUninst.cmd
2008-11-04 12:48 . 2008-11-04 12:47	6120	-c--a-w-	c:\windows\BricoPackFoldersDelete.cmd
2008-11-04 12:48 . 2004-08-03 23:54	219648	----a-w-	c:\windows\system32\uxtheme.dll
2008-11-04 12:38 . 2008-11-04 12:38	--------	d-----w-	c:\program files\Analog Devices
2008-11-04 12:12 . 2008-11-04 12:12	--------	d-----w-	c:\program files\microsoft frontpage
2008-11-04 12:10 . 2008-11-04 12:10	--------	d-----w-	c:\program files\Services en ligne
2008-11-04 12:08 . 2008-11-04 12:08	21892	-c--a-w-	c:\windows\system32\emptyregdb.dat
2008-06-04 17:42 . 2004-08-03 23:54	1386496	-c----w-	c:\windows\system32\msvbvm60.dll
2007-08-13 17:54 . 2004-08-03 23:54	818688	----a-w-	c:\windows\system32\wininet.dll
2007-08-13 17:54 . 2004-08-03 23:54	413696	-c--a-w-	c:\windows\system32\vbscript.dll
2007-08-13 17:54 . 2001-10-02 18:18	156160	----a-w-	c:\windows\system32\msls31.dll
2007-08-13 17:45 . 2004-08-03 23:54	78336	-c--a-w-	c:\windows\system32\ieencode.dll
2007-08-13 17:44 . 2004-08-03 23:54	40960	-c--a-w-	c:\windows\system32\licmgr10.dll
2007-08-13 17:42 . 2004-08-03 23:54	17408	-c--a-w-	c:\windows\system32\corpol.dll
2007-08-13 17:39 . 2004-08-03 23:54	71680	-c--a-w-	c:\windows\system32\admparse.dll
2007-08-13 17:39 . 2004-08-03 23:54	55296	-c--a-w-	c:\windows\system32\iesetup.dll
2007-08-13 17:36 . 2004-08-03 23:54	36352	----a-w-	c:\windows\system32\imgutil.dll
2007-08-13 17:32 . 2004-08-03 23:54	45568	----a-w-	c:\windows\system32\mshta.exe
2007-08-13 17:01 . 2004-08-03 23:53	48128	-c--a-w-	c:\windows\system32\mshtmler.dll
2007-07-30 18:19 . 2008-11-04 12:09	203096	-c--a-w-	c:\windows\system32\wuweb.dll
2007-07-30 18:19 . 2008-11-04 12:09	1712984	-c--a-w-	c:\windows\system32\wuaueng.dll
2007-07-30 18:19 . 2008-11-04 12:09	549720	----a-w-	c:\windows\system32\wuapi.dll
2007-07-30 18:19 . 2008-11-04 12:09	325976	-c--a-w-	c:\windows\system32\wucltui.dll
2007-07-30 18:19 . 2004-08-03 23:54	92504	-c--a-w-	c:\windows\system32\cdm.dll
2007-07-30 18:19 . 2008-11-04 12:09	53080	-c--a-w-	c:\windows\system32\wuauclt.exe
2007-07-30 18:18 . 2008-11-04 12:09	33624	----a-w-	c:\windows\system32\wups.dll
2007-06-28 09:13 . 2007-06-28 09:13	32576	-c--a-w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.0.125\English\setup.exe
2007-01-19 10:53 . 2007-01-19 10:53	51056	----a-w-	c:\windows\system32\sirenacm.dll
2006-12-17 03:08 . 2008-11-04 09:36	38944	-c--a-w-	c:\windows\system32\drivers\ativvpxx.vp
2006-12-17 02:50 . 2006-12-17 02:50	263168	----a-w-	c:\windows\system32\ati2dvag.dll
2006-12-17 02:50 . 2008-11-04 12:30	1918464	-c--a-w-	c:\windows\system32\drivers\ati2mtag.sys
2006-12-17 02:44 . 2008-11-04 09:36	118784	----a-w-	c:\windows\system32\atipdlxx.dll
2006-12-17 02:44 . 2008-11-04 09:36	102400	----a-w-	c:\windows\system32\Oemdspif.dll
2006-12-17 02:44 . 2008-11-04 09:36	26112	-c--a-w-	c:\windows\system32\Ati2mdxx.exe
2006-12-17 02:44 . 2008-11-04 09:36	42496	----a-w-	c:\windows\system32\ati2edxx.dll
2006-12-17 02:44 . 2008-11-04 09:36	110592	----a-w-	c:\windows\system32\ati2evxx.dll
2006-12-17 02:42 . 2008-11-04 09:36	434176	----a-w-	c:\windows\system32\ati2evxx.exe
2006-12-17 02:42 . 2008-11-04 09:36	53248	----a-w-	c:\windows\system32\ATIDDC.DLL
2006-12-17 02:41 . 2008-11-04 09:36	307200	----a-w-	c:\windows\system32\atiiiexx.dll
2006-12-17 02:35 . 2006-12-17 02:35	2676672	----a-w-	c:\windows\system32\ati3duag.dll
2006-12-17 02:30 . 2006-12-17 02:30	1289472	----a-w-	c:\windows\system32\ativvaxx.dll
2006-12-17 02:30 . 2006-12-17 02:30	3107788	----a-w-	c:\windows\system32\ativvaxx.dat
2006-12-17 02:23 . 2008-11-04 09:36	6684672	----a-w-	c:\windows\system32\atioglx1.dll
2006-12-17 02:21 . 2008-11-04 09:36	5304320	----a-w-	c:\windows\system32\atioglxx.dll
2006-12-17 02:17 . 2008-11-04 09:36	241664	----a-w-	c:\windows\system32\atikvmag.dll
2006-12-17 02:16 . 2008-11-04 09:36	303104	----a-w-	c:\windows\system32\ATIDEMGR.dll
2006-12-17 02:16 . 2008-11-04 09:36	17408	----a-w-	c:\windows\system32\atitvo32.dll
2006-12-17 02:15 . 2008-11-04 09:36	49152	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2006-12-17 02:10 . 2006-12-17 02:10	315392	----a-w-	c:\windows\system32\ati2cqag.dll
2006-12-11 18:38 . 2006-12-11 18:38	53248	----a-w-	c:\windows\system32\PhysXLoader.dll
2006-12-04 09:36 . 2008-11-04 12:18	135840	-c--a-w-	c:\documents and settings\Adel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-12-04 07:00 . 2006-12-04 07:00	--------	d-----w-	c:\program files\Microsoft Reader
2006-12-04 07:00 . 2008-11-04 12:27	--------	d--h--w-	c:\program files\InstallShield Installation Information
2006-12-04 04:33 . 2006-12-04 04:33	4096	----a-w-	c:\windows\d3dx.dat
2006-12-04 04:03 . 2006-12-04 00:40	--------	d-----w-	c:\program files\MSN Messenger
2006-12-04 00:28 . 2008-11-04 12:53	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2006-12-04 00:15 . 2006-12-04 01:07	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-03 23:56 . 2006-12-03 23:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2006-12-03 23:50 . 2006-12-03 22:41	686	-c--a-w-	c:\windows\eReg.dat
2006-12-03 23:42 . 2006-12-03 23:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab
2006-12-03 23:08 . 2006-12-03 23:08	--------	d-----w-	c:\program files\Alwil Software
2006-12-03 23:03 . 2006-12-03 23:03	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\HiYo
2006-12-03 22:13 . 2006-12-03 22:13	--------	d-----w-	c:\program files\Namtuk
2006-12-03 22:01 . 2001-10-02 18:18	482926	----a-w-	c:\windows\system32\perfh00C.dat
2006-12-03 22:01 . 2001-10-02 18:18	79764	----a-w-	c:\windows\system32\perfc00C.dat
2006-12-03 22:01 . 2006-12-04 00:12	49152	----a-w-	c:\windows\system32\win drivers.exe
2006-11-28 19:55 . 2008-11-04 09:36	142347	-c--a-w-	c:\windows\system32\atiicdxx.dat
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelTraditionalChinese.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelSwedish.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelSpanish.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelSimplifiedChinese.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelPortugese.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelKorean.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelJapanese.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelGerman.dll
2006-11-22 10:37 . 2006-11-22 10:37	45056	----a-w-	c:\windows\system32\AgCPanelFrench.dll
2006-10-26 13:42 . 2006-10-26 13:42	36160	-c--a-w-	c:\windows\system32\FM20FRA.DLL
2006-10-26 13:10 . 2006-10-26 13:10	1190688	-c--a-w-	c:\windows\system32\FM20.DLL
.

------- Sigcheck -------

[-] 2004-08-03 23:54	978432	9F3B76C8CF787449A47F05ABAB4E13E6	c:\windows\explorer.exe
[-] 2004-08-03 23:54	978432	9F3B76C8CF787449A47F05ABAB4E13E6	c:\windows\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-05 68856]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Accélérateur de démarrage AutoCAD.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Accélérateur de démarrage AutoCAD.lnk
backup=c:\windows\pss\Accélérateur de démarrage AutoCAD.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Messenger\msmsgs.exe"=
"d:\LimeWire\LimeWire.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"d:\asmaa\uTorrent.exe"=
"c:\WINDOWS\system32\mqsvc.exe"=
"c:\Program Files\MSN Messenger\msnmsgr.exe"=
"c:\Program Files\MSN Messenger\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3030:TCP"= 3030:TCP:efweu
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [04/11/2008 13:26 3456]
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 agmlcy;Image Support;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 cdhyuhymi;Manager Shell;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 cslqtcvw;Boot Update;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 dzwjo;Driver Monitor;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 gzoaxwrd;Security Microsoft;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 ifsxcgb;Center Monitor;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 itevdpb;Helper Boot;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 jlxqr;Config Center;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 jpdbc;Image Support;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 jydtj;Update Time;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 kgcmblohm;Driver Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 kwbae;Network Microsoft;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 ojxvgf;Shell Network;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 oyfcvcmg;Update Server;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 plhngq;Image Time;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 pturydll;Helper Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 qnvaiyfdu;Helper Update;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 stdoop;Support Shell;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 tofalmp;Boot Support;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 uwdmfytq;Helper Driver;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S2 xffppk;Shell Update;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 00:55 14336]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 Msfotlk;Msfotlk;c:\windows\system32\drivers\rdbss.sys [03/08/2004 23:20 176512]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
npoyszyx
agmlcy
cdhyuhymi
qnvaiyfdu
kgcmblohm
kwbae
jpdbc
uwdmfytq
pturydll
xffppk
ojxvgf
tofalmp
oyfcvcmg
stdoop
plhngq
itevdpb
gzoaxwrd
jydtj
ifsxcgb
dzwjo
cslqtcvw
jlxqr
.
Contenu du dossier 'Tâches planifiées'

2009-05-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2009-06-08 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-07-07 16:26]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
HKU-Default-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\MsnMsgr.Exe
Notify-64613806530 - c:\windows\System32\dmime32.dll
SafeBoot-procexp90.Sys


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
mStart Page = hxxp://home.sweetim.com
uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
IE: &Search
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?262dd727c15c484696d4b339fdf78b53
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?262dd727c15c484696d4b339fdf78b53
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.
.
------- Associations de fichier -------
.
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2006-12-03 23:01
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\agmlcy]
"ServiceDll"="c:\windows\system32\qryvto.dll"

morenas31 · Answer

es-que je doit refaire toutes cette procédures pour mes autre pc  sachant que pour les deux apparaissent le document winfiles (des fois il est caché)
voila le rapport 


ComboFix 09-06-05.09 - Ibtissem 10/06/2009 15:03.4 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.990.625 [GMT 2:00]
Lancé depuis: C:\ComboFix.exe
Commutateurs utilisés :: C:\CFScript.txt

FILE ::
"c:\windows\winfiles.exe"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\autorun.ini
c:\windows\winfiles.exe
c:\windows\winnt.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-05-10 au 2009-06-10  ))))))))))))))))))))))))))))))))))))
.

2009-12-04 21:45 . 2009-12-04 21:45	--------	d-----w-	c:\program files\Xilisoft
2009-06-08 13:53 . 2009-06-08 13:53	--------	d-----w-	c:\documents and settings\Adel\Application Data\Malwarebytes
2009-06-08 13:53 . 2009-06-08 13:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-07 23:01 . 2006-12-03 23:01	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-06-07 16:40 . 2009-06-07 16:40	--------	d-----w-	c:\documents and settings\Miss Cullen\Local Settings\Application Data\Adobe
2009-06-06 20:35 . 2009-06-06 20:36	--------	d-----w-	C:\Lop SD
2009-06-06 20:10 . 2009-06-06 20:08	715721	----a-w-	C:\UsbFix.exe
2009-06-06 19:22 . 2009-06-06 19:22	--------	d-----w-	c:\program files	rend micro
2009-05-28 16:58 . 2006-12-03 23:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-05-28 16:44 . 2006-12-03 23:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee
2009-05-27 15:30 . 2009-05-27 15:30	--------	d-----w-	c:\documents and settings\Adel\Application Data\BearShare
2009-05-25 23:00 . 2009-05-25 22:27	2967800	----a-w-	C:\mbam-setup.exe
2009-05-24 19:06 . 2009-03-24 14:07	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-05-23 23:43 . 2009-05-23 23:43	--------	d-----w-	c:\program files\UNO Freeware
2009-05-23 23:43 . 2009-05-23 23:43	796672	----a-w-	c:\windows\GPInstall.exe
2009-05-23 10:56 . 2009-05-23 10:56	--------	d-----w-	C:\My Downloads
2009-05-23 10:23 . 2009-05-24 10:21	--------	d-----w-	c:\documents and settings\Adel\Application Data\skypePM
2009-05-21 23:26 . 2009-05-21 23:26	--------	d-----w-	c:\program files\Lies Ref Iso
2009-05-21 16:51 . 2009-05-21 17:18	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-05-21 11:19 . 2009-05-21 11:20	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-05-20 15:43 . 2009-05-21 08:34	--------	d-----w-	c:\documents and settings\Adel\Application Data\DMCache
2009-05-19 21:02 . 2009-05-19 21:02	--------	d-----w-	C:\save2pc
2009-05-16 20:35 . 2009-05-16 20:36	--------	d-----w-	c:\documents and settings\Ibtissem\Graphisoft
2009-05-16 20:21 . 2009-05-16 20:21	--------	d-----w-	c:\program files\WIBU-SYSTEMS
2009-05-16 20:13 . 2009-05-16 20:13	--------	d-----w-	c:\program files\Graphisoft

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-10 13:10 . 2001-10-02 18:18	79764	----a-w-	c:\windows\system32\perfc00C.dat
2009-06-10 13:10 . 2001-10-02 18:18	482926	----a-w-	c:\windows\system32\perfh00C.dat
2009-06-10 13:03 . 2006-12-04 00:12	49152	----a-w-	c:\windows\system32\win drivers.exe
2009-06-09 01:26 . 2006-12-04 00:14	3018864	----a-w-	C:\jacombo.exe
2009-06-06 22:34 . 2006-12-03 23:07	3018761	----a-r-	C:\ComboFix.exe
2009-06-05 20:10 . 2009-01-29 19:30	--------	d-----w-	c:\program files\Fichiers communs\Autodesk Shared
2009-05-30 22:07 . 2009-05-10 15:02	--------	d-----w-	c:\documents and settings\Adel\Application Data\Apple Computer
2009-05-29 17:08 . 2008-11-06 13:41	--------	d-----w-	c:\documents and settings\All Users\Application Data\part dead amok eggs
2009-05-27 12:48 . 2008-11-04 12:51	--------	d-----w-	c:\program files\SuperCopier2
2009-05-24 07:11 . 2006-12-03 23:01	456442	--sha-r-	c:\windows\system32\winfiles.exe
2009-05-23 23:26 . 2008-11-04 13:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-23 22:11 . 2008-11-06 13:02	--------	d-----w-	c:\program files\Fichiers communs\Real
2009-05-23 00:31 . 2004-04-05 02:31	348160	----a-w-	c:\windows\system32\msvcr71.dll
2009-05-21 23:26 . 2009-02-10 17:55	--------	d-----w-	c:\documents and settings\All Users\Application Data\Grid Blue Memo Site
2009-05-21 11:22 . 2009-05-21 11:22	32	----a-w-	c:\documents and settings\All Users\Application Data\ezsid.dat
2009-04-28 20:40 . 2009-04-28 20:40	923339	-c--a-w-	c:\windows\Zidane_Screensaver.scr
2009-04-17 16:59 . 2009-04-17 16:59	--------	d-----w-	c:\program files\hp LaserJet 1000
2009-04-16 09:39 . 2009-04-16 09:39	--------	d-----w-	c:\program files\Canon
2009-04-11 19:14 . 2009-06-08 15:26	11344	----a-w-	c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1036.dat
2009-03-22 07:08 . 2009-03-22 07:08	278728	-c--a-w-	c:\windows\system32\drivers\atksgt.sys
2009-03-22 07:08 . 2009-03-22 07:08	25416	-c--a-w-	c:\windows\system32\drivers\lirsgt.sys
2004-08-03 23:55 . 2009-02-06 12:30	444928	-c--a-w-	c:\program files\paint.exe
.

------- Sigcheck -------

[-] 2004-08-03 23:54	978432	9F3B76C8CF787449A47F05ABAB4E13E6	c:\windows\explorer.exe
[-] 2004-08-03 23:54	978432	9F3B76C8CF787449A47F05ABAB4E13E6	c:\windows\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot@2006-12-03_22.01.33   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-10 13:09 . 2009-06-10 13:09	16384              c:\windows\Temp\Perflib_Perfdata_6b8.dat
+ 2001-10-02 18:18 . 2009-06-10 13:10	66262              c:\windows\system32\perfc009.dat
- 2001-10-02 18:18 . 2006-12-03 22:01	66262              c:\windows\system32\perfc009.dat
+ 2001-10-02 18:18 . 2009-06-10 13:10	414996              c:\windows\system32\perfh009.dat
- 2001-10-02 18:18 . 2006-12-03 22:01	414996              c:\windows\system32\perfh009.dat
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-05 68856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Accélérateur de démarrage AutoCAD.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Accélérateur de démarrage AutoCAD.lnk
backup=c:\windows\pss\Accélérateur de démarrage AutoCAD.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Messenger\msmsgs.exe"=
"d:\LimeWire\LimeWire.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"d:\asmaa\uTorrent.exe"=
"c:\WINDOWS\system32\mqsvc.exe"=
"c:\Program Files\MSN Messenger\msnmsgr.exe"=
"c:\Program Files\MSN Messenger\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3030:TCP"= 3030:TCP:efweu
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [04/11/2008 14:26 3456]
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 agmlcy;Image Support;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 cdhyuhymi;Manager Shell;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 cslqtcvw;Boot Update;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 dzwjo;Driver Monitor;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 gzoaxwrd;Security Microsoft;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 ifsxcgb;Center Monitor;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 itevdpb;Helper Boot;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 jlxqr;Config Center;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 jpdbc;Image Support;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 jydtj;Update Time;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 kgcmblohm;Driver Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 kwbae;Network Microsoft;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 ojxvgf;Shell Network;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 oyfcvcmg;Update Server;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 plhngq;Image Time;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 pturydll;Helper Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 qnvaiyfdu;Helper Update;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 stdoop;Support Shell;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 tofalmp;Boot Support;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 uwdmfytq;Helper Driver;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S2 xffppk;Shell Update;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 Msfotlk;Msfotlk;c:\windows\system32\driversdbss.sys [04/08/2004 00:20 176512]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
npoyszyx
agmlcy
cdhyuhymi
qnvaiyfdu
kgcmblohm
kwbae
jpdbc
uwdmfytq
pturydll
xffppk
ojxvgf
tofalmp
oyfcvcmg
stdoop
plhngq
itevdpb
gzoaxwrd
jydtj
ifsxcgb
dzwjo
cslqtcvw
jlxqr
.
Contenu du dossier 'Tâches planifiées'

2009-05-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2009-06-09 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-07-07 16:26]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.bearshare.com/intl/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://home.sweetim.com
IE: &Search
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 15:10
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\agmlcy]
"ServiceDll"="c:\windows\system32\qryvto.dll"

Lyonnais92 · Answer

Bonjour à tous les deux,

morenas31, tu es infecté par une variante de Conficker qui a modifié, entre autres la clé de registre :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

On voit bien comment Combofix rend compte des modifications.

J'aimerai savoir comment elles se manifestent dans un autre outil.

Aurais-tu la gentillesse de faire la manip ci-dessous, ça devrait servir à d'autres.

Cette manip va seulement recueillir des informations. Elle ne fera aucune modifications à ton système.

Merci d'avance.

===

Télécharge AVZ ici :http://www.z-oleg.com/avz4.zip et enregistre le sur ton Bureau.
 
Dézippe par un clic droit et Choisis "Extraire tout". Suis les instructions.

Lance l'outil par un double clic (sous Vista par un clic droit et "Exécuter en tant qu'administrateur") sur AVZ.exe.

La fenêtre principale s'ouvre. Clique sur File puis sur Custom Scripts. 

Copy les lignes suivantes dans la fenêtre de saisie :  

begin
ExecuteStdScr(3);
RebootWindows(true);
end.

Clic sur Run pour exécuter le script. L'ordi va redémarrer. Dans le répertoire où est AVZ.exe, un sous-répertoire LOG a été créé. Tu vas y trouver le fichier  virusinfo_syscure.zip inside.  

CCM ne permet pas d'attacher un fichier. Pour me le transmettre, clique sur ce lien :

http://www.cijoint.fr/

Clique sur Parcourir et cherche le fichier ci-dessus.

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

morenas31 · Answer

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

morenas31 · Answer

http://www.cijoint.fr/cjlink.php?file=cj200906/cijqBVtu4H.zip

Lyonnais92 · Answer

Bonjour,

merci,

bien qu'il y ait une incertitude pour savoir si l'outil est allé au bout.

Pour avancer :

===

Ouvre Spybot search and destroy.

clique sur mode, choisis advanced mode;

dans la colonne de gauche clique sur le + devant tools.

clique sur résident (colonne de gauche)

dans la fenêtre de droite décoche la case devant "resident tea-timer"


Désinstalle Spybot S&D via le panneau de configuration, il va gêner la désinfection.

Tu le réinstalleras à la fin si tu souhaites.

Supprime aussi le répertoire C:\Program Files\Spybot - Search & Destroy 


Le logiciel peut gêner fortement la désinfection.

====
Télécharge cet outil de SiRi:

http://siri.urz.free.fr/RHosts.php

Double cliquer dessus pour l'exécuter

et cliquer sur " Restore original Hosts " 

====

Ouvre ce lien et télécharge ZHPDiag :

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html
hxxp://telechargement.zebulon.fr/telecharger-zhpdiag.html

Enregistre le sur ton Bureau.

Une fois le téléchargement achevé, lance ZHPDiag.exe et clique sur Unzip dans la fenêtre qui s'ouvre.

Clique sur Tous pour cocher toutes les cases des options.

Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse, clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Ouvre le fichier sauvegardé (ZHPDiag.txt)avec le Bloc-Notes et copie son contenu dans ta réponse.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\.ZHPDiag.txt

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse. 


==================================

Relance AVZ.exe par un double clic (sous Vista par un clic droit et "Exécuter en tant qu'administrateur") sur .

La fenêtre principale s'ouvre. Clique sur File puis sur Custom Scripts. 

Copy les lignes suivantes dans la fenêtre de saisie :  

begin
ExecuteStdScr(3);
RebootWindows(true);
end.

Clic sur Run pour exécuter le script. L'ordi va redémarrer. Dans le répertoire où est AVZ.exe, un sous-répertoire LOG a été créé. Tu vas y trouver le fichier  virusinfo_syscure.zip inside.  

CCM ne permet pas d'attacher un fichier. Pour me le transmettre, clique sur ce lien :

http://www.cijoint.fr/

Clique sur Parcourir et cherche le fichier ci-dessus.

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

morenas31 · Answer

un message d'erreur s'affiche quand je veut lancé ZHPDiag.exe disant qu'il n'est pas une application win32 valide

j'ai relancé avz.exe et voila le rapport

http://www.cijoint.fr/cjlink.php?file=cj200906/cijPUUL1iF.zip

Lyonnais92 · Answer

Re,

merci beaucoup.

=============

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver::
npoyszyx
agmlcy 
cdhyuhymi 
qnvaiyfdu
kgcmblohm
kwbae
jpdbc
uwdmfytq
pturydll
xffppk
ojxvgf
tofalmp
oyfcvcmg
stdoop
plhngq
itevdpb
gzoaxwrd
jydtj
ifsxcgb
dzwjo
cslqtcvw
jlxqr
FXDrv32

File::
c:\windows\system32\qryvto.dll
c:\windows\system32\pevlehb.dll
e:\fxdrv32.sys

NetSvc::
npoyszyx
agmlcy 
cdhyuhymi 
qnvaiyfdu
kgcmblohm
kwbae
jpdbc
uwdmfytq
pturydll
xffppk
ojxvgf
tofalmp
oyfcvcmg
stdoop
plhngq
itevdpb
gzoaxwrd
jydtj
ifsxcgb
dzwjo
cslqtcvw
jlxqr
.
 
Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\agmlcy]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cdhyuhymi]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cslqtcvw]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dzwjo]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gzoaxwrd]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ifsxcgb] 
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\itevdpb] 
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jlxqr]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jpdbc]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jydtj]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kgcmblohm]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kwbae]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ojxvgf]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\oyfcvcmg]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\plhngq]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pturydll]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\qnvaiyfdu]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\stdoop]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services	ofalmp]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uwdmfytq]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xffppk]


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

morenas31 · Answer

vraiment merci pour cette aide


ComboFix 09-06-05.09 - Ibtissem 12/06/2009 23:45.5 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.990.665 [GMT 2:00]
Lancé depuis: C:\ComboFix.exe
Commutateurs utilisés :: C:\CFscript.txt

FILE ::
"c:\windows\system32\pevlehb.dll"
"c:\windows\system32\qryvto.dll"
"e:\fxdrv32.sys"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\autorun.ini
c:\windows\winnt.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AGMLCY
-------\Legacy_CDHYUHYMI
-------\Legacy_CSLQTCVW
-------\Legacy_DZWJO
-------\Legacy_FXDRV32
-------\Legacy_GZOAXWRD
-------\Legacy_IFSXCGB
-------\Legacy_ITEVDPB
-------\Legacy_JLXQR
-------\Legacy_JPDBC
-------\Legacy_JYDTJ
-------\Legacy_KGCMBLOHM
-------\Legacy_KWBAE
-------\Legacy_NPOYSZYX
-------\Legacy_OJXVGF
-------\Legacy_OYFCVCMG
-------\Legacy_PLHNGQ
-------\Legacy_PTURYDLL
-------\Legacy_QNVAIYFDU
-------\Legacy_STDOOP
-------\Legacy_TOFALMP
-------\Legacy_UWDMFYTQ
-------\Legacy_XFFPPK
-------\Service_agmlcy
-------\Service_cdhyuhymi
-------\Service_cslqtcvw
-------\Service_dzwjo
-------\Service_FXDrv32
-------\Service_gzoaxwrd
-------\Service_ifsxcgb
-------\Service_itevdpb
-------\Service_jlxqr
-------\Service_jpdbc
-------\Service_jydtj
-------\Service_kgcmblohm
-------\Service_kwbae
-------\Service_ojxvgf
-------\Service_oyfcvcmg
-------\Service_plhngq
-------\Service_pturydll
-------\Service_qnvaiyfdu
-------\Service_stdoop
-------\Service_tofalmp
-------\Service_uwdmfytq
-------\Service_xffppk


(((((((((((((((((((((((((((((   Fichiers créés du 2009-05-12 au 2009-06-12  ))))))))))))))))))))))))))))))))))))
.

2009-12-04 21:45 . 2009-12-04 21:45	--------	d-----w-	c:\program files\Xilisoft
2009-06-12 20:46 . 2009-06-12 20:40	252928	----a-w-	C:\RHosts.exe
2009-06-12 20:46 . 2009-06-12 20:44	524288	----a-w-	C:\ZHPDiag.exe
2009-06-10 16:22 . 2009-05-24 07:11	456442	--sha-r-	c:\windows\winfiles.exe
2009-06-08 13:53 . 2009-06-08 13:53	--------	d-----w-	c:\documents and settings\Adel\Application Data\Malwarebytes
2009-06-08 13:53 . 2009-06-08 13:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-07 16:40 . 2009-06-07 16:40	--------	d-----w-	c:\documents and settings\Miss Cullen\Local Settings\Application Data\Adobe
2009-06-06 20:35 . 2009-06-06 20:36	--------	d-----w-	C:\Lop SD
2009-06-06 20:10 . 2009-06-06 20:08	715721	----a-w-	C:\UsbFix.exe
2009-06-06 19:22 . 2009-06-06 19:22	--------	d-----w-	c:\program files	rend micro
2009-05-28 16:58 . 2006-12-03 23:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-05-28 16:44 . 2006-12-03 23:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee
2009-05-27 15:30 . 2009-05-27 15:30	--------	d-----w-	c:\documents and settings\Adel\Application Data\BearShare
2009-05-25 23:00 . 2009-05-25 22:27	2967800	----a-w-	C:\mbam-setup.exe
2009-05-24 19:06 . 2009-03-24 15:07	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-05-23 23:43 . 2009-05-23 23:43	--------	d-----w-	c:\program files\UNO Freeware
2009-05-23 23:43 . 2009-05-23 23:43	796672	----a-w-	c:\windows\GPInstall.exe
2009-05-23 10:56 . 2009-05-23 10:56	--------	d-----w-	C:\My Downloads
2009-05-23 10:23 . 2009-05-24 10:21	--------	d-----w-	c:\documents and settings\Adel\Application Data\skypePM
2009-05-21 23:26 . 2009-05-21 23:26	--------	d-----w-	c:\program files\Lies Ref Iso
2009-05-21 16:51 . 2009-05-21 17:18	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-05-21 11:19 . 2009-05-21 11:20	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-05-20 15:43 . 2009-05-21 08:34	--------	d-----w-	c:\documents and settings\Adel\Application Data\DMCache
2009-05-19 21:02 . 2009-05-19 21:02	--------	d-----w-	C:\save2pc
2009-05-16 20:35 . 2009-05-16 20:36	--------	d-----w-	c:\documents and settings\Ibtissem\Graphisoft
2009-05-16 20:21 . 2009-05-16 20:21	--------	d-----w-	c:\program files\WIBU-SYSTEMS
2009-05-16 20:13 . 2009-05-16 20:13	--------	d-----w-	c:\program files\Graphisoft

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-12 21:45 . 2006-12-04 14:24	49152	----a-w-	c:\windows\system32\win drivers.exe
2009-06-12 20:02 . 2001-10-02 18:18	79764	----a-w-	c:\windows\system32\perfc00C.dat
2009-06-12 20:02 . 2001-10-02 18:18	482926	----a-w-	c:\windows\system32\perfh00C.dat
2009-06-09 01:26 . 2006-12-04 00:14	3018864	----a-w-	C:\jacombo.exe
2009-06-06 22:34 . 2006-12-03 23:07	3018761	----a-r-	C:\ComboFix.exe
2009-06-05 20:10 . 2009-01-29 19:30	--------	d-----w-	c:\program files\Fichiers communs\Autodesk Shared
2009-05-30 22:07 . 2009-05-10 15:02	--------	d-----w-	c:\documents and settings\Adel\Application Data\Apple Computer
2009-05-29 17:08 . 2008-11-06 13:41	--------	d-----w-	c:\documents and settings\All Users\Application Data\part dead amok eggs
2009-05-27 12:48 . 2008-11-04 12:51	--------	d-----w-	c:\program files\SuperCopier2
2009-05-24 07:11 . 2006-12-03 23:01	456442	--sha-r-	c:\windows\system32\winfiles.exe
2009-05-23 23:26 . 2008-11-04 13:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-23 22:11 . 2008-11-06 13:02	--------	d-----w-	c:\program files\Fichiers communs\Real
2009-05-23 00:31 . 2004-04-05 02:31	348160	----a-w-	c:\windows\system32\msvcr71.dll
2009-05-21 23:26 . 2009-02-10 17:55	--------	d-----w-	c:\documents and settings\All Users\Application Data\Grid Blue Memo Site
2009-05-21 11:22 . 2009-05-21 11:22	32	----a-w-	c:\documents and settings\All Users\Application Data\ezsid.dat
2009-04-28 20:40 . 2009-04-28 20:40	923339	-c--a-w-	c:\windows\Zidane_Screensaver.scr
2009-04-17 16:59 . 2009-04-17 16:59	--------	d-----w-	c:\program files\hp LaserJet 1000
2009-04-16 09:39 . 2009-04-16 09:39	--------	d-----w-	c:\program files\Canon
2009-04-11 19:14 . 2009-06-08 15:26	11344	----a-w-	c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1036.dat
2009-03-22 07:08 . 2009-03-22 07:08	278728	-c--a-w-	c:\windows\system32\drivers\atksgt.sys
2009-03-22 07:08 . 2009-03-22 07:08	25416	-c--a-w-	c:\windows\system32\drivers\lirsgt.sys
2004-08-03 23:55 . 2009-02-06 12:30	444928	-c--a-w-	c:\program files\paint.exe
.

------- Sigcheck -------

[-] 2004-08-03 23:54	978432	9F3B76C8CF787449A47F05ABAB4E13E6	c:\windows\explorer.exe
[-] 2004-08-03 23:54	978432	9F3B76C8CF787449A47F05ABAB4E13E6	c:\windows\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((   SnapShot@2006-12-03_22.01.33   )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 01:19 . 2007-11-07 01:19	54272              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
- 2007-11-07 00:19 . 2007-11-07 00:19	54272              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	62976              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	62976              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	46080              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	46080              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	46592              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	46592              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	64512              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	64512              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	66048              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	66048              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	65024              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	65024              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	65024              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	65024              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	56832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	56832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	66560              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	66560              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	39936              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	39936              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	38912              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	38912              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 05:07 . 2008-07-29 05:07	59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
- 2008-07-29 04:07 . 2008-07-29 04:07	59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 05:07 . 2008-07-29 05:07	59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
- 2008-07-29 04:07 . 2008-07-29 04:07	59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2009-06-12 21:50 . 2009-06-12 21:50	16384              c:\windows\Temp\Perflib_Perfdata_774.dat
+ 2001-10-02 18:18 . 2009-06-12 20:02	66262              c:\windows\system32\perfc009.dat
- 2001-10-02 18:18 . 2006-12-03 22:01	66262              c:\windows\system32\perfc009.dat
+ 2008-07-29 07:05 . 2008-07-29 07:05	655872              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	655872              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	572928              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	572928              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
- 2008-07-29 01:54 . 2008-07-29 01:54	225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 02:54 . 2008-07-29 02:54	225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	161784              c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	161784              c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2001-10-02 18:18 . 2009-06-12 20:02	414996              c:\windows\system32\perfh009.dat
- 2001-10-02 18:18 . 2006-12-03 22:01	414996              c:\windows\system32\perfh009.dat
+ 2008-07-29 07:05 . 2008-07-29 07:05	3783672              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	3783672              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
- 2008-07-29 06:05 . 2008-07-29 06:05	3768312              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05	3768312              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-05 68856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\Adel\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Accélérateur de démarrage AutoCAD.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Accélérateur de démarrage AutoCAD.lnk
backup=c:\windows\pss\Accélérateur de démarrage AutoCAD.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=c:\documents and settings\Ibtissem\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Messenger\msmsgs.exe"=
"d:\LimeWire\LimeWire.exe"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"d:\asmaa\uTorrent.exe"=
"c:\WINDOWS\system32\mqsvc.exe"=
"c:\Program Files\MSN Messenger\msnmsgr.exe"=
"c:\Program Files\MSN Messenger\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3030:TCP"= 3030:TCP:efweu
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [04/11/2008 14:26 3456]
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 01:55 14336]
S3 Msfotlk;Msfotlk;c:\windows\system32\driversdbss.sys [04/08/2004 00:20 176512]
.
Contenu du dossier 'Tâches planifiées'

2009-05-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2009-06-12 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-07-07 16:26]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.bearshare.com/intl/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://home.sweetim.com
IE: &Search
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-12 23:51
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1417001333-1085031214-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:f0,ba,0e,70,52,19,c9,fe,b1,6a,39,51,29,8d,20,4f,4d,a3,0f,62,ee,66,06,
   ef,bb,59,63,eb,e2,52,05,df,fe,94,77,a1,ba,46,8a,35,19,9b,67,9d,20,9f,0a,fc,\
"??"=hex:92,f5,79,d3,45,d9,13,76,4a,40,b7,3c,25,72,22,3d
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(636)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(288)
c:\windows\system32\MSVCP60.dll
c:\windows\system32
tshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\msdtc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2009-06-12 23:53 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-06-12 21:53
ComboFix2.txt  2009-06-10 13:12
ComboFix3.txt  2009-06-09 15:26
ComboFix4.txt  2006-12-03 22:04

Avant-CF: 6 771 867 648 octets libres
Après-CF: 6 761 242 624 octets libres

302	--- E O F ---	2008-11-05 21:23

Lyonnais92 · Answer

Bonjour,

l'outil a bien travaillé.

Relance USBFix et Lop S&D comme demandé au début du topic.

morenas31 · Answer

toujours le même problème quand je clique sur Lop S&D une fenêtre bleu apparait pendant une seconde puis rien et pour usbfix il c'est installé normalement mais aussi quand je clique une fenêtre noire apparait pendant une seconde puis rien

Lyonnais92 · Answer

Bonjour,

Démarrer, Exécuter, tape combofix /u dans la zone de saisie puis clique sur OK.

* Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.

http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

* Clique sur Recherche et laisse le scan se terminer.

* Clique, sur Suppression pour finaliser.

* Tu peux, si tu le souhaites, te servir des Options facultatives.

* Clique sur Quitter, pour que le rapport puisse se créer.

* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

===============

Telecharge et installe UsbFix de C_XX & Chiquitine29

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau .

# Choisie l' option 1 ( Recherche )

# Laisse travailler l'outil.

# Ensuite poste le rapport UsbFix.txt qui apparaitra.

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
         Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
         Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

morenas31 · Answer

[ Rapport ToolsCleaner version 2.3.6 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\avenger.txt: trouvé !
C:\UsbFix.exe: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\UsbFix: trouvé !
C:\Documents and Settings\Adel\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\Ibtissem\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Ibtissem\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\Ibtissem\Menu Démarrer\Programmes\UsbFix: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\Ibtissem\Bureau\LopSD.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\avenger.txt: supprimé !
C:\UsbFix.exe: supprimé !
C:\Documents and Settings\Ibtissem\Bureau\UsbFix.exe: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\UsbFix: supprimé !
C:\Documents and Settings\Adel\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Documents and Settings\Ibtissem\Menu Démarrer\Programmes\UsbFix: supprimé !

morenas31 · Answer

############################## [ UsbFix V3.029 | Scan ]

# User : Ibtissem () # BOUSMAHA
# Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 15:01:14 | 15/06/2009

#               Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 29,29 Go (7,78 Go free) # NTFS
# D:\ # Disque fixe local # 45,19 Go (6,42 Go free) # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque amovible # 3,72 Go (3,56 Go free) [MILOUD REAL] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe

################## [  Registre Startup ]

HKCU_Main:   "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
HKCU_Main:   "Window Title"="" 
HKLM_logon:  "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon:  "DefaultUserName"="Ibtissem" 
HKLM_logon:  "AltDefaultUserName"="Ibtissem" 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    windows drivers=C:\WINDOWS\system32\win drivers.exe 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe  

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]


################## [ ! Fin du rapport # UsbFix V3.029 ! ]

Lyonnais92 · Answer

Bonjour,

Télécharge Lop S&D ici :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Double-clique dessus pour lancer l'installation

Puis double-clique [b]sur le raccourci Lop S&D/b présent sur ton bureau

Séléctionne la langue souhaitée , puis choisis [b]l'Option 1/b ( Recherche )

Patiente jusqu'à la fin du scan

Poste le rapport généré ( C:lopR.txt )

morenas31 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 1.1.2 
   USER : Adel ( Administrator )
   BOOT : Normal boot
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:29 Go (Free:7 Go)
   D:\ (Local Disk) - FAT32 - Total:45 Go (Free:6 Go)
   E:\ (CD or DVD)
   F:\ (USB) - FAT32 - Total:3811 Mo (Free:3 Go)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 15/06/2009|16:52 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [04/12/2006|01:55] C:\DOCUME~1\Adel\APPLIC~1\Adobe
   [31/05/2009|00:07] C:\DOCUME~1\Adel\APPLIC~1\Apple Computer
   [14/12/2008|01:00] C:\DOCUME~1\Adel\APPLIC~1\ATI
   [27/05/2009|17:30] C:\DOCUME~1\Adel\APPLIC~1\BearShare
   [07/11/2008|16:04] C:\DOCUME~1\Adel\APPLIC~1\COWON
   [21/05/2009|10:34] C:\DOCUME~1\Adel\APPLIC~1\DMCache
   [24/02/2009|01:22] C:\DOCUME~1\Adel\APPLIC~1\Free Spider TreeCardGames
   [05/11/2008|19:57] C:\DOCUME~1\Adel\APPLIC~1\Google
   [14/12/2008|20:44] C:\DOCUME~1\Adel\APPLIC~1\Hamachi
   [04/01/2009|14:07] C:\DOCUME~1\Adel\APPLIC~1\Help
   [25/12/2008|16:39] C:\DOCUME~1\Adel\APPLIC~1\HiYo
   [04/11/2008|14:17] C:\DOCUME~1\Adel\APPLIC~1\Identities
   [31/03/2009|16:14] C:\DOCUME~1\Adel\APPLIC~1\Macromedia
   [08/06/2009|15:53] C:\DOCUME~1\Adel\APPLIC~1\Malwarebytes
   [18/11/2008|13:59] C:\DOCUME~1\Adel\APPLIC~1\Media Player Classic
   [04/12/2006|03:16] C:\DOCUME~1\Adel\APPLIC~1\Microsoft
   [23/05/2009|13:13] C:\DOCUME~1\Adel\APPLIC~1\Real
   [07/12/2008|23:14] C:\DOCUME~1\Adel\APPLIC~1\SecuROM
   [24/05/2009|12:21] C:\DOCUME~1\Adel\APPLIC~1\skypePM
   [05/11/2008|20:20] C:\DOCUME~1\Adel\APPLIC~1\Sun

   [04/12/2006|01:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\HiYo
   [04/12/2006|01:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [26/05/2009|11:29] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [07/11/2008|01:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [13/02/2009|19:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [13/02/2009|19:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [27/03/2009|14:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
   [20/11/2008|18:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [22/05/2009|01:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grid Blue Memo Site
   [23/11/2008|19:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HiYo
   [04/12/2006|01:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
   [04/12/2006|01:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
   [29/01/2009|12:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
   [08/06/2009|15:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [04/12/2006|01:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [08/11/2008|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [04/12/2006|01:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [14/06/2009|03:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [30/03/2009|16:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [29/05/2009|19:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
   [04/12/2006|01:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [21/05/2009|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [04/12/2006|03:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [07/11/2008|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [04/12/2007|21:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [04/11/2008|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [11/02/2009|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [12/02/2009|11:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion



   [06/05/2008|00:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft


   [26/05/2009|11:29] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [07/06/2009|18:40] C:\DOCUME~1\MISSCU~1\APPLIC~1\Adobe
   [07/06/2009|18:26] C:\DOCUME~1\MISSCU~1\APPLIC~1\Identities
   [07/06/2009|18:37] C:\DOCUME~1\MISSCU~1\APPLIC~1\Microsoft

   [26/05/2009|11:29] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [21/05/2009 17:39][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [15/06/2009 16:23][--a------] C:\WINDOWS	asks\Check Updates for Windows Live Toolbar.job
   [15/06/2009 14:58][--ah-c---] C:\WINDOWS	asks\SA.DAT
   [02/10/2001 20:18][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [04/12/2006|02:28] C:\Program Files\Adobe
   [04/11/2008|14:50] C:\Program Files\Ahead
   [04/12/2006|01:08] C:\Program Files\Alwil Software
   [04/11/2008|14:38] C:\Program Files\Analog Devices
   [27/03/2009|14:56] C:\Program Files\AnswerWorks 4.0
   [13/02/2009|19:37] C:\Program Files\Apple Software Update
   [11/02/2009|23:34] C:\Program Files\ATI Technologies
   [27/03/2009|14:58] C:\Program Files\AutoCAD 2006
   [27/03/2009|14:16] C:\Program Files\Autodesk
   [04/04/2009|22:57] C:\Program Files\Broadcom
   [16/04/2009|11:39] C:\Program Files\Canon
   [12/02/2009|00:29] C:\Program Files\CCleaner
   [08/11/2008|01:06] C:\Program Files\Circle Developement
   [19/02/2009|13:46] C:\Program Files\Dell
   [16/12/2008|12:20] C:\Program Files\directx
   [27/03/2009|16:10] C:\Program Files\EPSON
   [12/06/2009|23:47] C:\Program Files\Fichiers communs
   [12/12/2008|00:04] C:\Program Files\Fighter Ace 3.5 Ftv
   [04/12/2008|19:23] C:\Program Files\GMG
   [02/12/2008|19:08] C:\Program Files\Google
   [16/05/2009|22:13] C:\Program Files\Graphisoft
   [23/11/2008|19:08] C:\Program Files\HiYo
   [17/04/2009|18:59] C:\Program Files\hp LaserJet 1000
   [04/12/2006|09:00] C:\Program Files\InstallShield Installation Information
   [21/11/2008|14:29] C:\Program Files\Internet Explorer
   [10/01/2009|00:17] C:\Program Files\IVT Corporation
   [19/02/2009|13:51] C:\Program Files\Java
   [02/04/2009|20:08] C:\Program Files\JetAudio
   [22/05/2009|01:26] C:\Program Files\Lies Ref Iso
   [15/02/2009|14:57] C:\Program Files\Logitech
   [28/11/2008|20:43] C:\Program Files\Messenger
   [21/05/2009|19:18] C:\Program Files\Messenger Plus! Live
   [13/12/2008|21:13] C:\Program Files\MessengerDiscovery
   [27/03/2009|15:06] C:\Program Files\Microsoft Encarta
   [04/11/2008|14:12] C:\Program Files\microsoft frontpage
   [27/03/2009|14:56] C:\Program Files\Microsoft Office
   [04/12/2006|09:00] C:\Program Files\Microsoft Reader
   [20/02/2009|11:57] C:\Program Files\Microsoft R‚f‚rence
   [04/11/2008|15:08] C:\Program Files\Microsoft Visual Studio
   [04/11/2008|15:09] C:\Program Files\Microsoft Works
   [05/12/2008|00:24] C:\Program Files\Movie Maker
   [04/11/2008|15:08] C:\Program Files\MSBuild
   [04/11/2008|14:07] C:\Program Files\MSN
   [04/11/2008|14:08] C:\Program Files\MSN Gaming Zone
   [04/12/2006|06:03] C:\Program Files\MSN Messenger
   [04/12/2006|00:13] C:\Program Files\Namtuk
   [04/11/2008|14:09] C:\Program Files\NetMeeting
   [04/11/2008|14:56] C:\Program Files\Outlook Express
   [13/02/2009|19:38] C:\Program Files\QuickTime
   [06/11/2008|15:02] C:\Program Files\Ringz Studio
   [04/11/2008|14:10] C:\Program Files\Services en ligne
   [19/02/2009|21:41] C:\Program Files\Spider
   [27/05/2009|14:48] C:\Program Files\SuperCopier2
   [06/06/2009|21:22] C:\Program Files	rend micro
   [04/11/2008|14:16] C:\Program Files\Uninstall Information
   [24/05/2009|01:43] C:\Program Files\UNO Freeware
   [18/02/2009|22:58] C:\Program Files\uTorrent
   [16/05/2009|22:21] C:\Program Files\WIBU-SYSTEMS
   [04/11/2008|23:12] C:\Program Files\Windows Live
   [28/11/2008|20:43] C:\Program Files\Windows Live Toolbar
   [04/04/2009|19:46] C:\Program Files\Windows Media Player
   [31/03/2009|11:13] C:\Program Files\Windows NT
   [04/11/2008|14:10] C:\Program Files\WindowsUpdate
   [02/04/2009|11:49] C:\Program Files\WinRAR
   [04/11/2008|14:12] C:\Program Files\xerox
   [04/12/2009|23:45] C:\Program Files\Xilisoft
   [12/02/2009|00:24] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [04/12/2006|02:28] C:\Program Files\Fichiers communs\Adobe
   [06/11/2008|15:14] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [04/11/2008|14:50] C:\Program Files\Fichiers communs\Ahead
   [05/06/2009|22:10] C:\Program Files\Fichiers communs\Autodesk Shared
   [06/11/2008|17:24] C:\Program Files\Fichiers communs\COWON
   [27/03/2009|14:56] C:\Program Files\Fichiers communs\DESIGNER
   [07/11/2008|12:54] C:\Program Files\Fichiers communs\InstallShield
   [19/02/2009|13:51] C:\Program Files\Fichiers communs\Java
   [15/02/2009|13:05] C:\Program Files\Fichiers communs\Logitech
   [04/12/2006|09:00] C:\Program Files\Fichiers communs\Microsoft Shared
   [02/10/2001|20:18] C:\Program Files\Fichiers communs\Mozilla Shared
   [04/11/2008|14:09] C:\Program Files\Fichiers communs\MSSoap
   [01/04/2009|15:34] C:\Program Files\Fichiers communs\Nero
   [04/11/2008|15:02] C:\Program Files\Fichiers communs\ODBC
   [24/05/2009|00:11] C:\Program Files\Fichiers communs\Real
   [04/11/2008|14:09] C:\Program Files\Fichiers communs\Services
   [04/11/2008|15:02] C:\Program Files\Fichiers communs\SpeechEngines
   [04/11/2008|15:06] C:\Program Files\Fichiers communs\System
   [04/11/2008|22:46] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 31 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grid Blue Memo Site
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs	itle real.dat
   C:\Program Files\Circle Developement
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-06-15 16:53:10
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 9
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Adel\Mes documents\logiciel\Download Accelerator Plus 8.5\Crack
   C:\DOCUME~1\Adel\Mes documents\logiciel\Download Accelerator Plus 8.5\Crack\a lire.txt
   C:\DOCUME~1\Adel\Mes documents\logiciel\Download Accelerator Plus 8.5\Crack\DAP.exe
   C:\DOCUME~1\Adel\Mes documents\logiciel\Download Accelerator Plus 8.5\Crack\zlib.dll


   [F:1][D:0]-> C:\DOCUME~1\Adel\LOCALS~1\Temp
   [F:1][D:0]-> C:\DOCUME~1\Adel\Cookies
   [F:6][D:4]-> C:\DOCUME~1\Adel\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 15/06/2009|16:53 - Option : [1]

   --------------------\  Fin du rapport a 16:53:42

Lyonnais92 · Answer

Re,

Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré ( C:\lopR.txt )

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier,

 Nouvelle tâche, tape explorer.exe et valide )

morenas31 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 1.1.2 
   USER : Ibtissem ( Administrator )
   BOOT : Normal boot
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:29 Go (Free:7 Go)
   D:\ (Local Disk) - FAT32 - Total:45 Go (Free:6 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 15/06/2009|17:18 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs	itle real.dat
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grid Blue Memo Site
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
   Supprime! - C:\Program Files\Circle Developement
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [04/12/2006|01:55] C:\DOCUME~1\Adel\APPLIC~1\Adobe
   [31/05/2009|00:07] C:\DOCUME~1\Adel\APPLIC~1\Apple Computer
   [14/12/2008|01:00] C:\DOCUME~1\Adel\APPLIC~1\ATI
   [27/05/2009|17:30] C:\DOCUME~1\Adel\APPLIC~1\BearShare
   [07/11/2008|16:04] C:\DOCUME~1\Adel\APPLIC~1\COWON
   [21/05/2009|10:34] C:\DOCUME~1\Adel\APPLIC~1\DMCache
   [24/02/2009|01:22] C:\DOCUME~1\Adel\APPLIC~1\Free Spider TreeCardGames
   [05/11/2008|19:57] C:\DOCUME~1\Adel\APPLIC~1\Google
   [14/12/2008|20:44] C:\DOCUME~1\Adel\APPLIC~1\Hamachi
   [04/01/2009|14:07] C:\DOCUME~1\Adel\APPLIC~1\Help
   [25/12/2008|16:39] C:\DOCUME~1\Adel\APPLIC~1\HiYo
   [04/11/2008|14:17] C:\DOCUME~1\Adel\APPLIC~1\Identities
   [31/03/2009|16:14] C:\DOCUME~1\Adel\APPLIC~1\Macromedia
   [08/06/2009|15:53] C:\DOCUME~1\Adel\APPLIC~1\Malwarebytes
   [18/11/2008|13:59] C:\DOCUME~1\Adel\APPLIC~1\Media Player Classic
   [04/12/2006|03:16] C:\DOCUME~1\Adel\APPLIC~1\Microsoft
   [23/05/2009|13:13] C:\DOCUME~1\Adel\APPLIC~1\Real
   [07/12/2008|23:14] C:\DOCUME~1\Adel\APPLIC~1\SecuROM
   [24/05/2009|12:21] C:\DOCUME~1\Adel\APPLIC~1\skypePM
   [05/11/2008|20:20] C:\DOCUME~1\Adel\APPLIC~1\Sun

   [04/12/2006|01:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\HiYo
   [04/12/2006|01:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [26/05/2009|11:29] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [07/11/2008|01:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [13/02/2009|19:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [13/02/2009|19:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [27/03/2009|14:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
   [20/11/2008|18:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [23/11/2008|19:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HiYo
   [04/12/2006|01:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
   [04/12/2006|01:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
   [29/01/2009|12:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
   [08/06/2009|15:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [04/12/2006|01:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [08/11/2008|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [04/12/2006|01:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [14/06/2009|03:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [30/03/2009|16:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [04/12/2006|01:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [21/05/2009|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [04/12/2006|03:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [07/11/2008|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [04/12/2007|21:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [04/11/2008|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [11/02/2009|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [12/02/2009|11:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion



   [06/05/2008|00:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [10/02/2009|16:53] C:\DOCUME~1\Ibtissem\APPLIC~1\Adobe
   [13/02/2009|19:41] C:\DOCUME~1\Ibtissem\APPLIC~1\Apple Computer
   [21/11/2008|14:42] C:\DOCUME~1\Ibtissem\APPLIC~1\ATI
   [25/03/2009|20:58] C:\DOCUME~1\Ibtissem\APPLIC~1\Autodesk
   [24/05/2009|02:44] C:\DOCUME~1\Ibtissem\APPLIC~1\BearShare
   [15/11/2008|04:41] C:\DOCUME~1\Ibtissem\APPLIC~1\COWON
   [07/11/2008|13:01] C:\DOCUME~1\Ibtissem\APPLIC~1\EPSON
   [04/12/2006|09:52] C:\DOCUME~1\Ibtissem\APPLIC~1\Free Spider TreeCardGames
   [06/11/2008|15:37] C:\DOCUME~1\Ibtissem\APPLIC~1\Google
   [16/05/2009|22:35] C:\DOCUME~1\Ibtissem\APPLIC~1\Graphisoft
   [07/11/2008|14:20] C:\DOCUME~1\Ibtissem\APPLIC~1\Help
   [23/11/2008|19:09] C:\DOCUME~1\Ibtissem\APPLIC~1\HiYo
   [04/11/2008|14:43] C:\DOCUME~1\Ibtissem\APPLIC~1\Identities
   [05/06/2009|12:13] C:\DOCUME~1\Ibtissem\APPLIC~1\Lies Ref Iso
   [24/05/2009|03:22] C:\DOCUME~1\Ibtissem\APPLIC~1\LimeWire
   [27/03/2009|15:16] C:\DOCUME~1\Ibtissem\APPLIC~1\Macromedia
   [26/05/2009|01:01] C:\DOCUME~1\Ibtissem\APPLIC~1\Malwarebytes
   [06/11/2008|15:03] C:\DOCUME~1\Ibtissem\APPLIC~1\Media Player Classic
   [26/05/2009|11:29] C:\DOCUME~1\Ibtissem\APPLIC~1\Microsoft
   [24/05/2009|00:10] C:\DOCUME~1\Ibtissem\APPLIC~1\Real
   [11/01/2009|23:25] C:\DOCUME~1\Ibtissem\APPLIC~1\SecuROM
   [23/05/2009|21:53] C:\DOCUME~1\Ibtissem\APPLIC~1\Skype
   [23/05/2009|21:18] C:\DOCUME~1\Ibtissem\APPLIC~1\skypePM
   [09/11/2008|21:28] C:\DOCUME~1\Ibtissem\APPLIC~1\Sun
   [15/05/2009|23:56] C:\DOCUME~1\Ibtissem\APPLIC~1\uTorrent

   [26/05/2009|11:29] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [07/06/2009|18:40] C:\DOCUME~1\MISSCU~1\APPLIC~1\Adobe
   [07/06/2009|18:26] C:\DOCUME~1\MISSCU~1\APPLIC~1\Identities
   [07/06/2009|18:37] C:\DOCUME~1\MISSCU~1\APPLIC~1\Microsoft

   [26/05/2009|11:29] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [21/05/2009 17:39][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [15/06/2009 16:23][--a------] C:\WINDOWS	asks\Check Updates for Windows Live Toolbar.job
   [04/12/2006 00:00][--ah-c---] C:\WINDOWS	asks\SA.DAT
   [02/10/2001 20:18][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [04/12/2006|02:28] C:\Program Files\Adobe
   [04/11/2008|14:50] C:\Program Files\Ahead
   [04/12/2006|01:08] C:\Program Files\Alwil Software
   [04/11/2008|14:38] C:\Program Files\Analog Devices
   [27/03/2009|14:56] C:\Program Files\AnswerWorks 4.0
   [13/02/2009|19:37] C:\Program Files\Apple Software Update
   [11/02/2009|23:34] C:\Program Files\ATI Technologies
   [27/03/2009|14:58] C:\Program Files\AutoCAD 2006
   [27/03/2009|14:16] C:\Program Files\Autodesk
   [04/04/2009|22:57] C:\Program Files\Broadcom
   [16/04/2009|11:39] C:\Program Files\Canon
   [12/02/2009|00:29] C:\Program Files\CCleaner
   [19/02/2009|13:46] C:\Program Files\Dell
   [16/12/2008|12:20] C:\Program Files\directx
   [27/03/2009|16:10] C:\Program Files\EPSON
   [12/06/2009|23:47] C:\Program Files\Fichiers communs
   [12/12/2008|00:04] C:\Program Files\Fighter Ace 3.5 Ftv
   [04/12/2008|19:23] C:\Program Files\GMG
   [02/12/2008|19:08] C:\Program Files\Google
   [16/05/2009|22:13] C:\Program Files\Graphisoft
   [23/11/2008|19:08] C:\Program Files\HiYo
   [17/04/2009|18:59] C:\Program Files\hp LaserJet 1000
   [04/12/2006|09:00] C:\Program Files\InstallShield Installation Information
   [21/11/2008|14:29] C:\Program Files\Internet Explorer
   [10/01/2009|00:17] C:\Program Files\IVT Corporation
   [19/02/2009|13:51] C:\Program Files\Java
   [02/04/2009|20:08] C:\Program Files\JetAudio
   [22/05/2009|01:26] C:\Program Files\Lies Ref Iso
   [15/02/2009|14:57] C:\Program Files\Logitech
   [28/11/2008|20:43] C:\Program Files\Messenger
   [21/05/2009|19:18] C:\Program Files\Messenger Plus! Live
   [13/12/2008|21:13] C:\Program Files\MessengerDiscovery
   [27/03/2009|15:06] C:\Program Files\Microsoft Encarta
   [04/11/2008|14:12] C:\Program Files\microsoft frontpage
   [27/03/2009|14:56] C:\Program Files\Microsoft Office
   [04/12/2006|09:00] C:\Program Files\Microsoft Reader
   [20/02/2009|11:57] C:\Program Files\Microsoft R‚f‚rence
   [04/11/2008|15:08] C:\Program Files\Microsoft Visual Studio
   [04/11/2008|15:09] C:\Program Files\Microsoft Works
   [05/12/2008|00:24] C:\Program Files\Movie Maker
   [04/11/2008|15:08] C:\Program Files\MSBuild
   [04/11/2008|14:07] C:\Program Files\MSN
   [04/11/2008|14:08] C:\Program Files\MSN Gaming Zone
   [04/12/2006|06:03] C:\Program Files\MSN Messenger
   [04/12/2006|00:13] C:\Program Files\Namtuk
   [04/11/2008|14:09] C:\Program Files\NetMeeting
   [04/11/2008|14:56] C:\Program Files\Outlook Express
   [13/02/2009|19:38] C:\Program Files\QuickTime
   [06/11/2008|15:02] C:\Program Files\Ringz Studio
   [04/11/2008|14:10] C:\Program Files\Services en ligne
   [19/02/2009|21:41] C:\Program Files\Spider
   [27/05/2009|14:48] C:\Program Files\SuperCopier2
   [06/06/2009|21:22] C:\Program Files	rend micro
   [04/11/2008|14:16] C:\Program Files\Uninstall Information
   [24/05/2009|01:43] C:\Program Files\UNO Freeware
   [18/02/2009|22:58] C:\Program Files\uTorrent
   [16/05/2009|22:21] C:\Program Files\WIBU-SYSTEMS
   [04/11/2008|23:12] C:\Program Files\Windows Live
   [28/11/2008|20:43] C:\Program Files\Windows Live Toolbar
   [04/04/2009|19:46] C:\Program Files\Windows Media Player
   [31/03/2009|11:13] C:\Program Files\Windows NT
   [04/11/2008|14:10] C:\Program Files\WindowsUpdate
   [02/04/2009|11:49] C:\Program Files\WinRAR
   [04/11/2008|14:12] C:\Program Files\xerox
   [04/12/2009|23:45] C:\Program Files\Xilisoft
   [12/02/2009|00:24] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [04/12/2006|02:28] C:\Program Files\Fichiers communs\Adobe
   [06/11/2008|15:14] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [04/11/2008|14:50] C:\Program Files\Fichiers communs\Ahead
   [05/06/2009|22:10] C:\Program Files\Fichiers communs\Autodesk Shared
   [06/11/2008|17:24] C:\Program Files\Fichiers communs\COWON
   [27/03/2009|14:56] C:\Program Files\Fichiers communs\DESIGNER
   [07/11/2008|12:54] C:\Program Files\Fichiers communs\InstallShield
   [19/02/2009|13:51] C:\Program Files\Fichiers communs\Java
   [15/02/2009|13:05] C:\Program Files\Fichiers communs\Logitech
   [04/12/2006|09:00] C:\Program Files\Fichiers communs\Microsoft Shared
   [02/10/2001|20:18] C:\Program Files\Fichiers communs\Mozilla Shared
   [04/11/2008|14:09] C:\Program Files\Fichiers communs\MSSoap
   [01/04/2009|15:34] C:\Program Files\Fichiers communs\Nero
   [04/11/2008|15:02] C:\Program Files\Fichiers communs\ODBC
   [24/05/2009|00:11] C:\Program Files\Fichiers communs\Real
   [04/11/2008|14:09] C:\Program Files\Fichiers communs\Services
   [04/11/2008|15:02] C:\Program Files\Fichiers communs\SpeechEngines
   [04/11/2008|15:06] C:\Program Files\Fichiers communs\System
   [04/11/2008|22:46] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 31 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-06-15 17:19:32
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 276
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:1][D:0]-> C:\DOCUME~1\Ibtissem\Cookies
   [F:6][D:9]-> C:\DOCUME~1\Ibtissem\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 15/06/2009|16:53 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 15/06/2009|17:20 - Option : [2]

   --------------------\  Fin du rapport a 17:20:18

Lyonnais92 · Answer

Re,

comment va l'ordi ?

===

Refais tourner RSIT (télécharge Hijackthis si il veut bien).

Poste le rapport.

morenas31 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Ibtissem at 2009-06-15 18:23:20
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 8 GB (27%) free of 30 GB
Total RAM: 990 MB (65% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS	asks\AppleSoftwareUpdate.job
C:\WINDOWS	asks\Check Updates for Windows Live Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\Ibtissem\Mes documentspbrowserrecordplugin.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-05 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-20 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-20 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-07-07 493856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-05-20 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-05 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-05 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-07-07 493856]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL []
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-20 259696]
{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - BearShare MediaBar - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll []
{0BF43445-2F28-4351-9252-17FE6E806AA0}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"windows drivers"=C:\WINDOWS\system32\win drivers [2009-06-15 3564891]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-11-05 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdslTaskBar]
stmctrl.dll,TaskBar []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Amok Eggs Four Web]
C:\Documents and Settings\All Users\Application Data\part dead amok eggs	itle real.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe /min []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
C:\Program Files\BearShare\BearShare.exe /pause []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus D78 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE [2006-02-23 131072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Ibtissem\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-22 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HiYo]
C:\Program Files\HiYo\bin\HiYo.exe [2009-01-11 300336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hp 1000 firmware]
C:\Program Files\hp LaserJet 1000\fwdl.exe [2001-04-18 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-03 208952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\memo site kind that]
C:\Documents and Settings\All Users\Application Data\Grid Blue Memo Site\about bird.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsmqIntCert]
regsvr32 /s mqrt.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-03 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Plugin]
rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2007-06-29 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock]
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-05-01 843776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2005-03-24 94770]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-05 136600]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperCopier2.exe]
C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\SweetIM\Messenger\SweetIM.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-11-05 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thsys]
D:\WINDOWS\system32\winrun.sys.pif []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToniArts EasyCleaner]
C:\Documents and Settings\Adel\Mes documents\moh\ToniArts\EasyCleaner\EasyClea.exe [2003-12-02 1994240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIUCU]
C:\DOCUME~1\Adel\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vga Copy]
C:\DOCUME~1\Ibtissem\APPLIC~1\LIESRE~1\Plan Program.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo Messengger]
C:\WINDOWS\system32\winfiles.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\ROCKET~1\ROCKET~1.EXE [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\TransBar\TransBar.exe [2005-06-01 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\UberIcon\UBERIC~1.EXE [2006-05-21 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Adel^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Accélérateur de démarrage AutoCAD.lnk]
C:\PROGRA~1\FICHIE~1\AUTODE~1\ACSTAR~1.EXE [2005-03-05 10872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE  []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\ROCKET~1\ROCKET~1.EXE [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\TransBar\TransBar.exe [2005-06-01 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\UberIcon\UBERIC~1.EXE [2006-05-21 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\ROCKET~1\ROCKET~1.EXE [2007-03-19 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\TransBar\TransBar.exe [2005-06-01 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\UberIcon\UBERIC~1.EXE [2006-05-21 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ibtissem^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
C:\WINDOWS\BRICOP~1\VISTAI~1\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-12-17 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-04 240128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDriveAutoRun"=FFFFFFFF
"NoDrives"=0
"NoFind"=0
"NoFolderOptions"=0
"NoRun"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"D:\LimeWire\LimeWire.exe"="D:\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\asmaa\uTorrent.exe"="D:\asmaa\uTorrent.exe:*:Enabled:µTorrent"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======File associations======

.scr - open - "C:\WINDOWS\system32
otepad.exe" "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 2 months======

2009-12-04 23:45:52 ----D---- C:\Program Files\Xilisoft
2009-06-15 18:23:20 ----D---- C:sit
2009-06-15 16:52:15 ----A---- C:\lopR.txt
2009-06-15 16:51:49 ----D---- C:\Lop SD
2009-06-15 14:59:56 ----RASHD---- C:\autorun.inf
2009-06-15 14:54:49 ----D---- C:\UsbFix
2009-06-15 14:50:05 ----A---- C:\TCleaner.txt
2009-06-12 23:58:28 ----SHD---- C:\RECYCLER
2009-06-12 22:46:31 ----A---- C:\Nouveau Document texte.txt
2009-06-12 22:46:07 ----A---- C:\RHosts.exe
2009-06-12 22:46:02 ----A---- C:\ZHPDiag.exe
2009-06-09 16:57:43 ----ASH---- C:\BOOT.BAK
2009-06-09 16:57:25 ----RSHD---- C:\cmdcons
2009-06-09 16:57:25 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-06-09 16:57:22 ----D---- C:\WINDOWS\setup.pss
2009-06-08 15:53:49 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-06-06 23:36:11 ----D---- C:\WINDOWS\ERDNT
2009-06-06 21:22:43 ----D---- C:\Program Files	rend micro
2009-05-28 18:58:05 ----D---- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2009-05-28 18:44:54 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-05-26 01:01:27 ----D---- C:\Documents and Settings\Ibtissem\Application Data\Malwarebytes
2009-05-26 01:00:09 ----A---- C:\mbam-setup.exe
2009-05-24 01:43:31 ----D---- C:\Program Files\UNO Freeware
2009-05-24 01:43:17 ----A---- C:\WINDOWS\GPInstall.exe
2009-05-23 12:56:15 ----D---- C:\My Downloads
2009-05-23 02:27:51 ----D---- C:\Documents and Settings\Ibtissem\Application Data\Real
2009-05-23 00:08:37 ----D---- C:\Documents and Settings\Ibtissem\Application Data\BearShare
2009-05-22 01:26:54 ----D---- C:\Program Files\Lies Ref Iso
2009-05-21 18:51:27 ----D---- C:\Program Files\Messenger Plus! Live
2009-05-21 13:22:55 ----D---- C:\Documents and Settings\Ibtissem\Application Data\skypePM
2009-05-21 13:19:23 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-05-20 12:46:32 ----A---- C:\WINDOWS\IDMan.INI
2009-05-19 23:02:55 ----D---- C:\save2pc
2009-05-16 22:35:28 ----D---- C:\Documents and Settings\Ibtissem\Application Data\Graphisoft
2009-05-16 22:21:34 ----D---- C:\Program Files\WIBU-SYSTEMS
2009-05-16 22:13:58 ----D---- C:\Program Files\Graphisoft
2009-05-15 23:56:28 ----D---- C:\Documents and Settings\Ibtissem\Application Data\uTorrent
2009-04-17 19:00:00 ----C---- C:\WINDOWS\system32\isutil.dll
2009-04-17 18:59:57 ----A---- C:\WINDOWS\system32\zstatus.exe
2009-04-17 18:59:57 ----A---- C:\WINDOWS\system32\ZSHP1000.dll
2009-04-17 18:59:57 ----A---- C:\WINDOWS\apptune.ini
2009-04-17 18:59:57 ----A---- C:\WINDOWS\apptune.exe
2009-04-17 18:59:56 ----A---- C:\WINDOWS\system32\hpflash1.exe
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZUNINST.EXE
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZTAG32.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZSPOOL.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZPP.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\zPJL.dll
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\zlmhp1.dll
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\zlm.dll
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZLANG.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\ZGDI32.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\VSETUP.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\SDhp1000.DLL
2009-04-17 18:59:55 ----A---- C:\WINDOWS\system32\IMF32.DLL
2009-04-17 18:59:54 ----A---- C:\WINDOWS\system32\zpppcl.dll
2009-04-17 18:59:54 ----A---- C:\WINDOWS\system32\PCLDLL6L.DLL
2009-04-17 18:59:53 ----D---- C:\Program Files\hp LaserJet 1000
2009-04-17 15:51:41 ----D---- C:\Config.Msi
2009-04-16 11:39:22 ----D---- C:\Program Files\Canon

======List of files/folders modified in the last 2 months======

2009-06-15 17:44:37 ----D---- C:\WINDOWS\Prefetch
2009-06-15 17:22:37 ----D---- C:\WINDOWS\Temp
2009-06-15 17:20:48 ----D---- C:\WINDOWS\system32
2009-06-15 17:20:48 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-15 17:18:38 ----D---- C:\Program Files
2009-06-15 17:06:24 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-15 16:50:39 ----AC---- C:\WINDOWS\NeroDigital.ini
2009-06-15 15:00:01 ----D---- C:\WINDOWS
2009-06-15 14:47:16 ----SHD---- C:\System Volume Information
2009-06-15 14:47:16 ----D---- C:\WINDOWS\system32\Restore
2009-06-15 14:44:43 ----A---- C:\WINDOWS\system32\win drivers.exe
2009-06-14 03:10:59 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-06-14 03:10:40 ----SHD---- C:\WINDOWS\Installer
2009-06-12 23:53:30 ----D---- C:\WINDOWS\system32\drivers
2009-06-12 23:52:07 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-12 23:51:12 ----A---- C:\WINDOWS\system.ini
2009-06-12 23:48:13 ----D---- C:\WINDOWS\system32\config
2009-06-12 23:47:07 ----D---- C:\WINDOWS\AppPatch
2009-06-12 23:47:06 ----D---- C:\Program Files\Fichiers communs
2009-06-09 16:57:44 ----RASH---- C:\boot.ini
2009-06-09 03:26:12 ----A---- C:\jacombo.exe
2009-06-08 14:02:42 ----AC---- C:\WINDOWS\WININIT.INI
2009-06-07 18:26:06 ----D---- C:\Documents and Settings
2009-06-05 22:10:42 ----D---- C:\Program Files\Fichiers communs\Autodesk Shared
2009-06-05 22:08:26 ----D---- C:\WINDOWS\system32\DirectX
2009-06-05 22:08:25 ----RSD---- C:\WINDOWS\assembly
2009-06-05 12:13:35 ----D---- C:\Documents and Settings\Ibtissem\Application Data\Lies Ref Iso
2009-05-31 13:11:33 ----A---- C:\WINDOWS\win.ini
2009-05-31 13:11:32 ----D---- C:\WINDOWS\pss
2009-05-28 18:51:52 ----D---- C:\WINDOWS\system32\CatRoot
2009-05-27 14:48:35 ----D---- C:\Program Files\SuperCopier2
2009-05-26 11:29:49 ----SD---- C:\Documents and Settings\Ibtissem\Application Data\Microsoft
2009-05-24 03:22:43 ----D---- C:\Documents and Settings\Ibtissem\Application Data\LimeWire
2009-05-24 00:11:18 ----D---- C:\Program Files\Fichiers communs\Real
2009-05-23 21:53:52 ----D---- C:\Documents and Settings\Ibtissem\Application Data\Skype
2009-05-23 02:31:58 ----A---- C:\WINDOWS\system32\msvcr71.dll
2009-05-20 20:09:39 ----A---- C:\WINDOWS\ModemLog_Bluetooth Fax Modem.txt
2009-05-20 20:09:39 ----A---- C:\WINDOWS\ModemLog_Bluetooth DUN Modem.txt
2009-05-20 12:50:33 ----D---- C:\WINDOWS\Debug
2009-05-13 19:27:16 ----RSD---- C:\WINDOWS\Fonts
2009-05-10 16:26:11 ----D---- C:\WINDOWS\system32\NtmsData
2009-04-26 23:20:58 ----A---- C:\WINDOWS\system32\Read Me.txt
2009-04-26 23:20:48 ----D---- C:\WINDOWS\system32\Death Note
2009-04-17 15:52:21 ----D---- C:\WINDOWS\system32\wbem
2009-04-17 15:52:20 ----D---- C:\WINDOWS\Registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-03-22 278728]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-03-22 25416]
R2 NwlnkIpx;Protocole de transport compatible NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS
wlnkipx.sys [2004-08-04 88448]
R2 NwlnkNb;NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS
wlnknb.sys [2001-10-02 63232]
R2 NwlnkSpx;Protocole NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS
wlnkspx.sys [2001-10-02 55936]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [1997-05-30 64512]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2006-05-22 230400]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-05-17 44544]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-08-12 137728]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-02 9600]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-02 12288]
R3 MQAC;Message Queuing access control; \??\C:\WINDOWS\system32\drivers\mqac.sys []
R3 RMCAST;Reliable Multicast Protocol driver; \??\C:\WINDOWS\system32\drivers\RMCast.sys []
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-02 5888]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2005-05-31 20480]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2005-04-30 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-05-31 23000]
S3 BthEnum;Pilote de bloc de demande Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-04 17024]
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-04-30 11860]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992]
S3 BTHPORT;Pilote de port Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-04 274944]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-04 18944]
S3 BTNetFilter;Bluetooth Network Filter; \??\C:\WINDOWS\system32\drivers\BTNetFilter.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-01-31 22016]
S3 Msfotlk;Msfotlk; C:\WINDOWS\system32\driversdbss.sys [2004-08-04 176512]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2005-01-31 211712]
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\WINDOWS\system32\DRIVERSfcomm.sys [2004-08-04 59648]
S3 sermouse;Pilote pour souris sur port série; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-08-23 18432]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2005-03-25 82148]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-04 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-12-17 434176]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-05 152984]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NwSapAgent;Agent SAP; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-12-20 520192]
S2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe []
S2 MSMQ;Message Queuing; C:\WINDOWS\system32\mqsvc.exe [2004-08-04 4608]
S2 MSMQTriggers;Message Queuing Triggers; C:\WINDOWS\system32\mqtgsvc.exe [2004-08-04 117248]
S2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe []
S2 SNMP;Service SNMP; C:\WINDOWS\System32\snmp.exe []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-11-06 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2009-01-30 77944]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-20 182768]
S3 LPDSVC;Serveur d'impression TCP/IP; C:\WINDOWS\system32	cpsvcs.exe [2001-10-02 19456]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SNMPTRAP;Service d'interruption SNMP; C:\WINDOWS\System32\snmptrap.exe []
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

-----------------EOF-----------------

morenas31 · Answer

il marche mieux qu'avant le dossier winefiles.exe n'apparait plus, vraiment merci
juste une question es-que le dois faire les même procédures pour mes autres PC.
encore merci

Virus non détecté

30 réponses

Discussions similaires

Newsletters