Rapport hijackthis

Encore merci, je crois que je vais avoir pas mal de lecture mais au moins je serais un peu plus au courant.
A+
Gaëlle

@Gaelle;-)

Voilà, tout est fait. Un grand merci pour ton aide.
J'ai essayé d'imprimer avec excel, word et en pdf, tout fonctionne, je pense que tout marche.
Par rapport à tout ce qu'on a fait, est-ce que je remodifie l'affichage des dossiers (avoir accès aux fichiers cachés), et est-ce que je remets tea timer de spybot en route ?
Pour la sécurité de mon ordi est-ce que tu aurais des conseils sur les antivirus et anti spyware ?
encore merci beaucoup
Gaëlle

Le rapport Toolscleaner2 :
[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Gaelle\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Gaelle\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Gaelle\Recent\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Gaelle\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Gaelle\Bureau\HJTInstall.exe: supprimé !
C:\Documents and Settings\Gaelle\Recent\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Salut, petit problème de réseau ce matin donc je n'ai pas pu répondre plus tôt.
J'ai télécharger Java et Adobe avec les versions que tu m'as indiqués.
Voici le rapport du scan HijackThis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:25:33, on 25/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

J'utilise Javara, par contre c'est assez long donc je te renvoie le rapport HijackThis demain matin.
Je fais toutes les mises à jour.

Par contre sur le rapport ActiveScan, qu'est que je fais du fichier
C:\Documents and Settings\INRA\Cookies\inra@maxserving[2].txt

A demain
Gaëlle

Voilà enfin le rapport de Panda :

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-08-24 15:45:00
PROTECTIONS: 1
MALWARE: 1
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Symantec AntiVirus Corporate Edition 10.1.6.6000 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00149064 Cookie/Maxserving TrackingCookie No 0 Yes No C:\Documents and Settings\INRA\Cookies\inra@maxserving[2].txt
;===================================================================================================================================================================================
SUSPECTS
Sent Location a
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description a
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Le rapport TCcleaner

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Combofix: trouvé !
C:\HijackThis: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\_OTM: trouvé !
C:\Toolbar SD: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Gaelle\Bureau\OTM.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Gaelle\Bureau\OAD.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\Gaelle\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Genproc\Genproc.exe: trouvé !
C:\Genproc\outil\hijackthis.log: trouvé !
C:\Genproc\outil\mbr.exe: trouvé !
C:\Genproc\Page\GenProc[*].html: trouvé !
C:\Hijackthis\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\Gaelle\Bureau\OTM.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Gaelle\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Gaelle\Bureau\OAD.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\Gaelle\Bureau\Rsit.exe: supprimé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Genproc\Genproc.exe: supprimé !
C:\Genproc\outil\hijackthis.log: supprimé !
C:\Genproc\outil\mbr.exe: supprimé !
C:\Genproc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Hijackthis\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Combofix: supprimé !
C:\HijackThis: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\_OTM: supprimé !
C:\Toolbar SD: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\Gaelle\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\ZHPDiag: supprimé !

Le rapport OTM

All processes killed
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8829557EB322C354F96043E0B32EE193\\ProductName deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties\\DisplayName deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}\\DisplayName deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Gaelle
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\Gaelle\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 49286 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 51125372 bytes

User: INRA
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 220085 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 33645926 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 81,21 mb

OTM by OldTimer - Version 3.0.0.6 log created on 08242009_120930

Files moved on Reboot...

Registry entries deleted on Reboot...

Voilà le rapport-OAD

24/08/2009 ---- 11:47:59,37

----------------------------------
§§§§§§ [MyWay Search Assistant] §§§§§§
----------------------------------
[X] Registre
[ ] Fichier (rapide)
[ ] Fichier (disque systeme)
[X] Fichier (complete)

********************
[Registre]
********************

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8829557EB322C354F96043E0B32EE193]
"ProductName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties]
"DisplayName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}]
"DisplayName"="MyWay Search Assistant"

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

La suite le rapport GenProc

Rapport GenProc 2.615 [1] - 24/08/2009 à 10:38:39
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.0.13) [Navigateur par défaut]

~~ "C:\WINDOWS\sed.exe" a été renommé sed.exe_RenameGenProc ~~
~~ "C:\WINDOWS\grep.exe" a été renommé grep.exe_RenameGenProc ~~

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt

~~~~ INFORMATION COMPLEMENTAIRE ~~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:41, on 24/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Genproc\outil\Gaelle_GenProc.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Je vais laisser mon ordi allumer tout le week-end mais déconnecté.
et je ferais tes manips lundi. Mes enfants ne peuvent pas m'attendre, désolée.
Je te remercie pour ton aide et j'espère te retrouver lundi
Merci
Gaëlle

@GaelleDéconnecté oui ... Mais allumé ! ...

j'espère qu'il y un veille ... ^^

donc pour Lundi fait cette manipe > https://forums.commentcamarche.net/forum/affich-13989022-rapport-hijackthis#37

bon week ...

@sKe69Salut,
J'espère que ton week-end a été bon, voilà je t'envoie déjà le rapport combo et je fais la manip avec RSIT.
a tout à l'heure

ComboFix 09-08-20.07 - Gaelle 24/08/2009 9:13.4.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.107 [GMT 2:00]
Running from: c:\documents and settings\Gaelle\Bureau\ske.exe
Command switches used :: c:\documents and settings\Gaelle\Bureau\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-07-24 to 2009-08-24 )))))))))))))))))))))))))))))))
.

2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-21 10:10 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-21 09:09 . 2009-08-21 13:19 -------- d-----w- C:\UsbFix
2009-08-21 08:55 . 2009-08-21 13:17 -------- d-----w- c:\program files\ZHPDiag
2009-08-21 08:41 . 2009-08-21 15:24 -------- d-----w- c:\program files\CCleaner
2009-08-21 07:48 . 2009-08-21 07:50 -------- d-----w- C:\ToolBar SD
2009-08-21 07:12 . 2009-08-21 13:46 -------- d-----w- C:\Hijackthis
2009-08-20 09:23 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\uic40E.exe
2009-08-20 06:41 . 2009-08-20 06:41 -------- d-sh--w- c:\documents and settings\Gaelle\PrivacIE
2009-08-13 07:09 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 07:49 . 2009-08-10 07:49 152576 ----a-w- c:\documents and settings\Gaelle\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-30 08:15 . 2009-07-03 16:57 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-30 08:15 . 2009-07-03 16:57 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-24 07:11 . 2009-04-03 07:14 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-21 11:46 . 2009-05-05 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 09:35 . 2004-08-19 13:03 64484 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-21 09:35 . 2004-08-19 13:03 446566 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-20 13:39 . 2006-02-03 10:59 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-20 09:25 . 2009-05-12 09:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-10 11:56 . 2006-02-03 10:21 -------- d-----w- c:\program files\PowerArchiver
2009-08-10 10:23 . 2009-05-05 09:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 07:55 . 2006-01-31 11:10 -------- d-----w- c:\program files\Java
2009-08-05 09:00 . 2004-08-19 13:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2009-02-18 13:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Simply Super Software
2009-07-17 19:03 . 2004-08-19 13:03 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 06:27 . 2009-05-05 11:39 -------- d-----w- c:\program files\Spyware Terminator
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Firebird
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Eppendorf
2009-07-12 10:21 . 2004-08-19 13:04 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 13:03 915456 ------w- c:\windows\system32\wininet.dll
2009-06-22 15:05 . 2009-07-23 12:52 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\eah3B.exe
2009-06-22 15:05 . 2009-07-23 12:51 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\jpe3A.exe
2009-06-16 14:40 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-08-19 13:03 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-08-19 13:03 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-19 13:03 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 13:03 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2004-08-19 13:14 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-19 13:03 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2004-08-19 13:03 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-03-26 13:26 . 2008-03-26 13:24 3116521 ----a-w- c:\program files\dialang.exe
2007-05-25 07:31 . 2007-05-25 07:31 4787 ----a-w- c:\program files\legitcheck.hta
.

((((((((((((((((((((((((((((( SnapShot@2009-08-21_13.06.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-19 13:03 . 2008-04-13 19:15 574976 c:\windows\system32\drivers\ntfs.sys
+ 2004-08-19 13:03 . 2008-04-13 19:15 574976 c:\windows\system32\dllcache\ntfs.sys
+ 2009-06-18 08:00 . 2009-08-23 08:00 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-06-18 08:00 . 2009-08-21 08:00 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-05-04 126000]
"_BackupService"="c:\program files\Astase\UltraBackup\4.9\bin\tbs.exe" [2008-02-08 1671168]
"thnotify"="c:\program files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" [2008-02-08 1491456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 34880]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53:UDP"= 53:UDP:Promo

R2 thpassivesvc;Astase ThalliumBackup Client Background Service;c:\program files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe [06/04/2009 08:54 646144]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [21/08/2009 10:02 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [04/05/2007 16:06 119856]
S4 ThalliumServer;Astase ThalliumBackup Storage Service;c:\program files\Astase\UltraBackup\4.9\bin\tbsd.exe [06/04/2009 08:54 1952256]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SPBBCDRV
*NewlyCreated* - SPBBCSVC

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]

2009-08-24 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-05-05 13:31]
.
.
------- Supplementary Scan -------
.
mWindow Title =
TCP: {63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD} = 147.99.0.16,147.99.0.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Gaelle\Application Data\Mozilla\Firefox\Profiles\p8yfybmu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?source=gama&hl=fr
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
FF - prefs.js: network.proxy.type - 2

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-24 09:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseGuardian]
"ImagePath"="c:\program files\Firebird\bin\ibguard -s"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseServer]
"ImagePath"="c:\program files\Firebird\bin\ibserver -s"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\windows\system32\igfxdev.dll

- - - - - - - > 'explorer.exe'(2384)
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-08-24 9:21
ComboFix-quarantined-files.txt 2009-08-24 07:21
ComboFix2.txt 2009-08-21 13:42
ComboFix3.txt 2009-08-21 13:08
ComboFix4.txt 2009-08-21 12:03

Pre-Run: 63 668 502 528 octets libres
Post-Run: 63 624 818 688 octets libres

159 --- E O F --- 2009-08-21 12:11

@sKe69Voilà le log.txt de RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gaelle at 2009-08-24 09:32:18
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 61 GB (80%) free of 76 GB
Total RAM: 502 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:32:42, on 24/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Gaelle\Bureau\RSIT.exe
C:\Documents and Settings\Gaelle\Bureau\Gaelle.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

@sKe69Et le dernier le rapport info.txt de RSIT

info.txt logfile of random's system information tool 1.06 2009-08-24 09:32:44

======Uninstall list======

-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
AFPL Ghostscript 8.51-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\gs8.51\uninstal.txt"
AFPL Ghostscript Fonts-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\fonts\uninstal.txt"
Astase UltraBackup 2007-->"C:\Program Files\Astase\UltraBackup\4.9\unins000.exe"
Broadcom Advanced Control Suite-->MsiExec.exe /I{058B32E2-6310-4359-B2D4-1988390C3B83}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Complément Microsoft Enregistrer en tant que PDF pour programmes Microsoft Office 2007-->MsiExec.exe /X{90120000-00B0-040C-0000-0000000FF1CE}
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
CutePDF Writer 2.3-->C:\WINDOWS\system32\uninscpw.exe C:\Program Files\
Désinstalleur HP LaserJet 2200-->C:\Program Files\Hewlett-Packard\LaserJet All-in-one\Uninstall\2200\setup.exe uninst22.ini
EndNote-->C:\PROGRA~1\EndNote\UNWISE.EXE C:\PROGRA~1\EndNote\INSTALL.LOG
Firebird 1.0.0.796-->"C:\Program Files\Firebird\unins000.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\Gaelle\Bureau\HijackThis.exe" /uninstall
Intel(R) Graphics Media Accelerator Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2776 PCI\VEN_8086&DEV_2772
Internet Explorer Default Page-->MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395}
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Japanese Fonts Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5760-0000-800000000003}
Java 2 Runtime Environment, SE v1.4.2_03-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
LiveUpdate 3.1 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MATLAB 6.5-->C:\MATLAB6p5\uninstall\uninstall.exe C:\MATLAB6p5
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office 97 Professional-->C:\Program Files\Microsoft Office\Office\Install\Acme.exe /w Off97Pro.STF
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB971180)-->"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.22)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MyWay Search Assistant-->MsiExec.exe /X{E7559288-223B-453C-9F06-340E3BE21E39}
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
PowerArchiver 2006 v9.50 French-->"C:\Program Files\PowerArchiver\unins000.exe"
PowerArchiver 2006 v9.62 French-->"C:\Program Files\PowerArchiver\unins001.exe"
PowerArchiver 2006 v9.63 French-->"C:\Program Files\PowerArchiver\unins002.exe"
PowerArchiver 2006 v9.64 French-->"C:\Program Files\PowerArchiver\unins003.exe"
PowerArchiver 2007 French-->MsiExec.exe /I{8E397FED-07AB-439C-80C5-1DA3A1E4C827}
PowerDVD 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
R for Windows 2.9.0-->"C:\Program Files\R\R-2.9.0\unins000.exe"
realplex-->C:\PROGRA~1\EPPEND~1\UNWISE.EXE C:\PROGRA~1\EPPEND~1\INSTALL.LOG
RIS Web Helper-->C:\PROGRA~1\FICHIE~1\Risxtd\_UNINST.EXE C:\PROGRA~1\FICHIE~1\Risxtd\Install.log
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Symantec AntiVirus-->MsiExec.exe /I{50E125D1-88E5-48CE-80AE-98EC9698E639}
UsbFix-->C:\UsbFix\Uninstal.exe
Windows Defender-->MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
ZHPDiag 1.24-->"C:\Program Files\ZHPDiag\unins000.exe"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: Symantec AntiVirus Corporate Edition (disabled)

======System event log======

Computer Name: MONBLANC
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 6341
Source Name: Service Control Manager
Time Written: 20090618090531.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MONBLANC
Event Code: 7035
Message: Un contrôle Arrêter a correctement été envoyé au service Fax.

Record Number: 6340
Source Name: Service Control Manager
Time Written: 20090618090530.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MONBLANC
Event Code: 9
Message: Broadcom NetXtreme 57xx Gigabit Controller: Network controller configured for 100Mb full-duplex link.

Record Number: 6339
Source Name: b57w2k
Time Written: 20090618090518.000000+120
Event Type: Informations
User:

Computer Name: MONBLANC
Event Code: 15
Message: Broadcom NetXtreme 57xx Gigabit Controller: Driver initialized successfully.

Record Number: 6338
Source Name: b57w2k
Time Written: 20090618090518.000000+120
Event Type: Informations
User:

Computer Name: MONBLANC
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 6337
Source Name: EventLog
Time Written: 20090618090507.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: MONBLANC
Event Code: 2
Message:

Analyse Terminée : Risques : 0 Eléments analysés : 375305 Fichiers/Dossiers/Lecteurs omis : 61

Record Number: 1952
Source Name: Symantec AntiVirus
Time Written: 20090710134417.000000+120
Event Type: Informations
User: MONBLANC\INRA

Computer Name: MONBLANC
Event Code: 6
Message:

Impossible d'analyser 1 fichiers dans C:\Program Files\R\R-2.9.0\library\vegan\CONTENTS à cause d'erreurs d'extraction détectées par les moteurs de décomposition.

Record Number: 1951
Source Name: Symantec AntiVirus
Time Written: 20090710133109.000000+120
Event Type: Avertissement
User:

Computer Name: MONBLANC
Event Code: 6
Message:

Impossible d'analyser 1 fichiers dans C:\Program Files\R\R-2.9.0\library\utils\CONTENTS à cause d'erreurs d'extraction détectées par les moteurs de décomposition.

Record Number: 1950
Source Name: Symantec AntiVirus
Time Written: 20090710133107.000000+120
Event Type: Avertissement
User:

Computer Name: MONBLANC
Event Code: 6
Message:

Impossible d'analyser 1 fichiers dans C:\Program Files\R\R-2.9.0\library\tools\CONTENTS à cause d'erreurs d'extraction détectées par les moteurs de décomposition.

Record Number: 1949
Source Name: Symantec AntiVirus
Time Written: 20090710133106.000000+120
Event Type: Avertissement
User:

Computer Name: MONBLANC
Event Code: 6
Message:

Impossible d'analyser 1 fichiers dans C:\Program Files\R\R-2.9.0\library\tcltk2\CONTENTS à cause d'erreurs d'extraction détectées par les moteurs de décomposition.

Record Number: 1948
Source Name: Symantec AntiVirus
Time Written: 20090710133103.000000+120
Event Type: Avertissement
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;c:\matlab6p5\bin\win32;C:\PROGRA~1\EPPEND~1\realplex
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 3, GenuineIntel
"PROCESSOR_REVISION"=0403
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Suppression OK

Il faut vraiment que je parte, est-ce que lundi on peux continuer ?
Encore merci
Gaëlle

@Gaellere,

hophophop !!!

fait au moins l'étape 1 que je t'ai donné ici > http://www.commentcamarche.net/forum/affich-13997635-rapport-hijackthis#ecrire

cela permettra au PC de ne pas ce réinfecter ! ....

Fichier c:\windows\system32\drivers\beep.sys
Résultat: 1/40 (2.5%)

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 Win32.Banker
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
F-Secure 8.0.14470.0 2009.08.21 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 4224 bytes
MD5...: da1f27d85e0d1525f6621372e7b685e9
SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260
SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d
ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/
DKrmLGWBqhev7X+MEWKLu+Ww8
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x66c
timedatestamp.....: 0x3b7d82e5 (Fri Aug 17 20:47:33 2001)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d
.rdata 0x780 0xad 0x100 2.62 0ace5f365131534c66de4137833221ad
INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99
.rsrc 0xb80 0x3c8 0x400 3.22 9b654fc1759147ff04b147754f347be4
.reloc 0xf80 0x9a 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57

( 2 imports )
> ntoskrnl.exe: MmLockPagableDataSection, KeCancelTimer, MmUnlockPagableImageSection, IoStartNextPacket, KeSetTimer, _allmul, IoStartPacket, KeInitializeEvent, KeInitializeTimer, KeInitializeDpc, IoCreateDevice, RtlInitUnicodeString, IoAcquireCancelSpinLock, KeRemoveDeviceQueue, KeRemoveEntryDeviceQueue, IoReleaseCancelSpinLock, IoDeleteDevice, IofCompleteRequest
> HAL.dll: ExReleaseFastMutex, KfRaiseIrql, KfLowerIrql, HalMakeBeep, ExAcquireFastMutex

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set

( Topics Entertainment )

> Instant Home Design: beep.sys

( Symantec )

> Norton SystemWorks 2005: BEEP.SYS

( Compaq )

> Compaq Operating System CD: beep.sys

( NewTech Infosystems Inc. )

> CD-Maker Plus Edition: beep.sys

( The Learning Company Inc. )

> Reader Rabbits Toddler: beep.sys

( Dell )

> Reinstallation CD Microsoft Windows XP Professional: beep.sys

( Microsoft )

> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sys
> MSDN Disc 2466.2: beep.sys
> MSDN Disc 2466.1: beep.sys
> MSDN Disc 2466.4: beep.sys
> MSDN Disc 2465: beep.sys
> MSDN Disc 2464: beep.sys
> MSDN Disc 2466: beep.sys
> Windows XP: beep.sys
> Microsoft TechNet Trial Software 2002 Volume 1: beep.sys
> MSDN Disc2389: beep.sys
> MSDN disc 2455.2: beep.sys
> Windows 98 Versions: beep.sys
> MSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sys
> MSDN Disc 2438.7: beep.sys
> MSDN Disc 2438.2: beep.sys
> MSDN Disc 2438.1: beep.sys
> MSDN Disc 3264: beep.sys
> MSDN Disc 2455: beep.sys
> MSDN Disc 2438.8: beep.sys
> MSDN Disc 2428.1: beep.sys
> MSDN Disc 2428.2: beep.sys
> MSDN Disc 2428.5: beep.sys
> MSDN Disc 2428.4: beep.sys
> MSDN Disc 2428.8: beep.sys
> Platforms, SDK/DDK: beep.sys
> Internet Explorer Versions: beep.sys
> Virtual PC for Mac Windows XP Professional Edition: beep.sys
> Platforms: beep.sys
> MSDN DISC 2438.3: beep.sys
> Platforms SDKs/DDKs: beep.sys
> MSDN Disc 2053: beep.sys
> MSDN Disc 2444: beep.sys
> MSDN Disc 2443: beep.sys
> MSDN Disc 2442: beep.sys
> MSDN Disc 2441: beep.sys
> Internet Explorer: beep.sys
> MSDN Disc2428.3: beep.sys
> MSDN Disc 1550: beep.sys
> MSDN Disc 2455.6: beep.sys
> MSDN Disc 2455.1: beep.sys
> MSDN Disc 2476.1: beep.sys
> MSDN Disc 2476.2: beep.sys
> 2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sys
> Disc 2438.5: beep.sys
> 2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys
> MSDN Disc 2041: beep.sys
> MSDN Disc 2439.3: beep.sys
> MSDN Disc 2439.2: beep.sys
> MSDN Disc 2439.1: beep.sys
> MSDN Disc 2439.7: beep.sys
> MSDN Disc 2439.6: beep.sys
> MSDN Disc 2438: beep.sys
> MSDN Disc 2439: beep.sys
> MSDN Disc 2465.4: beep.sys
> MSDN Disc 2465.5: beep.sys
> MSDN Disc 2465.2: beep.sys
> Windows XP Professional: beep.sys
> MSDN Disc 2364: beep.sys
> Office XP Professional with FrontPage: beep.sys
> Microsoft Windows XP Professional: beep.sys
> Windows XP Professional 2002 Service Pack 1: beep.sys
> MSDN Disc 2443.1: beep.sys
> MSDN Disc 2443.2: beep.sys
> MSDN Disc 2443.4: beep.sys
> MSDN disc 2465.3: beep.sys
> MSDN Disc 2441.1: beep.sys
> MSDN Disc 2441.6: beep.sys
> MSDN Disc 2441.7: beep.sys
> MSDN Disc 2441.5: beep.sys
> MSDN Disc 2428: beep.sys
> MSDN Disc 2477.2: beep.sys
> Windows XP Home Edition: beep.sys
> Windows CE .NET Evaluation Software: beep.sys
> MSDN Disc 2307: beep.sys
> Implementing and Supporting Microsoft Windows XP Professional: beep.sys
> MSDN Disc 2464.1: beep.sys
> MSDN Disc 2464.5: beep.sys
> MSDN Disc 2439.8: beep.sys
> MSDN Disc 2440.5: beep.sys
> MSDN Disc 2440.4: beep.sys
> MSDN Disc 2440.3: beep.sys
> MSDN Disc2365: beep.sys
> MDSN Disc 2441.2: beep.sys
> Platforms, SDK/DDK, Developer Tools: beep.sys
> MSDN disc 2390: beep.sys
> MSDN Disc 2476.4: beep.sys
> Microsoft Security Resource Kit: beep.sys
> Windows 2000 Versions: beep.sys
> MSDN Disc 2444.3: beep.sys
> MSDN Disc 2444.1: beep.sys
> MSDN Disc 2444.6: beep.sys
> MSDN Disc 2444.4: beep.sys
> Virtual PC for Mac Windows XP Home Edition: beep.sys
> Windows XP eMbedded Evaluation Software: beep.sys
> MSDN Disc 2476: beep.sys
> MSDN Disc 2442.4: beep.sys
> MSDN Disc 2442.6: beep.sys
> MSDN Disc 2442.1: beep.sys
> Applications, Platforms, Servers: beep.sys
> MSDN Disc 2442.3: beep.sys
> MSDN Disc 2442.2: beep.sys
> Windows XP Tablet PC Edition: beep.sys
> Applications, Platforms: beep.sys

( Sony )

> Sony VAIO Recover CDs: BEEP.SYS

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS,beep.sys

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=da1f27d85e0d1525f6621372e7b685e9' target='_blank'>https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9</a>

Fichier C:\Program Files\Firebird\bin\ibserver.exe

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 -
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
F-Secure 8.0.14470.0 2009.08.21 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 1748992 bytes
MD5...: 92dafd2c2416b8041ea239fb2084d5fe
SHA1..: 4a729c2d6bfab4a02d4332f959788a7abe1f9280
SHA256: 0ddce8bcebc0d0b2f14d4e7d09c3aec3835ea6cb8a7b0c677d3806f5f278ea2f
ssdeep: 49152:TzSE319xQCKT+BzkEL5kPsYWW0VGrLCKRLP8hX6d1D8ZqornlbgFjj:TzS
swczkCkfCKRLP801D8Fl8
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1651a0
timedatestamp.....: 0x3c88d92a (Fri Mar 08 15:30:50 2002)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x16472c 0x165000 6.17 fef765211ae90c8220729b72d1cc938d
.rdata 0x166000 0x1d682 0x1e000 5.13 f40c616f81b36e04951b65b1b791bf0f
.data 0x184000 0x2d0e4 0x24000 5.32 d61b83260302a5bef404933dcd541fc2
.rsrc 0x1b2000 0x2c18 0x3000 3.39 dd59d07d0b5e6c3f0c496c76bc5ba1ca

( 9 imports )
> GDI32.dll: SetBkMode, CreateSolidBrush, GetStockObject
> USER32.dll: TranslateMessage, DestroyWindow, GetMessageA, UpdateWindow, DispatchMessageA, SendMessageA, CreateWindowExA, RegisterClassA, LoadCursorA, LoadIconA, MessageBoxA, LoadStringA, FindWindowA, PostQuitMessage, SetFocus, DefWindowProcA, DeleteMenu, GetSystemMenu, DestroyIcon, LoadImageA, ShowWindow, DestroyMenu, TrackPopupMenu, GetCursorPos, SetMenuDefaultItem, AppendMenuA, CreatePopupMenu, SetForegroundWindow, EndDialog, CharToOemA, CharLowerBuffA, GetDlgItemInt, GetWindowLongA, DialogBoxParamA, SetWindowPos, EnableWindow, SetDlgItemInt, GetDlgItem, wsprintfA, GetParent, SetDlgItemTextA, SendDlgItemMessageA, SetCursor, GetSysColor, WinHelpA, SetWindowLongA, PostMessageA
> MSVCRT.dll: _onexit, _controlfp, __dllonexit, __setusermatherr, _initterm, __getmainargs, _isatty, _getcwd, __p__fmode, _stricmp, _strnicmp, _dup2, _getpid, _mktemp, _unlink, _open, _lseek, _read, _close, _umask, _fileno, _acmdln, _XcptFilter, _exit, strrchr, getchar, __p__commode, __set_app_type, putc, fseek, ftell, _setmaxstdio, _splitpath, strncat, _access, _seh_longjmp_unwind, _except_handler3, toupper, strpbrk, fgetc, system, getc, _open_osfhandle, signal, _beginthreadex, abort, strncmp, sscanf, __mb_cur_max, _isctype, _pctype, atol, fgets, free, vsprintf, _fullpath, strtok, localtime, _adjust_fdiv, _ftol, _errno, _iob, fputs, fputc, fflush, getenv, fopen, ctime, fprintf, vfprintf, fclose, _sys_nerr, _sys_errlist, strchr, malloc, memmove, time, strncpy, atoi, longjmp, _setjmp3, printf, exit, _stat, _write, sprintf
> COMCTL32.dll: CreatePropertySheetPageA, PropertySheetA
> WS2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> ADVAPI32.dll: RegCloseKey, ImpersonateNamedPipeClient, RegQueryValueExA, StartServiceCtrlDispatcherA, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegOpenKeyExA, RegisterServiceCtrlHandlerA, QueryServiceConfigA, OpenServiceA, GetUserNameA, RevertToSelf, OpenSCManagerA, ReportEventA, DeregisterEventSource, CloseServiceHandle, SetServiceStatus, RegisterEventSourceA
> MPR.dll: WNetCloseEnum, WNetGetUniversalNameA, WNetEnumResourceA, WNetOpenEnumA
> SHELL32.dll: Shell_NotifyIconA
> KERNEL32.dll: MoveFileA, GetConsoleCP, GetTapeParameters, CreateMutexA, GetFileSize, GetACP, SetFilePointer, SetEndOfFile, FlushViewOfFile, ResetEvent, SetThreadPriority, OpenEventA, SuspendThread, ResumeThread, TlsAlloc, LeaveCriticalSection, EnterCriticalSection, TlsSetValue, DeleteCriticalSection, TlsFree, InitializeCriticalSection, Sleep, ReleaseMutex, OpenMutexA, SetErrorMode, SetEvent, CreateEventA, CreateThread, GetCurrentThread, DuplicateHandle, WaitForSingleObject, CloseHandle, GetModuleHandleA, GetProcAddress, GetLastError, GetModuleFileNameA, GetVersionExA, GetCurrentProcess, GetPriorityClass, SetPriorityClass, GetCurrentProcessId, lstrcpyA, lstrcatA, CreateProcessA, GetCommandLineA, FormatMessageA, SleepEx, ConnectNamedPipe, CreateNamedPipeA, WaitNamedPipeA, CreateFileA, DisconnectNamedPipe, FlushFileBuffers, ReadFile, WriteFile, TerminateThread, ExitThread, CreateSemaphoreA, OpenProcess, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, WaitForMultipleObjects, ReleaseSemaphore, TlsGetValue, GetUserDefaultLangID, VirtualAlloc, VirtualFree, GetTempPathA, GetComputerNameA, SetProcessWorkingSetSize, DeleteFileA, SetTapePosition, GetDriveTypeA, GetShortPathNameA, GetFileInformationByHandle, FreeLibrary, LoadLibraryA, GetCurrentDirectoryA, GetStartupInfoA, IsBadReadPtr, GetCurrentThreadId

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-

fichier : C:\Program Files\Firebird\bin\ibguard.exe

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 -
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 32768 bytes
MD5...: 9ddfdccce76633b074ffafc856a6148d
SHA1..: f76ce7ad1d9629c87d7008b5282bf517565eb2ff
SHA256: 6bb5a67d1ddba95e3ea8bf754f62c53059d1061cdef73f5426b6331a4a91feba
ssdeep: 384:yHAC6BQoC5ZhP/pMk21oXl1HlqA1nw7QJHLh2qS3GOa:YvYQFdxs1oBqynQQ
Jrh9Vd
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x357a
timedatestamp.....: 0x3c874c9a (Thu Mar 07 11:18:50 2002)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x271e 0x3000 5.09 64b85725f7231ba49415a7fe55d753f5
.rdata 0x4000 0xb74 0x1000 3.99 b2ae61ac2b18e6f9d3fa86d0b87fb8dd
.data 0x5000 0x504 0x1000 1.86 9e13c6addf596571e5e675e9f3e0e7c5
.rsrc 0x6000 0x19c8 0x2000 3.16 9980d091a4f788a9aeb52e8208546b0b

( 9 imports )
> gds32.dll: -, -
> ADVAPI32.dll: QueryServiceStatus, DeregisterEventSource, StartServiceCtrlDispatcherA, CloseServiceHandle, ControlService, StartServiceA, OpenServiceA, OpenSCManagerA, RegCloseKey, ReportEventA, RegisterEventSourceA, RegisterServiceCtrlHandlerA, RegQueryValueExA, RegOpenKeyExA, SetServiceStatus
> USER32.dll: LoadImageA, SetClassLongA, SetDlgItemInt, SetDlgItemTextA, GetDlgItem, WinHelpA, SetWindowLongA, GetWindowLongA, ShowWindow, SetForegroundWindow, CreatePopupMenu, AppendMenuA, SetMenuDefaultItem, FindWindowA, SetFocus, PostQuitMessage, TranslateMessage, GetCursorPos, TrackPopupMenu, DestroyMenu, PostMessageA, DispatchMessageA, DestroyIcon, GetSystemMenu, DeleteMenu, DefWindowProcA, UpdateWindow, GetMessageA, LoadCursorA, LoadStringA, MessageBoxA, LoadIconA, RegisterClassA, CreateWindowExA, DestroyWindow, SendMessageA
> GDI32.dll: GetStockObject
> SHELL32.dll: Shell_NotifyIconA
> COMCTL32.dll: PropertySheetA
> MSVCRT.dll: _XcptFilter, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, _controlfp, time, _exit, malloc, _beginthread, free, exit, sprintf, atoi, strrchr, strncpy, localtime
> VERSION.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
> KERNEL32.dll: CreateEventA, SetEvent, Sleep, GetDateFormatA, FormatMessageA, LocalFree, GetModuleFileNameA, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, GetModuleHandleA, SetErrorMode, CreateMutexA, CreateProcessA, CloseHandle, GetStartupInfoA, WaitForSingleObject, ReleaseMutex, GetExitCodeProcess, lstrcpyA, GetVersionExA, GetLastError, GetTimeFormatA, OpenProcess

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
Fichier : c:\windows\system32\dllcache\msoe.dll

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.21 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.21 -
Antiy-AVL 2.0.3.7 2009.08.21 -
Authentium 5.1.2.4 2009.08.20 -
Avast 4.8.1335.0 2009.08.20 -
AVG 8.5.0.406 2009.08.21 -
BitDefender 7.2 2009.08.21 -
CAT-QuickHeal 10.00 2009.08.21 -
ClamAV 0.94.1 2009.08.21 -
Comodo 2046 2009.08.21 -
DrWeb 5.0.0.12182 2009.08.21 -
eSafe 7.0.17.0 2009.08.20 -
eTrust-Vet 31.6.6693 2009.08.21 -
F-Prot 4.4.4.56 2009.08.20 -
F-Secure 8.0.14470.0 2009.08.21 -
Fortinet 3.120.0.0 2009.08.21 -
GData 19 2009.08.21 -
Ikarus T3.1.1.68.0 2009.08.21 -
Jiangmin 11.0.800 2009.08.21 -
K7AntiVirus 7.10.824 2009.08.21 -
Kaspersky 7.0.0.125 2009.08.21 -
McAfee 5715 2009.08.20 -
McAfee+Artemis 5715 2009.08.20 -
McAfee-GW-Edition 6.8.5 2009.08.21 -
Microsoft 1.4903 2009.08.21 -
NOD32 4355 2009.08.21 -
Norman 6.01.09 2009.08.20 -
nProtect 2009.1.8.0 2009.08.21 -
Panda 10.0.0.14 2009.08.21 -
PCTools 4.4.2.0 2009.08.21 -
Prevx 3.0 2009.08.21 -
Rising 21.43.44.00 2009.08.21 -
Sophos 4.44.0 2009.08.21 -
Sunbelt 3.2.1858.2 2009.08.21 -
Symantec 1.4.4.12 2009.08.21 -
TheHacker 6.3.4.3.384 2009.08.21 -
TrendMicro 8.950.0.1094 2009.08.21 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.21.1895 2009.08.21 -
VirusBuster 4.6.5.0 2009.08.21 -
Information additionnelle
File size: 1315328 bytes
MD5...: 97b6c66fe04c607d5f530f174b090138
SHA1..: cdd1363c2599cf5241a8da1c80daa6691b8eafa2
SHA256: b7ad8e59b964a04b745a151102a66f9a4fdfe62b067de85e48e14ad9bcf2b32e
ssdeep: 24576:F7FcCZs5NxkRCQOQ2ky9G70ywq+TncVX5d4a77K04L3AkN:fcr5NxkwQ2k
hwOX5d4av/4jAq
PEiD..: -
TrID..: File type identification
DirectShow filter (77.7%)
Win32 Executable MS Visual C++ (generic) (14.5%)
Win32 Executable Generic (3.2%)
Win32 Dynamic Link Library (generic) (2.9%)
Generic Win/DOS Executable (0.7%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x173cd
timedatestamp.....: 0x4a5741bf (Fri Jul 10 13:27:27 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1250a5 0x125200 6.52 d9f4843c46e4a0db128c439460608570
.data 0x127000 0xfc58 0xb000 0.96 c06d614727f526fbdfc81c828b649360
.rsrc 0x137000 0x24d0 0x2600 5.71 779e870b1d2636d9184800b94a1e08c3
.reloc 0x13a000 0xe49c 0xe600 6.41 9b1e18f6210517711b7617531a854e98

( 11 imports )
> ATL.DLL: -, -, -, -, -, -, -, -, -, -
> MSOERT2.dll: UlStripWhitespace, UlStripWhitespaceW, StreamSubStringMatch, _MSG, CreateLogFile, DeleteTempFileOnShutdownEx, CleanupFileNameInPlaceA, GenerateUniqueFileName, IDrawText, PszFromANSIStreamA, FIsHTMLFile, CreateStreamOnHFile, IsDigit, StrToUintA, FBuildTempPath, WriteStreamToFile, CrackNotificationPackage, CreateEnumFormatEtc, FIsEmptyW, HrStreamToByte, HrCreateTridentMenu, HrCheckTridentMenu, HrGetBodyElement, fGetBrowserUrlEncoding, UpdateRebarBandColors, CreateInfoWindow, LoadMappedToolbarBitmap, strtrimW, IUnknownList_CreateInstance, StrTokEx, CchFileTimeToDateTimeW, HrGetElementImpl, HrGetStreamSize, IsHttpUrlA, SetWindowLongPtrAthW, PszDupW, FMissingCert, FIsSpaceA, CleanupFileNameInPlaceW, PszDupLenA, MessageBoxInstW, PszToANSI, HrStreamSeekSet, FIsEmptyA, PszToUnicode, GetExePath, MessageBoxInst, CenterDialog, PszSkipWhiteA, HrSetDirtyFlagImpl, HrLPSZCPToBSTR, HrIStreamWToBSTR, CreateStreamOnHFileW, FIsHTMLFileW, HrCopyStream, HrRewindStream, CopyRegistry, WriteStreamToFileHandle, CreateTempFile, BrowseForFolder, CreateNotify, DoHotMailWizard, ReplaceChars, WriteStreamToFileW, CreateDataObject, CchFileTimeToDateTimeSz, PszEscapeMenuStringA, SetIntlFont, HrIsStreamUnicode, GetHtmlCharset, HrSafeGetStreamSize, HrGetCertKeyUsage, PVGetCertificateParam, SzGetCertificateEmailAddress, CryptAllocFunc, CryptFreeFunc, PszDupA, FIsValidFileNameCharW, OpenFileStream, FBuildTempPathW, PszAllocA, HrLPSZToBSTR, ReplaceCharsW
> MSOEACCT.dll: HrCreateAccountManager, ValidEmailAddress
> INETCOMM.dll: HrAthGetFileNameW, MimeOleCreateSecurity, MimeOleAlgStrengthFromSMimeCap, MimeEditDocumentFromStream, MimeOleGetCertsFromThumbprints, MimeEditViewSource, MimeOleAlgNameFromSMimeCap, MimeOleClearDirtyTree, MimeOleSetBodyPropW, MimeOleParseRfc822AddressW, RichMimeEdit_CreateInstance, MimeOleGetPropertySchema, MimeOleParseRfc822Address, MimeOleSMimeCapGetHashAlg, MimeOleSetCompatMode, MimeOleGetAllocator, MimeOleCreateBody, MimeOleCreateHashTable, CreateIMAPTransport2, MimeOleUnEscapeStringInPlace, MimeOleDecodeHeader, MimeOleGetPropA, MimeOleCreatePropertySet, CreateRangeList, MimeOleCreateMessageParts, CreatePOP3Transport, MimeOleGenerateMID, CreateSMTPTransport, MimeOleStripHeaders, HrAthGetFileName, MimeOleSMimeCapInit, MimeOleSMimeCapAddSMimeCap, MimeOleSMimeCapAddCert, MimeOleSMimeCapGetEncAlg, MimeOleGetCodePageCharset, MimeOleSetDefaultCharset, MimeOleFindCharset, MimeOleGetCharsetInfo, MimeOleGetCodePageInfo, MimeOleGetBodyPropA, MimeOleCreateMessage, MimeOleCreateVirtualStream, MimeOleGetBodyPropW, MimeOleSetBodyPropA, HrGetAttachIconByFile, HrGetAttachIcon, HrFreeAttachData, HrAttachDataFromBodyPart, HrAttachDataFromFile, HrDoAttachmentVerb, MimeOleGetFileInfoW, CreateNNTPTransport, MimeOleInetDateToFileTime, MimeOleSMimeCapsFull
> ADVAPI32.dll: RegCloseKey, CryptAcquireContextA, RegQueryValueA, RegDeleteValueA, RegOpenKeyA, RevertToSelf, AllocateAndInitializeSid, FreeSid, ImpersonateLoggedOnUser, OpenThreadToken, RegQueryValueExA, RegOpenKeyExA, RegEnumKeyExA, RegQueryInfoKeyA, RegCreateKeyExA, RegSetValueExA, RegDeleteKeyA, RegEnumKeyA, CloseServiceHandle, RegEnumValueA, EnumServicesStatusA, OpenSCManagerA, GetTokenInformation, OpenProcessToken, EqualSid
> GDI32.dll: CreateFontIndirectA, GetObjectA, GetDeviceCaps, CreateSolidBrush, SetBkColor, DeleteObject, GetTextMetricsA, SelectObject, RestoreDC, SetBkMode, SaveDC, DeleteDC, BitBlt, TextOutA, TextOutW, CreateCompatibleBitmap, CreateCompatibleDC, PatBlt, LineTo, MoveToEx, CreatePen, SetTextAlign, CreateRectRgnIndirect, DeleteMetaFile, CloseMetaFile, Polyline, CreateFontA, GetTextExtentPointA, SelectPalette, RealizePalette, GetPixel, StretchBlt, EnumFontFamiliesExA, Rectangle, Ellipse, SetWindowExtEx, SetWindowOrgEx, CreateMetaFileA, SetViewportOrgEx, SetMapMode, LPtoDP, Polygon, GetTextExtentPoint32A, ExtTextOutA, SetTextColor
> KERNEL32.dll: HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, InterlockedExchange, VirtualQuery, UnhandledExceptionFilter, GetOEMCP, GetCPInfo, SetFilePointer, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetStdHandle, VirtualProtect, FlushFileBuffers, GetProcessHeap, GetWindowsDirectoryA, HeapSize, CreateDirectoryA, GetShortPathNameW, GetShortPathNameA, GetSystemDefaultLangID, GetUserDefaultLangID, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, RtlUnwind, HeapReAlloc, GetEnvironmentStringsW, lstrcmpiA, lstrcpynA, FreeLibrary, GetProcAddress, LoadLibraryA, GetVersionExA, ExpandEnvironmentStringsA, GetSystemDirectoryA, lstrlenA, GetACP, SystemTimeToFileTime, GetSystemTime, lstrlenW, LoadLibraryExA, GetLastError, SizeofResource, LockResource, LoadResource, FindResourceA, LeaveCriticalSection, lstrcmpA, EnterCriticalSection, FindClose, FindFirstFileA, GetCurrentThreadId, GetLocaleInfoA, GetModuleFileNameA, DeleteCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalLock, GlobalSize, GlobalFree, GlobalAlloc, InterlockedIncrement, InterlockedDecrement, LocalFree, CompareFileTime, WideCharToMultiByte, LocalAlloc, GetSystemTimeAsFileTime, FormatMessageA, MultiByteToWideChar, MulDiv, GetLocaleInfoW, GetUserDefaultLCID, RtlMoveMemory, CloseHandle, CreateMutexA, SetErrorMode, Sleep, GetTickCount, ReleaseMutex, WaitForSingleObject, IsDBCSLeadByte, GlobalReAlloc, IsBadReadPtr, GetCurrentProcessId, TlsSetValue, TlsGetValue, TlsAlloc, TlsFree, OpenFile, DeleteFileA, GetTempFileNameA, GetTempPathA, FormatMessageW, GetProfileIntA, FlushInstructionCache, GetCurrentProcess, GetCurrentThread, GetModuleHandleA, IsBadWritePtr, FileTimeToSystemTime, FileTimeToLocalFileTime, IsBadStringPtrA, GetVersion, MoveFileA, GetDiskFreeSpaceA, FindNextFileA, GetDriveTypeA, ExitProcess, GetExitCodeProcess, CreateProcessA, SetThreadPriority, SetEvent, CreateThread, CreateEventA, IsDBCSLeadByteEx, SetLastError, GetFileAttributesA, GetEnvironmentVariableA, CreateFileA, GetSystemInfo, GetCommandLineA, HeapAlloc, HeapFree
> ole32.dll: OleSetClipboard, CLSIDFromString, DoDragDrop, CoTaskMemRealloc, PropVariantCopy, CoDisconnectObject, CoInitialize, CoUninitialize, CreateStreamOnHGlobal, StringFromGUID2, CreateDataAdviseHolder, OleRegGetMiscStatus, OleRegGetUserType, OleRegEnumVerbs, CoTaskMemFree, OleSaveToStream, CoGetMalloc, CoTaskMemAlloc, OleInitialize, OleUninitialize, CreateOleAdviseHolder, OleRun, WriteClassStm, CoLockObjectExternal, RegisterDragDrop, RevokeDragDrop, ReadClassStm, ReleaseStgMedium, CoCreateInstance, PropVariantClear
> USER32.dll: WinHelpA, CheckRadioButton, DrawTextExA, SetMenuDefaultItem, IsDialogMessageA, GetAsyncKeyState, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, DrawFocusRect, FindWindowExA, GetMessageA, PostThreadMessageA, GetMessagePos, GetCursorPos, CharLowerA, TranslateAcceleratorA, GetNextDlgTabItem, GetSubMenu, IsMenu, ModifyMenuA, UnionRect, PtInRect, GetClassInfoExA, RegisterClassExA, IntersectRect, EqualRect, SetWindowRgn, UnregisterClassA, IsIconic, UpdateWindow, RemoveMenu, GetWindowDC, RegisterClipboardFormatA, GetMenuStringA, CheckMenuRadioItem, SetParent, DrawEdge, ActivateKeyboardLayout, ClientToScreen, GetDlgCtrlID, GetKeyboardLayoutList, ReleaseCapture, SetCapture, AdjustWindowRectEx, CopyRect, LoadMenuA, GetCapture, GetWindowPlacement, SetWindowPlacement, WindowFromPoint, IsChild, GetKeyState, LoadAcceleratorsA, GetForegroundWindow, CheckMenuItem, DeleteMenu, PostQuitMessage, LoadImageA, DestroyIcon, EnumWindows, GetClassNameA, GetSysColorBrush, FillRect, InflateRect, GetDlgItemInt, SetDlgItemInt, GetDlgItemTextW, SendDlgItemMessageW, SetDlgItemTextW, MessageBeep, CreateDialogParamA, KillTimer, PeekMessageA, TranslateMessage, DispatchMessageA, SetTimer, SystemParametersInfoA, MoveWindow, RegisterWindowMessageA, SetForegroundWindow, GetDlgItemTextA, InsertMenuItemA, SendDlgItemMessageA, GetSystemMetrics, GetMenu, GetMenuItemInfoA, InsertMenuA, IsWindowUnicode, SetDlgItemTextA, CheckDlgButton, CreatePopupMenu, AppendMenuA, GetMenuItemCount, SetMenuItemInfoA, DestroyMenu, OffsetRect, SetPropA, IsDlgButtonChecked, LoadIconA, GetDC, DrawTextA, ReleaseDC, SetWindowTextA, DialogBoxParamA, SetActiveWindow, EnableWindow, EnumThreadWindows, IsWindowEnabled, GetActiveWindow, GetLastActivePopup, IsWindowVisible, GetWindowThreadProcessId, GetWindow, MapWindowPoints, TrackPopupMenuEx, PostMessageA, SetFocus, GetClassInfoA, RegisterClassA, CreateWindowExA, BeginPaint, EndPaint, DefWindowProcA, DestroyWindow, EnableMenuItem, GetWindowRect, ScreenToClient, SetRect, GetDlgItem, GetWindowTextLengthA, GetWindowTextA, GetPropA, GetSysColor, CallWindowProcA, GetClientRect, SetWindowPos, InvalidateRect, ShowWindow, SetWindowLongA, RemovePropA, LoadCursorA, SetCursor, IsWindow, GetWindowLongA, GetParent, SendMessageA, CharNextA, GetFocus, MessageBoxA, EndDialog, CharPrevA, GetDesktopWindow, LoadStringA, DrawStateA, GetUpdateRect, IsZoomed, WaitForInputIdle, IsCharAlphaA, IsCharAlphaNumericA, GetMenuItemID, SendMessageW, GetMenuState, TrackPopupMenu, RedrawWindow, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, AdjustWindowRect, SetMenu, CharUpperA, EnumChildWindows, LoadStringW, LoadBitmapA, GetDoubleClickTime, ValidateRect, DrawIconEx, DrawFrameControl
> SHLWAPI.dll: SHRegGetValueW, -, StrChrA, PathRemoveBackslashW, StrStrIW, PathStripPathW, PathAddExtensionW, PathIsRootA, PathIsContentTypeW, SHCreateShellPalette, SHGetValueW, SHSetValueW, PathCombineW, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, SHQueryInfoKeyA, SHEnumKeyExA, StrToIntExA, StrStrW, StrNCatW, wvnsprintfA, PathCombineA, PathFindExtensionA, PathFindFileNameA, StrFormatByteSizeA, PathCanonicalizeA, PathRemoveBackslashA, PathIsDirectoryA, SHCopyKeyA, PathGetArgsA, PathRemoveArgsA, PathUnquoteSpacesA, StrDupW, PathFindExtensionW, StrRChrIW, StrCatBuffW, StrCmpNIW, SHAutoComplete, UrlApplySchemeW, StrStrIA, SHRegGetBoolUSValueA, PathRemoveExtensionW, PathCompactPathExW, PathAppendA, PathIsDirectoryW, PathFileExistsW, PathFindFileNameW, PathIsFileSpecW, StrDupA, PathIsURLW, PathRemoveFileSpecA, PathRemoveFileSpecW, UrlUnescapeA, SHDeleteValueA, SHSetValueA, StrCmpW, StrCSpnW, StrCSpnA, StrCmpIW, SHQueryValueExA, PathFileExistsA, StrToIntA, wnsprintfW, StrCmpNIA, UrlEscapeA, StrCpyNW, PathAddBackslashA, SHGetValueA, StrStrA, SHDeleteKeyA, StrCatBuffA, wnsprintfA
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -

( 32 exports )
BMAPIAddress, BMAPIDetails, BMAPIFindNext, BMAPIGetAddress, BMAPIGetReadMail, BMAPIReadMail, BMAPIResolveName, BMAPISaveMail, BMAPISendMail, CoStartOutlookExpress, DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, FIsDefaultMailConfiged, FIsDefaultNewsConfiged, ImportMailStoreToGUID, ImportNewsListToGUID, MAPIAddress, MAPIDeleteMail, MAPIDetails, MAPIFindNext, MAPIFreeBuffer, MAPILogoff, MAPILogon, MAPIReadMail, MAPIResolveName, MAPISaveMail, MAPISendDocuments, MAPISendMail, SetDefaultMailHandler, SetDefaultNewsHandler
PDFiD.: -
RDS...: NSRL Reference Data Set
-

Je vais devoir m'arrêter car j'ai des enfants à aller chercher et je ne pourrais pas m'occuper de l'ordi ce week-end.
Est-ce qu'il y a moyen de continuer lundi , je relancerais virus total à ce moment là.
Est-ce que je peux éteindre l'ordi et le relancer lundi matin ou je le laisse allumer ?
En tout cas merci beaucoup pour ton aide
Gaëlle

Combo :
ComboFix 09-08-20.07 - Gaelle 21/08/2009 15:35.3.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.154 [GMT 2:00]
Running from: c:\documents and settings\Gaelle\Bureau\ske.exe
Command switches used :: c:\documents and settings\Gaelle\Bureau\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((( Files Created from 2009-07-21 to 2009-08-21 )))))))))))))))))))))))))))))))
.

2009-08-21 12:55 . 2009-08-21 13:00 -------- d-s---w- C:\ComboFix
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-21 10:10 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-21 09:09 . 2009-08-21 13:19 -------- d-----w- C:\UsbFix
2009-08-21 08:55 . 2009-08-21 13:17 -------- d-----w- c:\program files\ZHPDiag
2009-08-21 08:41 . 2009-08-21 08:46 -------- d-----w- c:\program files\CCleaner
2009-08-21 07:48 . 2009-08-21 07:50 -------- d-----w- C:\ToolBar SD
2009-08-21 07:12 . 2009-08-21 12:15 -------- d-----w- C:\Hijackthis
2009-08-20 09:23 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\uic40E.exe
2009-08-20 06:41 . 2009-08-20 06:41 -------- d-sh--w- c:\documents and settings\Gaelle\PrivacIE
2009-08-17 14:59 . 2009-08-17 14:59 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-13 07:09 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 07:49 . 2009-08-10 07:49 152576 ----a-w- c:\documents and settings\Gaelle\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-30 08:15 . 2009-07-03 16:57 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-30 08:15 . 2009-07-03 16:57 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2009-07-23 12:52 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\eah3B.exe
2009-07-23 12:51 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\jpe3A.exe
2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Simply Super Software
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-21 13:32 . 2009-04-03 07:14 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-21 11:46 . 2009-05-05 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 09:35 . 2004-08-19 13:03 64484 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-21 09:35 . 2004-08-19 13:03 446566 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-20 13:39 . 2006-02-03 10:59 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-20 09:25 . 2009-05-12 09:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-17 14:59 . 2004-08-19 13:03 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-08-10 11:56 . 2006-02-03 10:21 -------- d-----w- c:\program files\PowerArchiver
2009-08-10 10:23 . 2009-05-05 09:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 07:55 . 2006-01-31 11:10 -------- d-----w- c:\program files\Java
2009-08-05 09:00 . 2004-08-19 13:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2009-02-18 13:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2004-08-19 13:03 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 06:27 . 2009-05-05 11:39 -------- d-----w- c:\program files\Spyware Terminator
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Firebird
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Eppendorf
2009-07-12 10:21 . 2004-08-19 13:04 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 13:03 915456 ------w- c:\windows\system32\wininet.dll
2009-06-16 14:40 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-08-19 13:03 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-08-19 13:03 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-19 13:03 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 13:03 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2004-08-19 13:14 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-19 13:03 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2004-08-19 13:03 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-03-26 13:26 . 2008-03-26 13:24 3116521 ----a-w- c:\program files\dialang.exe
2007-05-25 07:31 . 2007-05-25 07:31 4787 ----a-w- c:\program files\legitcheck.hta
.

------- Sigcheck -------

[-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\$NtServicePackUninstall$\ntfs.sys
[7] 2004-08-05 12:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtUninstallKB930916$\ntfs.sys
[7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\dllcache\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\drivers\ntfs.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-05-04 126000]
"_BackupService"="c:\program files\Astase\UltraBackup\4.9\bin\tbs.exe" [2008-02-08 1671168]
"thnotify"="c:\program files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" [2008-02-08 1491456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 34880]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53:UDP"= 53:UDP:Promo

R2 thpassivesvc;Astase ThalliumBackup Client Background Service;c:\program files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe [06/04/2009 08:54 646144]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [21/08/2009 10:02 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [04/05/2007 16:06 119856]
S4 ThalliumServer;Astase ThalliumBackup Storage Service;c:\program files\Astase\UltraBackup\4.9\bin\tbsd.exe [06/04/2009 08:54 1952256]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SPBBCDRV
*NewlyCreated* - SPBBCSVC

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]

2009-08-21 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-05-05 13:31]
.
.
------- Supplementary Scan -------
.
mWindow Title =
TCP: {63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD} = 147.99.0.16,147.99.0.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Gaelle\Application Data\Mozilla\Firefox\Profiles\p8yfybmu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?source=gama&hl=fr
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
FF - prefs.js: network.proxy.type - 2

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-21 15:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseGuardian]
"ImagePath"="c:\program files\Firebird\bin\ibguard -s"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseServer]
"ImagePath"="c:\program files\Firebird\bin\ibserver -s"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\windows\system32\igfxdev.dll

- - - - - - - > 'explorer.exe'(2104)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-08-21 15:42
ComboFix-quarantined-files.txt 2009-08-21 13:42
ComboFix2.txt 2009-08-21 13:08
ComboFix3.txt 2009-08-21 12:03

Pre-Run: 63 681 400 832 octets libres
Post-Run: 63 662 313 472 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

168 --- E O F --- 2009-08-21 12:11

Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:47:07, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Gaelle\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

En fait à la fin du tutoriel il parle de téléchargerle programme sur le site de microsoft, est-ce que je suis ce système et on voit si ça marche ?

@Gaellere,

fait ce que je t'ai demandé ici d'abors > https://forums.commentcamarche.net/forum/affich-13989022-rapport-hijackthis#22

on verra après si il faut qu'on fasse l'installe manuellement ....

@sKe69OK je me lance (version XP Pro)

@sKe69Toujours pas d'installation de console !!!

Sur le tutoriel , une fenêtre doit s'ouvrir pour installer la console et quand j'ai lancé combofix, de suite après la fenêtre limitation de garantie il a lancé le scan. Je fais comment pour installer la console s'il ne me le demande pas ?

Tes instructions sont vraiment très bien et facile à suivre donc voilà les 2 rapports :

ComboFix 09-08-20.07 - Gaelle 21/08/2009 13:56.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.216 [GMT 2:00]
Running from: c:\documents and settings\Gaelle\Bureau\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\Installer\25158e.msi
c:\windows\Installer\251593.msi
c:\windows\Installer\251598.msi

.
((((((((((((((((((((((((( Files Created from 2009-07-21 to 2009-08-21 )))))))))))))))))))))))))))))))
.

2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-21 10:10 . 2009-08-21 10:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-21 10:10 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-21 09:09 . 2009-08-21 09:41 -------- d-----w- C:\UsbFix
2009-08-21 08:55 . 2009-08-21 08:57 -------- d-----w- c:\program files\ZHPDiag
2009-08-21 08:41 . 2009-08-21 08:46 -------- d-----w- c:\program files\CCleaner
2009-08-21 07:48 . 2009-08-21 07:50 -------- d-----w- C:\ToolBar SD
2009-08-21 07:12 . 2009-08-21 10:34 -------- d-----w- C:\Hijackthis
2009-08-20 09:23 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\uic40E.exe
2009-08-20 06:41 . 2009-08-20 06:41 -------- d-sh--w- c:\documents and settings\Gaelle\PrivacIE
2009-08-17 14:59 . 2009-08-17 14:59 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-13 07:09 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 07:49 . 2009-08-10 07:49 152576 ----a-w- c:\documents and settings\Gaelle\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-30 08:15 . 2009-07-03 16:57 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-30 08:15 . 2009-07-03 16:57 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2009-07-23 12:52 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\eah3B.exe
2009-07-23 12:51 . 2009-06-22 15:05 3015544 ----a-w- c:\documents and settings\Gaelle\Application Data\Simply Super Software\Trojan Remover\jpe3A.exe
2009-07-23 12:46 . 2009-07-23 12:46 -------- d-----w- c:\documents and settings\Gaelle\Application Data\Simply Super Software
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2009-07-23 12:14 . 2009-07-23 12:14 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-21 11:54 . 2009-04-03 07:14 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-21 11:46 . 2009-05-05 09:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 09:35 . 2004-08-19 13:03 64484 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-21 09:35 . 2004-08-19 13:03 446566 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-20 13:39 . 2006-02-03 10:59 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-20 09:25 . 2009-05-12 09:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-17 14:59 . 2004-08-19 13:03 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-08-10 11:56 . 2006-02-03 10:21 -------- d-----w- c:\program files\PowerArchiver
2009-08-10 10:23 . 2009-05-05 09:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 07:55 . 2006-01-31 11:10 -------- d-----w- c:\program files\Java
2009-08-05 09:00 . 2004-08-19 13:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2009-02-18 13:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2004-08-19 13:03 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 06:27 . 2009-05-05 11:39 -------- d-----w- c:\program files\Spyware Terminator
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Firebird
2009-07-16 08:23 . 2009-07-16 08:21 -------- d-----w- c:\program files\Eppendorf
2009-07-12 10:21 . 2004-08-19 13:04 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2004-08-19 13:03 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-16 14:40 . 2004-08-19 13:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-08-19 13:03 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:44 . 2004-08-19 13:03 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2004-08-19 13:03 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2004-08-19 13:03 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2004-08-19 13:14 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2004-08-19 13:03 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2004-08-19 13:03 1297408 ----a-w- c:\windows\system32\quartz.dll
2008-03-26 13:26 . 2008-03-26 13:24 3116521 ----a-w- c:\program files\dialang.exe
2007-05-25 07:31 . 2007-05-25 07:31 4787 ----a-w- c:\program files\legitcheck.hta
.

------- Sigcheck -------

[-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\$NtServicePackUninstall$\ntfs.sys
[7] 2004-08-05 12:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtUninstallKB930916$\ntfs.sys
[7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\dllcache\ntfs.sys
[-] 2009-08-17 14:59 619584 A516EEA32C9376C718BC33C08D9A99F7 c:\windows\system32\drivers\ntfs.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-11-21 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-05-04 126000]
"_BackupService"="c:\program files\Astase\UltraBackup\4.9\bin\tbs.exe" [2008-02-08 1671168]
"thnotify"="c:\program files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" [2008-02-08 1491456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 34880]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53:UDP"= 53:UDP:Promo

R2 thpassivesvc;Astase ThalliumBackup Client Background Service;c:\program files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe [06/04/2009 08:54 646144]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [21/08/2009 10:02 101936]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [04/05/2007 16:06 119856]
S4 ThalliumServer;Astase ThalliumBackup Storage Service;c:\program files\Astase\UltraBackup\4.9\bin\tbsd.exe [06/04/2009 08:54 1952256]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]

2009-08-21 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2009-05-05 13:31]
.
.
------- Supplementary Scan -------
.
mWindow Title =
TCP: {63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD} = 147.99.0.16,147.99.0.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Gaelle\Application Data\Mozilla\Firefox\Profiles\p8yfybmu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?source=gama&hl=fr
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
FF - prefs.js: network.proxy.type - 2

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-21 14:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseGuardian]
"ImagePath"="c:\program files\Firebird\bin\ibguard -s"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\InterBaseServer]
"ImagePath"="c:\program files\Firebird\bin\ibserver -s"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\windows\system32\igfxdev.dll
.
Completion time: 2009-08-21 14:03
ComboFix-quarantined-files.txt 2009-08-21 12:03

Pre-Run: 61 310 795 776 octets libres
Post-Run: 61 270 904 832 octets libres

159 --- E O F --- 2009-08-18 03:45

et Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:15:34, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijackthis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe

Les résultats des scans :

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2668
Windows 5.1.2600 Service Pack 3

21/08/2009 12:27:27
mbam-log-2009-08-21 (12-27-27).txt

Type de recherche: Examen rapide
Eléments examinés: 98514
Temps écoulé: 4 minute(s), 47 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\11801404 (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\11801404\11801404 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\11801404\pc11801404ins (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gaelle\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gaelle\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.

et le second :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:26, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [_BackupService] "C:\Program Files\Astase\UltraBackup\4.9\bin\tbs.exe" -start
O4 - HKLM\..\Run: [thnotify] "C:\Program Files\Astase\UltraBackup\4.9\bin\thtrayagent.exe" /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{63EDE3A0-5C44-4FF9-B1BA-94A15F8FF3FD}: NameServer = 147.99.0.16,147.99.0.1
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\Astase\UltraBackup\4.9\bin\thpassiveclientsvc.exe