X.bat detecté par avast

Résolu
pwet31 -  
Bonjour,

A chaque démarrage, avast détecte un virus sur le fichier x.bat et impossible de m'en débarasser.

J'ai essayé ccleaner, spybot s&d, FindyKill (peut-être pas très bien), Malwarebyte's et un scan via eset (online).

Voici le rapport généré par RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-10-19 10:40:37
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 29 GB (57%) free of 50 GB
Total RAM: 3071 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:39, on 19/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\usb_drv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Windows\LSD\LClock\lclock.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://melanthios-ana.com/zcvisitor/1624d318-3614-11eb-87b9-12a1ab6c324d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=47f83760-f118-11ea-9bc8-0ac2bbf4ada7
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://dt-updates.com/activate?query=DQ3o0IVRO0mrscpJB5J2%2fclHZwJrvYUaRD%2b1%2b8E1xiFGoiWUqYSnXQ8j2xetHwTuZdz8DU16kYIvCdg8oLqZIzdcCGuNzd35nvCCnfGm2mLFnv0a1PNTlq64zxxovn9nxuQxszRjTjS%2f%2bdI4iakKLrcuLk33lo3HpfyGWfKhyfNGk7vZKdNYn2tNXuvriJyRmUmArauHS4Lrsd6uL42zL%2b%2fsYuMpB7bxk1ptVYoQdGpZaENfk%2bba7OlM1hPcikCVmaUm7XS0KPXG5o%2f0Xcr9RVLclupgmj%2fKKY6E6sA00xc%3d
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Universal Bus device] usb_drv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Windows\LSD\LClock\lclock.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 9686 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
pdfforge Toolbar - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll [2009-07-31 698880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-18 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-07-29 1153024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-18 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B922D405-6D13-4A2B-AE89-08A030DA4402} - pdfforge Toolbar - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll [2009-07-31 698880]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-09-15 81000]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2003-05-30 585728]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-09-21 305440]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [2001-12-12 196608]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]
"Universal Bus device"=C:\WINDOWS\usb_drv.exe [2009-10-08 101888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SearchSettings"=C:\Program Files\pdfforge Toolbar\SearchSettings.exe [2009-07-29 1024512]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-18 149280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"LClock"=C:\Windows\LSD\LClock\lclock.exe [2004-09-19 65536]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSMBalloonTip"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe"="C:\Program Files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe:*:Enabled:STREET FIGHTER IV"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 3 months======

2009-10-18 23:35:03 ----D---- C:\Program Files\CCleaner
2009-10-18 18:08:00 ----D---- C:\WINDOWS\Sun
2009-10-18 18:03:35 ----A---- C:\WINDOWS\system32\javaws.exe
2009-10-18 18:03:35 ----A---- C:\WINDOWS\system32\javaw.exe
2009-10-18 18:03:35 ----A---- C:\WINDOWS\system32\java.exe
2009-10-18 18:03:35 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-10-18 18:03:15 ----D---- C:\Program Files\Java
2009-10-18 18:01:20 ----D---- C:\Documents and Settings\Administrateur\Application Data\Sun
2009-10-18 16:48:20 ----D---- C:\Documents and Settings\All Users\Application Data\ACD Systems
2009-10-18 16:48:13 ----D---- C:\Program Files\ACD Systems
2009-10-18 14:26:51 ----D---- C:\Program Files\MeuhMeuhTV
2009-10-18 12:19:44 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-10-18 12:18:18 ----A---- C:\WINDOWS\system32\wups2.dll
2009-10-18 12:18:17 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2009-10-18 12:18:17 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2009-10-18 12:18:16 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2009-10-18 12:18:15 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-10-16 22:17:05 ----D---- C:\WINDOWS\system32\appmgmt
2009-10-16 22:02:44 ----A---- C:\FindyKill.txt
2009-10-16 21:59:43 ----D---- C:\FindyKill
2009-10-16 21:13:36 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-10-16 21:13:36 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-15 13:23:57 ----D---- C:\rsit
2009-10-15 13:23:57 ----D---- C:\Program Files\trend micro
2009-10-14 20:47:22 ----A---- C:\WINDOWS\system32\mbhmdptm.ini
2009-10-14 20:47:15 ----D---- C:\Program Files\Poker Tournament Manager Demo
2009-10-14 20:47:15 ----A---- C:\WINDOWS\system32\VB5DB.DLL
2009-10-10 12:44:35 ----D---- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2009-10-10 12:44:26 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-10-10 12:44:26 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-10-09 15:13:42 ----D---- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2009-10-09 09:36:03 ----D---- C:\Program Files\Messenger Plus! Live
2009-10-09 00:54:33 ----D---- C:\Documents and Settings\Administrateur\Application Data\Search Settings
2009-10-09 00:54:31 ----D---- C:\Documents and Settings\Administrateur\Application Data\pdfforge
2009-10-09 00:00:00 ----D---- C:\Program Files\pdfforge Toolbar
2009-10-08 23:57:02 ----A---- C:\WINDOWS\system32\pdfcmnnt.dll
2009-10-08 23:56:57 ----A---- C:\WINDOWS\system32\VB6FR.DLL
2009-10-08 23:56:57 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL
2009-10-08 23:56:57 ----A---- C:\WINDOWS\system32\MSCC2FR.DLL
2009-10-08 23:56:56 ----D---- C:\Program Files\PDFCreator
2009-10-08 23:56:56 ----A---- C:\WINDOWS\system32\MSMPIDE.DLL
2009-10-08 23:52:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-10-08 23:51:56 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-10-08 23:51:56 ----D---- C:\Program Files\Adobe
2009-10-08 23:13:19 ----D---- C:\bwinPoker
2009-10-08 23:02:37 ----A---- C:\WINDOWS\nigzss.txt
2009-10-08 23:02:27 ----RSH---- C:\WINDOWS\usb_drv.exe
2009-10-08 23:02:24 ----A---- C:\WINDOWS\s.txt
2009-10-08 23:02:10 ----A---- C:\WINDOWS\system32\Ms16.exe
2009-10-08 23:02:09 ----A---- C:\WINDOWS\system32\Ms17.exe
2009-10-08 22:58:22 ----A---- C:\WINDOWS\logfile32.txt
2009-10-08 20:15:01 ----D---- C:\Documents and Settings\Administrateur\Application Data\FileZilla
2009-10-08 16:39:53 ----D---- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2009-10-08 16:25:15 ----D---- C:\Program Files\CAPCOM
2009-10-08 16:25:09 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2009-10-08 16:25:09 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2009-10-08 16:25:08 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2009-10-08 16:25:08 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2009-10-08 16:25:08 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2009-10-08 16:25:07 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2009-10-08 16:25:06 ----D---- C:\WINDOWS\Logs
2009-10-08 16:15:37 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-10-08 16:11:07 ----D---- C:\WINDOWS\system32\XPSViewer
2009-10-08 16:10:34 ----D---- C:\Program Files\Reference Assemblies
2009-10-08 16:10:18 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-10-08 16:09:30 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2009-10-08 16:09:30 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2009-10-08 16:09:29 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2009-10-08 16:09:27 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-10-08 16:09:26 ----D---- C:\WINDOWS\system32\DirectX
2009-10-08 16:09:20 ----D---- C:\WINDOWS\system32\xlive
2009-10-08 16:09:19 ----D---- C:\Program Files\Microsoft Games for Windows - LIVE
2009-10-08 15:41:21 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-10-08 15:40:56 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-10-08 15:40:37 ----D---- C:\NVIDIA
2009-10-08 15:21:52 ----D---- C:\Program Files\Driver Cleaner Pro
2009-10-08 12:03:41 ----D---- C:\Documents and Settings\Administrateur\Application Data\ACD Systems
2009-10-06 18:55:40 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-10-06 14:26:34 ----D---- C:\WINDOWS\Minidump
2009-10-06 14:21:36 ----D---- C:\Program Files\SuperCopier2
2009-10-06 14:21:28 ----D---- C:\Program Files\SpeedFan
2009-10-06 00:37:09 ----D---- C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
2009-10-05 17:09:19 ----A---- C:\WINDOWS\system32\h323log.txt
2009-10-05 17:01:01 ----D---- C:\Program Files\Microsoft
2009-10-05 17:00:44 ----D---- C:\Program Files\Windows Live SkyDrive
2009-10-05 17:00:19 ----D---- C:\Program Files\Windows Live
2009-10-05 16:59:07 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-10-05 16:57:03 ----A---- C:\WINDOWS\system32\usbui.dll
2009-10-05 16:56:34 ----D---- C:\Program Files\hp deskjet 930c series
2009-10-05 16:56:29 ----D---- C:\Program Files\Hewlett-Packard
2009-10-05 16:55:33 ----SHD---- C:\WINDOWS\Installer
2009-10-05 16:55:33 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-10-05 16:55:32 ----D---- C:\Program Files\Fichiers communs\ODBC
2009-10-05 16:55:32 ----D---- C:\Program Files\Fichiers communs
2009-10-05 16:55:32 ----D---- C:\Program Files
2009-10-05 16:55:32 ----A---- C:\WINDOWS\ODBCINST.INI
2009-10-05 16:55:27 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-10-05 16:55:27 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-10-05 16:55:27 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-10-05 16:55:26 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-10-05 16:55:25 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-10-05 16:55:24 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-10-05 16:55:24 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-10-05 16:55:24 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-10-05 16:55:24 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-10-05 16:55:24 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-10-05 16:55:23 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-10-05 16:55:22 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-10-05 16:55:17 ----A---- C:\WINDOWS\system32\irclass.dll
2009-10-05 16:55:16 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-10-05 16:55:16 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-10-05 16:55:15 ----A---- C:\WINDOWS\system32\batt.dll
2009-10-05 16:55:15 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-10-05 16:55:14 ----A---- C:\WINDOWS\system32\storprop.dll
2009-10-05 16:55:05 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-10-05 16:53:25 ----D---- C:\Program Files\Fichiers communs\Windows Live
2009-10-05 16:53:22 ----RA---- C:\WINDOWS\SET7.tmp
2009-10-05 16:53:17 ----RA---- C:\WINDOWS\SET4.tmp
2009-10-05 16:53:16 ----RA---- C:\WINDOWS\SET3.tmp
2009-10-05 16:53:11 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-05 16:53:11 ----D---- C:\WINDOWS\system32\CatRoot
2009-10-05 16:53:05 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-10-05 16:52:22 ----D---- C:\Documents and Settings
2009-10-05 16:52:21 ----SHD---- C:\System Volume Information
2009-10-05 16:51:30 ----SH---- C:\boot.ini
2009-10-05 16:49:37 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-10-05 16:49:37 ----HD---- C:\WINDOWS\inf
2009-10-05 16:49:37 ----D---- C:\WINDOWS\WinSxS
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Web
2009-10-05 16:49:37 ----D---- C:\WINDOWS\WBEM
2009-10-05 16:49:37 ----D---- C:\WINDOWS\twain_32
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Temp
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\wins
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\wbem
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\usmt
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\spool
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\ShellExt
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\Setup
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\ras
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\oobe
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\npp
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\mui
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\inetsrv
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\IME
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\icsxml
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\ias
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\fr-fr
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\fr
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\export
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\drivers
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\dhcp
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\config
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\3com_dmi
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\3076
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\2052
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1054
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1042
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1041
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1037
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1036
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1033
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1031
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1028
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32\1025
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system32
2009-10-05 16:49:37 ----D---- C:\WINDOWS\system
2009-10-05 16:49:37 ----D---- C:\WINDOWS\security
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Resources
2009-10-05 16:49:37 ----D---- C:\WINDOWS\repair
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Provisioning
2009-10-05 16:49:37 ----D---- C:\WINDOWS\PeerNet
2009-10-05 16:49:37 ----D---- C:\WINDOWS\PCHealth
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Offline Web Pages
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Network Diagnostic
2009-10-05 16:49:37 ----D---- C:\WINDOWS\mui
2009-10-05 16:49:37 ----D---- C:\WINDOWS\msapps
2009-10-05 16:49:37 ----D---- C:\WINDOWS\msagent
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Media
2009-10-05 16:49:37 ----D---- C:\WINDOWS\L2Schemas
2009-10-05 16:49:37 ----D---- C:\WINDOWS\java
2009-10-05 16:49:37 ----D---- C:\WINDOWS\ime
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Help
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Fonts
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Driver Cache
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Debug
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Cursors
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Connection Wizard
2009-10-05 16:49:37 ----D---- C:\WINDOWS\Config
2009-10-05 16:49:37 ----D---- C:\WINDOWS\AppPatch
2009-10-05 16:49:37 ----D---- C:\WINDOWS\addins
2009-10-05 16:49:37 ----D---- C:\WINDOWS
2009-10-05 16:27:44 ----A---- C:\WINDOWS\system32\unrar.dll
2009-10-05 16:27:43 ----A---- C:\WINDOWS\avisplitter.ini
2009-10-05 16:27:40 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-10-05 16:27:40 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2009-10-05 16:27:40 ----A---- C:\WINDOWS\system32\xvidcore.dll
2009-10-05 16:27:39 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-10-05 16:27:38 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-10-05 16:27:36 ----D---- C:\Program Files\K-Lite Codec Pack
2009-10-05 16:25:36 ----D---- C:\Documents and Settings\Administrateur\Application Data\vlc
2009-10-05 16:25:11 ----D---- C:\Program Files\uTorrent
2009-10-05 16:24:46 ----D---- C:\Program Files\Freeplayer
2009-10-05 16:24:37 ----D---- C:\Documents and Settings\Administrateur\Application Data\uTorrent
2009-10-05 16:19:48 ----D---- C:\Documents and Settings\Administrateur\Application Data\Macromedia
2009-10-05 16:19:48 ----D---- C:\Documents and Settings\Administrateur\Application Data\Adobe
2009-10-05 16:18:40 ----HDC---- C:\WINDOWS\ie8
2009-10-05 16:18:40 ----D---- C:\WINDOWS\system32\en-US
2009-10-05 16:05:18 ----A---- C:\WINDOWS\system32\PsisDecd.dll
2009-10-05 16:01:01 ----SHD---- C:\WINDOWS\CSC
2009-10-05 15:58:25 ----D---- C:\Program Files\Fichiers communs\ACD Systems
2009-10-05 15:57:54 ----D---- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2009-10-05 15:57:43 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-10-05 15:57:07 ----D---- C:\Program Files\iPod
2009-10-05 15:57:05 ----D---- C:\Program Files\iTunes
2009-10-05 15:57:05 ----D---- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-05 15:56:48 ----D---- C:\Program Files\Bonjour
2009-10-05 15:56:36 ----A---- C:\WINDOWS\system32\34CoInstaller.dll
2009-10-05 15:56:14 ----D---- C:\Program Files\QuickTime
2009-10-05 15:56:13 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-10-05 15:56:11 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2009-10-05 15:55:50 ----D---- C:\Program Files\Apple Software Update
2009-10-05 15:55:41 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-10-05 15:55:30 ----D---- C:\Program Files\Fichiers communs\Apple
2009-10-05 15:55:29 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-10-05 15:53:56 ----A---- C:\WINDOWS\system32\mpg4c32.dll
2009-10-05 15:53:33 ----N---- C:\WINDOWS\system32\MSVCR70.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MSVCP70.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MSVCI70.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70U.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70KOR.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70JPN.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70ITA.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70FRA.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70ESP.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70DEU.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70CHT.DLL
2009-10-05 15:53:32 ----N---- C:\WINDOWS\system32\MFC70CHS.DLL
2009-10-05 15:53:31 ----N---- C:\WINDOWS\system32\MFC70.DLL
2009-10-05 15:53:31 ----N---- C:\WINDOWS\system32\atl71.dll
2009-10-05 15:53:31 ----N---- C:\WINDOWS\system32\ATL70.DLL
2009-10-05 15:52:36 ----D---- C:\Program Files\Microsoft Works
2009-10-05 15:52:35 ----D---- C:\Documents and Settings\All Users\Application Data\Pinnacle
2009-10-05 15:52:28 ----D---- C:\Program Files\MSBuild
2009-10-05 15:52:17 ----D---- C:\Program Files\Microsoft Visual Studio
2009-10-05 15:52:17 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2009-10-05 15:51:43 ----D---- C:\Program Files\Microsoft.NET
2009-10-05 15:49:40 ----D---- C:\Program Files\MozBackup
2009-10-05 15:49:28 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-10-05 15:49:07 ----D---- C:\WINDOWS\Downloaded Installations
2009-10-05 15:49:03 ----D---- C:\WINDOWS\SHELLNEW
2009-10-05 15:48:43 ----D---- C:\Program Files\Microsoft Office
2009-10-05 15:48:43 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-10-05 15:48:41 ----D---- C:\Program Files\WinRAR
2009-10-05 15:48:05 ----RHD---- C:\MSOCache
2009-10-05 15:47:43 ----D---- C:\Program Files\Mozilla Firefox
2009-10-05 15:44:42 ----SHD---- C:\RECYCLER
2009-10-05 15:44:23 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
2009-10-05 15:44:10 ----D---- C:\Program Files\DAEMON Tools Toolbar
2009-10-05 15:44:07 ----D---- C:\Program Files\DAEMON Tools Lite
2009-10-05 15:41:03 ----RA---- C:\WINDOWS\system32\UpdDrv2K.exe
2009-10-05 15:41:03 ----D---- C:\WINDOWS\OPTIONS
2009-10-05 15:39:52 ----D---- C:\Program Files\Intel
2009-10-05 15:39:04 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-10-05 15:39:02 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-10-05 15:38:57 ----A---- C:\WINDOWS\system32\wdmioctl.dll
2009-10-05 15:38:55 ----A---- C:\WINDOWS\system32\SMMedia.dll
2009-10-05 15:38:47 ----D---- C:\WINDOWS\VirtualEar
2009-10-05 15:38:44 ----A---- C:\WINDOWS\system32\Audio3d.dll
2009-10-05 15:38:42 ----A---- C:\WINDOWS\system32\virtear.dll
2009-10-05 15:38:39 ----A---- C:\WINDOWS\system32\a3d.dll
2009-10-05 15:38:38 ----D---- C:\Program Files\Analog Devices
2009-10-05 15:38:38 ----A---- C:\WINDOWS\system32\DSndUp.exe
2009-10-05 15:38:38 ----A---- C:\WINDOWS\system32\CleanUp.exe
2009-10-05 15:38:36 ----HD---- C:\Program Files\InstallShield Installation Information
2009-10-05 15:37:59 ----A---- C:\WINDOWS\Ascd_tmp.ini
2009-10-05 15:36:28 ----D---- C:\Program Files\FileZilla FTP Client
2009-10-05 15:35:26 ----A---- C:\WINDOWS\system32\Msvcr71.dll
2009-10-05 15:35:26 ----A---- C:\WINDOWS\system32\msvcp71.dll
2009-10-05 15:35:26 ----A---- C:\WINDOWS\system32\MFC71.dll
2009-10-05 15:35:26 ----A---- C:\WINDOWS\system32\aswBoot.exe
2009-10-05 15:35:24 ----D---- C:\Program Files\Alwil Software
2009-10-05 15:35:10 ----D---- C:\WINDOWS\nvidia icons
2009-10-05 15:34:54 ----D---- C:\WINDOWS\nview
2009-10-05 15:34:38 ----D---- C:\Documents and Settings\Administrateur\Application Data\DAEMON Tools Lite
2009-10-05 15:34:14 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-10-05 15:29:44 ----D---- C:\Documents and Settings\Administrateur\Application Data\Identities
2009-10-05 15:29:41 ----HD---- C:\Program Files\Uninstall Information
2009-10-05 15:29:31 ----ASH---- C:\Documents and Settings\Administrateur\Application Data\desktop.ini
2009-10-05 15:29:30 ----SD---- C:\Documents and Settings\Administrateur\Application Data\Microsoft
2009-10-05 15:29:30 ----D---- C:\Documents and Settings\Administrateur\Application Data\Mozilla
2009-10-05 15:23:38 ----D---- C:\WINDOWS\SoftwareDistribution
2009-10-05 15:23:36 ----SD---- C:\WINDOWS\system32\Microsoft
2009-10-05 15:23:36 ----D---- C:\WINDOWS\Prefetch
2009-10-05 15:22:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-10-05 15:22:07 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-10-05 15:21:57 ----D---- C:\WINDOWS\ie7updates
2009-10-05 15:21:52 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-10-05 15:21:49 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2009-10-05 15:21:46 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-10-05 15:21:41 ----HDC---- C:\WINDOWS\$NtUninstallKB942763$
2009-10-05 15:21:32 ----D---- C:\WINDOWS\system32\PreInstall
2009-10-05 15:21:31 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-10-05 15:15:39 ----RSD---- C:\WINDOWS\assembly
2009-10-05 15:15:39 ----D---- C:\WINDOWS\system32\URTTemp
2009-10-05 15:15:39 ----D---- C:\WINDOWS\Microsoft.NET
2009-10-05 15:15:10 ----A---- C:\WINDOWS\system32\LegitCheckControl.DLL
2009-10-05 15:14:42 ----D---- C:\WINDOWS\LSD
2009-10-05 15:14:42 ----A---- C:\WINDOWS\system32\oeminfo.ini
2009-10-05 15:14:12 ----HD---- C:\WINDOWS\$hf_mig$
2009-10-05 15:14:10 ----D---- C:\WINDOWS\system32\LogFiles
2009-10-05 15:14:04 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-10-05 15:13:42 ----D---- C:\Program Files\Windows Media Connect 2
2009-10-05 15:13:40 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-10-05 15:13:24 ----A---- C:\WINDOWS\control.ini
2009-10-05 15:13:24 ----A---- C:\AUTOEXEC.BAT
2009-10-05 15:13:11 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-10-05 15:13:10 ----D---- C:\WINDOWS\system32\dllcache
2009-10-05 15:12:31 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-10-05 15:12:28 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-10-05 15:12:23 ----HD---- C:\Program Files\WindowsUpdate
2009-10-05 15:12:08 ----A---- C:\WINDOWS\system32\desktop.ini
2009-10-05 15:12:08 ----A---- C:\WINDOWS\desktop.ini
2009-10-05 15:12:07 ----D---- C:\Program Files\Fichiers communs\Services
2009-10-05 15:12:07 ----A---- C:\WINDOWS\system32\acctres.dll
2009-10-05 15:12:05 ----SD---- C:\WINDOWS\Tasks
2009-10-05 15:12:05 ----D---- C:\Program Files\Fichiers communs\MSSoap
2009-10-05 15:12:05 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-10-05 15:12:03 ----D---- C:\WINDOWS\system32\Macromed
2009-10-05 15:12:01 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-10-05 15:12:01 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-10-05 15:12:01 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-10-05 15:12:01 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-10-05 15:12:00 ----A---- C:\WINDOWS\system32\wups.dll
2009-10-05 15:12:00 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-10-05 15:12:00 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-10-05 15:11:58 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-10-05 15:11:46 ----D---- C:\WINDOWS\system32\Restore
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\srclient.dll
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-10-05 15:11:46 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-10-05 15:11:45 ----A---- C:\WINDOWS\system32\inetres.dll
2009-10-05 15:11:45 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-10-05 15:11:44 ----D---- C:\Program Files\Outlook Express
2009-10-05 15:11:44 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-10-05 15:11:44 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-10-05 15:11:43 ----A---- C:\WINDOWS\system32\mstask.dll
2009-10-05 15:11:43 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-10-05 15:11:43 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-10-05 15:11:42 ----A---- C:\WINDOWS\system32\isign32.dll
2009-10-05 15:11:42 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-10-05 15:11:39 ----D---- C:\Program Files\Fichiers communs\System
2009-10-05 15:11:38 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-10-05 15:11:37 ----D---- C:\Program Files\Internet Explorer
2009-10-05 15:10:55 ----D---- C:\Program Files\ComPlus Applications
2009-10-05 15:10:53 ----A---- C:\WINDOWS\vbaddin.ini
2009-10-05 15:10:53 ----A---- C:\WINDOWS\vb.ini
2009-10-05 15:10:48 ----D---- C:\WINDOWS\Registration
2009-10-05 15:10:39 ----D---- C:\Program Files\Windows Media Player
2009-10-05 15:10:33 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-10-05 15:10:32 ----A---- C:\WINDOWS\system32\getuname.dll
2009-10-05 15:10:32 ----A---- C:\WINDOWS\system32\charmap.exe
2009-10-05 15:10:31 ----A---- C:\WINDOWS\system32\reset.exe
2009-10-05 15:10:31 ----A---- C:\WINDOWS\system32\calc.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\tskill.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\tscon.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\shadow.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\regini.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\msg.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\logoff.exe
2009-10-05 15:10:30 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-10-05 15:10:26 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-10-05 15:10:26 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-10-05 15:10:26 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-10-05 15:10:24 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-10-05 15:10:24 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-10-05 15:10:23 ----A---- C:\WINDOWS\system32\tsgqec.dll
2009-10-05 15:10:23 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-10-05 15:10:23 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2009-10-05 15:10:23 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-10-05 15:10:23 ----A---- C:\WINDOWS\system32\aaclient.dll
2009-10-05 15:10:22 ----D---- C:\WINDOWS\system32\MsDtc
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-10-05 15:10:22 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-10-05 15:10:21 ----D---- C:\WINDOWS\system32\Com
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-10-05 15:10:21 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\stclient.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\colbact.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-10-05 15:10:20 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-10-05 15:10:19 ----A---- C:\WINDOWS\system32\comuid.dll
2009-10-05 15:10:19 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-10-05 15:10:19 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-10-05 15:10:15 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-10-05 15:10:15 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-10-05 15:10:15 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-10-05 15:10:15 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-07-26 16:44:56 ----A---- C:\WINDOWS\system32\sirenacm.dll

======List of files/folders modified in the last 3 months======

2009-10-05 16:55:29 ----A---- C:\WINDOWS\system.ini
2009-10-05 15:49:14 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-09-15 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-09-15 52368]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE; C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-12-18 1121536]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-09-15 23152]
R3 EL2000;3Com 3C2000x EtherLink XL Adapter; C:\WINDOWS\system32\DRIVERS\EL2K_XP.sys [2003-07-17 147328]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-06-01 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 ahpzvc4h;ahpzvc4h; C:\WINDOWS\system32\drivers\ahpzvc4h.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-09-15 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-09-15 138680]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-18 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-09-21 545568]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-09-15 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-09-15 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

Merci de votre aide
Configuration: Windows XP SP3
Firefox 3.5.3

34 réponses

Résumé de la discussion

Le démarrage récurrent d'un fichier x.bat déclenche la détection d'un virus par Avast sur une machine sous Windows XP SP3. Plusieurs outils de détection et suppression, dont CCleaner, Spybot S&D, Malwarebytes et un scan ESET Online, ont été employés, et le rapport RSIT liste de nombreux éléments système et paramètres modifiés. Pour résoudre, il faut éliminer les extensions et outils indésirables détectés, nettoyer les entrées de démarrage et les services non essentiels, puis relancer une analyse approfondie avec MBAM et Avast. En cas de persistance, l'analyse des journaux et la vérification des clés Run/HKLM peut aider à identifier des composants implantés comme usb_drv.exe et d'autres éléments actifs mal identifiés.

Bobot (l’IA à votre service)
  4. pwet31
    ############################## | UsbFix V6.043 |

    User : Administrateur (Administrateurs) # PERSO
    Update on 21/10/2009 by Chiquitine29, C_XX & Chimay8
    Start at: 19:19:23 | 21/10/2009
    Website : http://pagesperso-orange.fr/NosTools/index.html
    Contact : FindyKill.Contact@gmail.com

    Intel(R) Pentium(R) 4 CPU 3.20GHz
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Disabled

    A:\ -> Lecteur de disquettes 3 ½ pouces
    C:\ -> Disque fixe local # 48,83 Go (28,77 Go free) [System] # NTFS
    D:\ -> Disque fixe local # 141,08 Go (36,15 Go free) [Temp] # NTFS
    E:\ -> Disque CD-ROM
    F:\ -> Disque CD-ROM
    G:\ -> Disque CD-ROM
    H:\ -> Disque amovible # 955,73 Mo (129,09 Mo free) [JUL] # FAT
    I:\ -> Disque fixe local # 195,31 Go (38,13 Go free) [Data] # NTFS
    J:\ -> Disque fixe local # 37,57 Go (17,22 Go free) [Sauvegarde] # NTFS
    K:\ -> Disque amovible # 974,48 Mo (974,47 Mo free) # FAT32

    ############################## | Processus actifs |

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\setup\avast.setup
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe

    ################## | Fichiers # Dossiers infectieux |

    Supprimé ! C:\WINDOWS\s.txt

    ################## | Registre # Clés Run infectieuses |

    Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
    Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
    Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

    ################## | Registre # Mountpoints2 |

    ################## | Listing des fichiers présent |

    [05/10/2009 15:13|--a------|0] C:\AUTOEXEC.BAT
    [05/10/2009 15:09|--a------|212] C:\Boot.bak
    [20/10/2009 21:35|-rahs----|282] C:\boot.ini
    [28/08/2001 20:00|-rahs----|4952] C:\Bootfont.bin
    [03/08/2004 23:00|--a------|263488] C:\cmldr
    [05/10/2009 15:13|--a------|0] C:\CONFIG.SYS
    [05/10/2009 15:13|-rahs----|0] C:\IO.SYS
    [20/10/2009 21:39|--a------|19097] C:\log.txt
    [05/10/2009 15:13|-rahs----|0] C:\MSDOS.SYS
    [13/04/2008 15:43|-rahs----|47564] C:\NTDETECT.COM
    [13/04/2008 17:31|-rahs----|252240] C:\ntldr
    [05/10/2009 15:23|--ahs----|2145386496] C:\pagefile.sys
    [21/10/2009 13:13|--a------|1425] C:\TCleaner.txt
    [21/10/2009 19:20|--a------|3218] C:\UsbFix.txt
    [25/12/2005 18:37|--a------|385648] D:\aswclnr.exe
    [25/12/2005 18:52|--a------|962] D:\aswclnr.log
    [29/09/2009 15:06|--a------|81282048] D:\backupOutlookrentree2008.pst
    [15/03/2006 20:35|--a------|566784] D:\BF2AutoLoader.msi
    [26/09/2006 12:36|--a------|220342] D:\bookmarks.html
    [17/12/2005 00:37|--a------|18944] D:\Classeur1.xls
    [30/03/2006 19:59|--a------|3824] D:\config.cfg
    [09/01/2007 21:55|--a------|71676] D:\goats.jpg
    [07/02/2006 22:01|--a------|3858] D:\h.cfg
    [07/02/2006 00:53|--a------|3643] D:\hold.cfg
    [07/02/2006 12:15|--a------|463] D:\server.cfg
    [25/12/2005 18:40|--a------|536308] D:\SPNG2.2.397.exe
    [30/04/2008 21:44|--a------|281] D:\System (C).lnk
    [23/11/2006 19:03|--ahs----|5632] D:\Thumbs.db
    [05/03/2006 16:42|--a------|83870743] D:\TRiiAD.-.HouZessioN.Vol.9.mp3
    [07/02/2006 22:03|--a------|1244] D:\userconfig.cfg
    [04/08/2009 23:52|--a------|285325] H:\bcn2009.JPG
    [13/09/2009 18:14|--a------|3154944] H:\Soutenance_Stage_14-09-2009.ppt
    [06/10/2007 15:44|---h-----|233472] H:\bsu.dat
    [13/11/2007 20:49|---h-----|108336] H:\MSWINSCK.OCX
    [13/09/2009 18:14|--a------|3154944] H:\Copie de Soutenance_Stage_14-09-2009.ppt
    [23/12/2008 02:02|--a------|865] I:\iPodBackupLibrary_1.xml
    [23/12/2008 02:02|--a------|1846] I:\iPodBackupLibrary_2.xml
    [05/10/2009 12:18|--a------|46744576] J:\archive.pst
    [05/10/2009 16:15|--a------|225526784] J:\backupOutlook_Oct2009.pst
    [05/10/2009 12:18|--a------|227558400] J:\Outlook 16-10-2008.pst
    [06/10/2009 00:36|--a------|62997504] J:\Outlook.pst

    ################## | Vaccination |

    # C:\autorun.inf -> Folder created by UsbFix.
    # D:\autorun.inf -> Folder created by UsbFix.
    # H:\autorun.inf -> Folder created by UsbFix.
    # I:\autorun.inf -> Folder created by UsbFix.
    # J:\autorun.inf -> Folder created by UsbFix.

    ################## | Suspect | https://www.virustotal.com/gui/ |

    ################## | Cracks / Keygens / Serials |

    "C:\Documents and Settings\Administrateur\Mes documents\Mes fichiers re‡us\mIRC_v6.12_keygen.exe"
    15/03/2005 21:44 |Size 13312 |Crc32 2b76a26b |Md5 d6252de66cf7dc81259afe36df5e6cb4

    "D:\Downloads\ADOBE Photoshop CS3 Extended FR\Keygens - Cracks\Photoshop.exe"
    02/08/2009 21:58 |Size 44814336 |Crc32 87941229 |Md5 8bbffd6536ef589fc2d2820f6e377abd

    "J:\MesDocs oct 2009\Mes fichiers re‡us\mIRC_v6.12_keygen.exe"
    15/03/2005 21:44 |Size 13312 |Crc32 2b76a26b |Md5 d6252de66cf7dc81259afe36df5e6cb4

    ################## | Upload |

    Veuillez envoyer le fichier : C:\DOCUME~1\ADMINI~1\Bureau\UsbFix_Upload_Me_PERSO.zip : https://www.androidworld.fr/
    Merci pour votre contribution .
    2. jlpjlp Contributeur sécurité
      ok fais l'option 2 de usbfix et mets le rapport
      1. jlpjlp Contributeur sécurité
        télécharge la dernière version d'usbfix sur le lien precedent et colle le rapport usbfix option 1
        1. pwet31
          ############################## | UsbFix V6.043 |

          User : Administrateur (Administrateurs) # PERSO
          Update on 21/10/2009 by Chiquitine29, C_XX & Chimay8
          Start at: 17:48:59 | 21/10/2009
          Website : http://pagesperso-orange.fr/NosTools/index.html
          Contact : FindyKill.Contact@gmail.com

          Intel(R) Pentium(R) 4 CPU 3.20GHz
          Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
          Internet Explorer 8.0.6001.18702
          Windows Firewall Status : Disabled

          A:\ -> Lecteur de disquettes 3 ½ pouces
          C:\ -> Disque fixe local # 48,83 Go (28,81 Go free) [System] # NTFS
          D:\ -> Disque fixe local # 141,08 Go (36,15 Go free) [Temp] # NTFS
          E:\ -> Disque CD-ROM
          F:\ -> Disque CD-ROM
          G:\ -> Disque CD-ROM
          H:\ -> Disque amovible # 955,73 Mo (129,09 Mo free) [JUL] # FAT
          I:\ -> Disque fixe local # 195,31 Go (38,13 Go free) [Data] # NTFS
          J:\ -> Disque fixe local # 37,57 Go (17,22 Go free) [Sauvegarde] # NTFS
          K:\ -> Disque amovible # 974,48 Mo (974,47 Mo free) # FAT32

          ############################## | Processus actifs |

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\WINDOWS\Explorer.EXE
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\Java\jre6\bin\jusched.exe
          C:\Windows\LSD\LClock\lclock.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\Program Files\SuperCopier2\SuperCopier2.exe
          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\WINDOWS\System32\alg.exe
          C:\Program Files\Windows Live\Contacts\wlcomm.exe
          C:\Program Files\uTorrent\uTorrent.exe
          C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe

          ################## | Fichiers # Dossiers infectieux |

          C:\WINDOWS\s.txt

          ################## | Registre # Clés Run infectieuses |

          [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
          [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
          [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

          ################## | Registre # Mountpoints2 |

          ################## | Suspect | https://www.virustotal.com/gui/ |

          ################## | Cracks / Keygens / Serials |

          "C:\Documents and Settings\Administrateur\Mes documents\Mes fichiers re‡us\mIRC_v6.12_keygen.exe"
          15/03/2005 21:44 |Size 13312 |Crc32 2b76a26b |Md5 d6252de66cf7dc81259afe36df5e6cb4

          "D:\Downloads\ADOBE Photoshop CS3 Extended FR\Keygens - Cracks\Photoshop.exe"
          02/08/2009 21:58 |Size 44814336 |Crc32 87941229 |Md5 8bbffd6536ef589fc2d2820f6e377abd

          "J:\MesDocs oct 2009\Mes fichiers re‡us\mIRC_v6.12_keygen.exe"
          15/03/2005 21:44 |Size 13312 |Crc32 2b76a26b |Md5 d6252de66cf7dc81259afe36df5e6cb4

          ################## | ! Fin du rapport # UsbFix V6.043 ! |
      2. jlpjlp Contributeur sécurité
        remets un rapport rsit
        1. pwet31
          Logfile of random's system information tool 1.06 (written by random/random)
          Run by Administrateur at 2009-10-21 16:23:53
          Microsoft Windows XP Professionnel Service Pack 3
          System drive C: has 30 GB (59%) free of 50 GB
          Total RAM: 3071 MB (72% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 16:24:02, on 21/10/2009
          Platform: Windows XP SP3 (WinNT 5.01.2600)
          MSIE: Internet Explorer v8.00 (8.00.6001.18702)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\WINDOWS\Explorer.EXE
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\Java\jre6\bin\jusched.exe
          C:\Windows\LSD\LClock\lclock.exe
          C:\Program Files\DAEMON Tools Lite\daemon.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\Program Files\SuperCopier2\SuperCopier2.exe
          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\WINDOWS\System32\alg.exe
          C:\Program Files\Windows Live\Contacts\wlcomm.exe
          C:\Program Files\uTorrent\uTorrent.exe
          C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
          C:\Program Files\Mozilla Firefox\firefox.exe
          J:\Buro\Appz\RSIT.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe
          C:\Program Files\trend micro\Administrateur.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://dt-updates.com/activate?query=DQ3o0IVRO0mrscpJB5J2%2fclHZwJrvYUaRD%2b1%2b8E1xiFGoiWUqYSnXQ8j2xetHwTuZdz8DU16kYIvCdg8oLqZIzdcCGuNzd35nvCCnfGm2mLFnv0a1PNTlq64zxxovn9nxuQxszRjTjS%2f%2bdI4iakKLrcuLk33lo3HpfyGWfKhyfNGk7vZKdNYn2tNXuvriJyRmUmArauHS4Lrsd6uL42zL%2b%2fsYuMpB7bxk1ptVYoQdGpZaENfk%2bba7OlM1hPcikCVmaUm7XS0KPXG5o%2f0Xcr9RVLclupgmj%2fKKY6E6sA00xc%3d
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
          O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll (file missing)
          O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
          O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [Universal Bus device] usb_drv.exe
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
          O4 - HKCU\..\Run: [LClock] C:\Windows\LSD\LClock\lclock.exe
          O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
          O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\S-1-5-18\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SYSTEM')
          O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - HKUS\.DEFAULT\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'Default user')
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
          O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      3. pwet31
        rapport otm

        All processes killed
        ========== PROCESSES ==========
        No active process named explorer.exe was found!
        ========== FILES ==========
        File/Folder c:\windows\usb_drv.exe not found.
        C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll NOT unregistered.
        C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll moved successfully.
        ========== REGISTRY ==========
        Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ deleted successfully.
        Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Universal Bus device not found.
        ========== COMMANDS ==========

        [EMPTYTEMP]

        User: Administrateur
        ->Temp folder emptied: 2285 bytes
        ->Temporary Internet Files folder emptied: 315001457 bytes
        ->Java cache emptied: 0 bytes
        ->FireFox cache emptied: 96501506 bytes

        User: All Users

        User: Default User
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 67 bytes

        User: LocalService
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 0 bytes

        User: NetworkService
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 33170 bytes

        %systemdrive% .tmp files removed: 0 bytes
        %systemroot% .tmp files removed: 2351795 bytes
        %systemroot%\System32 .tmp files removed: 3072 bytes
        File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
        File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_538.dat scheduled to be deleted on reboot.
        Windows Temp folder emptied: 32768 bytes
        RecycleBin emptied: 49775 bytes

        Total Files Cleaned = 394,80 mb

        OTM by OldTimer - Version 3.0.0.6 log created on 10212009_125918

        Files moved on Reboot...
        File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
        File C:\WINDOWS\temp\Perflib_Perfdata_538.dat not found!

        Registry entries deleted on Reboot...
        1. jlpjlp Contributeur sécurité
          ok il en reste une trace

          Télécharge OTM
          http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
          (de Old_Timer) sur ton Bureau.

          double-clique sur OTM.exe pour le lancer.
          copie la liste qui se trouve en citation ci-dessous,
          et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.

          :processes
          explorer.exe
          :files
          c:\windows\usb_drv.exe
          C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
          :reg
          [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
          "Universal Bus device"=-
          :commands
          [purity]
          [emptytemp]
          [start explorer]

          clique sur MoveIt! pour lancer la suppression.
          le résultat apparaitra dans le cadre "Results".
          clique sur Exit pour fermer.
          poste le rapport situé dans C:\_OTM\MovedFiles.

          il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

          _________________________

          pour virer ce qui a été utilisé lance tools cleaner

          ________________________
          pour bien vérifier le pc: colle un scan en ligne de chez panda ou kaspersky ou bitdefender

          http://www.bitdefender.com/scan_fr/scan8/ie.html
          1. pwet31
            Logfile of random's system information tool 1.06 (written by random/random)
            Run by Administrateur at 2009-10-21 12:35:39
            Microsoft Windows XP Professionnel Service Pack 3
            System drive C: has 29 GB (58%) free of 50 GB
            Total RAM: 3071 MB (67% free)

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 12:35:47, on 21/10/2009
            Platform: Windows XP SP3 (WinNT 5.01.2600)
            MSIE: Internet Explorer v8.00 (8.00.6001.18702)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\csrss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\Explorer.EXE
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Java\jre6\bin\jusched.exe
            C:\Windows\LSD\LClock\lclock.exe
            C:\Program Files\DAEMON Tools Lite\daemon.exe
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
            C:\Program Files\SuperCopier2\SuperCopier2.exe
            C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Bonjour\mDNSResponder.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Java\jre6\bin\jqs.exe
            C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\System32\alg.exe
            C:\Program Files\Windows Live\Contacts\wlcomm.exe
            C:\PROGRA~1\MICROS~1\Office12\OUTLOOK.EXE
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\Program Files\Windows Media Player\wmplayer.exe
            C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
            C:\WINDOWS\system32\wbem\wmiprvse.exe
            C:\Program Files\trend micro\Administrateur.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
            R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://dt-updates.com/activate?query=DQ3o0IVRO0mrscpJB5J2%2fclHZwJrvYUaRD%2b1%2b8E1xiFGoiWUqYSnXQ8j2xetHwTuZdz8DU16kYIvCdg8oLqZIzdcCGuNzd35nvCCnfGm2mLFnv0a1PNTlq64zxxovn9nxuQxszRjTjS%2f%2bdI4iakKLrcuLk33lo3HpfyGWfKhyfNGk7vZKdNYn2tNXuvriJyRmUmArauHS4Lrsd6uL42zL%2b%2fsYuMpB7bxk1ptVYoQdGpZaENfk%2bba7OlM1hPcikCVmaUm7XS0KPXG5o%2f0Xcr9RVLclupgmj%2fKKY6E6sA00xc%3d
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
            O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
            O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
            O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
            O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
            O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [Universal Bus device] usb_drv.exe
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
            O4 - HKCU\..\Run: [LClock] C:\Windows\LSD\LClock\lclock.exe
            O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
            O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
            O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - HKUS\.DEFAULT\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'Default user')
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
            O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
            O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
            O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
            1. jlpjlp Contributeur sécurité
              remet un rapport rsit pour voir

              _________

              bizarre que avast voit cette infection car sur virus total il n'est pas considéré comme infectieux ce fichier :

              Antivirus Version Dernière mise à jour Résultat
              a-squared 4.5.0.41 2009.10.20 -
              AhnLab-V3 5.0.0.2 2009.10.20 -
              AntiVir 7.9.1.35 2009.10.19 -
              Antiy-AVL 2.0.3.7 2009.10.20 -
              Authentium 5.1.2.4 2009.10.20 -
              Avast 4.8.1351.0 2009.10.19 -
              1. pwet31
                merci à tous pour votre aide

                le message ne s'affiche plus au démarrage (j'ai supprimé à la main le fichier douteux usb_driver.exe)
                1. pwet31
                  Merci bcp à tout ce qui m'ont aidé.

                  Le message ne s'affiche plus au démarrage (j'ai supprimé le fichier douteux usb_driver.exe à la main).
                  1. jlpjlp Contributeur sécurité
                    Télécharge OTM
                    http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
                    (de Old_Timer) sur ton Bureau.

                    double-clique sur OTM.exe pour le lancer.
                    copie la liste qui se trouve en citation ci-dessous,
                    et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.

                    :processes
                    explorer.exe
                    :files
                    c:\windows\usb_drv.exe
                    :commands
                    [purity]
                    [emptytemp]
                    [start explorer]

                    clique sur MoveIt! pour lancer la suppression.
                    le résultat apparaitra dans le cadre "Results".
                    clique sur Exit pour fermer.
                    poste le rapport situé dans C:\_OTM\MovedFiles.

                    il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
                    1. pwet31
                      Antivirus Version Dernière mise à jour Résultat
                      a-squared 4.5.0.41 2009.10.20 -
                      AhnLab-V3 5.0.0.2 2009.10.20 -
                      AntiVir 7.9.1.35 2009.10.19 -
                      Antiy-AVL 2.0.3.7 2009.10.20 -
                      Authentium 5.1.2.4 2009.10.20 -
                      Avast 4.8.1351.0 2009.10.19 -
                      AVG 8.5.0.420 2009.10.19 -
                      BitDefender 7.2 2009.10.20 -
                      CAT-QuickHeal 10.00 2009.10.18 -
                      ClamAV 0.94.1 2009.10.20 -
                      Comodo 2663 2009.10.20 -
                      DrWeb 5.0.0.12182 2009.10.20 -
                      eSafe 7.0.17.0 2009.10.19 -
                      eTrust-Vet 35.1.7075 2009.10.19 -
                      F-Prot 4.5.1.85 2009.10.20 -
                      F-Secure 9.0.15300.0 2009.10.20 -
                      Fortinet 3.120.0.0 2009.10.20 -
                      GData 19 2009.10.20 -
                      Ikarus T3.1.1.72.0 2009.10.20 -
                      Jiangmin 11.0.800 2009.10.20 -
                      K7AntiVirus 7.10.874 2009.10.19 -
                      Kaspersky 7.0.0.125 2009.10.20 -
                      McAfee 5776 2009.10.19 -
                      McAfee+Artemis 5776 2009.10.19 -
                      McAfee-GW-Edition 6.8.5 2009.10.20 Heuristic.BehavesLike.Win32.Backdoor.H
                      Microsoft 1.5101 2009.10.20 Trojan:Win32/Ircbrute
                      NOD32 4524 2009.10.20 -
                      Norman 6.03.02 2009.10.19 -
                      nProtect 2009.1.8.0 2009.10.19 -
                      Panda 10.0.2.2 2009.10.20 -
                      PCTools 4.4.2.0 2009.10.19 -
                      Prevx 3.0 2009.10.20 Medium Risk Malware
                      Rising 21.52.11.00 2009.10.20 -
                      Sophos 4.46.0 2009.10.20 -
                      Sunbelt 3.2.1858.2 2009.10.20 -
                      Symantec 1.4.4.12 2009.10.20 -
                      TheHacker 6.5.0.2.048 2009.10.20 -
                      TrendMicro 8.950.0.1094 2009.10.20 -
                      VBA32 3.12.10.11 2009.10.19 Trojan.Win32.Initcmd.jk
                      ViRobot 2009.10.20.1995 2009.10.20 -
                      VirusBuster 4.6.5.0 2009.10.19 -
                      Information additionnelle
                      File size: 101888 bytes
                      MD5 : f97ac890ddd0f2289868b4d21c4aa29f
                      SHA1 : 21a093d86c0e1d601c565a0ef1a062ffab5f8f97
                      SHA256: 52c1732fe17aec8666b64bdb3ab5b7bec3b100e1854d41c93c37f169087a3a56
                      PEInfo: PE Structure information

                      ( base data )
                      entrypointaddress.: 0x3065
                      timedatestamp.....: 0x4ACA3DC8 (Mon Oct 5 20:41:12 2009)
                      machinetype.......: 0x14C (Intel I386)

                      ( 4 sections )
                      name viradd virsiz rawdsiz ntrpy md5
                      .text 0x1000 0x25CA 0x2600 6.13 4574ed3aee0a6a990adeeecdd5b1cbc9
                      .rdata 0x4000 0xB30 0xC00 5.40 a29dc08c98d0f44f7f96d5472f9624ae
                      .data 0x5000 0x6DC 0x200 2.76 09671d3a2fcca41b9093648ff0f45b19
                      .rsrc 0x6000 0x155AC 0x15600 6.79 e9c43e3c88e6b1693c0f88036f883394

                      ( 4 imports )

                      > kernel32.dll: Sleep, GetLastError, OutputDebugStringA, GetTickCount, VirtualProtect, VirtualQuery, WideCharToMultiByte, GetSystemTimeAsFileTime, GetCurrentProcessId, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetStartupInfoA, InterlockedCompareExchange, InterlockedExchange, QueryPerformanceCounter, GetCurrentThreadId, IsDebuggerPresent
                      > msvcr90.dll: _except_handler4_common, _amsg_exit, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, _acmdln, malloc, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, _encode_pointer, __set_app_type, _crt_debugger_hook, _terminate@@YAXXZ, _unlock, __dllonexit, _lock, _onexit, _decode_pointer, _invoke_watson, _controlfp_s, free, wcsrchr, __3@YAXPAX@Z, strstr, memcpy, __2@YAPAXI@Z, strtok, exit, memset, _initterm, _stricmp
                      > user32.dll: MessageBoxA
                      > ws2_32.dll: -

                      ( 0 exports )

                      TrID : File type identification
                      Win32 Executable Generic (68.0%)
                      Generic Win/DOS Executable (15.9%)
                      DOS Executable Generic (15.9%)
                      Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
                      ssdeep: 1536:ZDfrz9fLI3eAqsgOIXkP6o1x4T+AO9NAU0F+6qxEyxN3mXNj22QF0HtaOM4EDq2:lZyeJrOIUP6o1EF+6kzN3ms2QEKR
                      Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=A9D5F9A600F8FA5D8E4D010D818E650023687AAE
                      PEiD : -
                      RDS : NSRL Reference Data Set
                      -
                      2. jlpjlp Contributeur sécurité
                        télécharge combofix (par sUBs) ici :

                        http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                        et enregistre le sur le bureau.

                        déconnecte toi d'internet et ferme toutes tes applications.

                        désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

                        double-clique sur combofix.exe et suis les instructions

                        à la fin, il va produire un rapport C:\ComboFix.txt

                        réactive ton parefeu, ton antivirus, la garde de ton antispyware

                        copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

                        Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

                        Tu as un tutoriel complet ici :

                        https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
                        1. pwet31
                          ComboFix 09-10-19.04 - Administrateur 20/10/2009 21:35.1.2 - NTFSx86
                          Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3071.2525 [GMT 2:00]
                          Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
                          .

                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                          .

                          c:\program files\pdfforge Toolbar\SeARchsettings.dll
                          c:\windows\logfile32.txt
                          c:\windows\system32\i
                          c:\windows\system32\Ms16.exe
                          c:\windows\system32\Ms17.exe
                          c:\windows\system32\msconfig.exe

                          .
                          ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-20 au 2009-10-20 ))))))))))))))))))))))))))))))))))))
                          .

                          2009-10-20 10:01 . 2009-10-20 14:36 -------- d-----w- C:\UsbFix
                          2009-10-19 10:24 . 2009-10-20 10:21 -------- d-----w- C:\ToolBar SD
                          2009-10-18 21:35 . 2009-10-18 21:35 -------- d-----w- c:\program files\CCleaner
                          2009-10-18 16:08 . 2009-10-18 16:08 -------- d-----w- c:\windows\Sun
                          2009-10-18 16:03 . 2009-10-18 16:03 411368 ----a-w- c:\windows\system32\deploytk.dll
                          2009-10-18 16:03 . 2009-10-18 16:03 -------- d-----w- c:\program files\Java
                          2009-10-18 14:48 . 2009-10-18 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
                          2009-10-18 14:48 . 2009-10-18 14:48 -------- d-----w- c:\program files\ACD Systems
                          2009-10-18 14:47 . 2009-10-18 14:47 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Downloaded Installations
                          2009-10-18 12:26 . 2009-10-18 12:47 -------- d-----w- c:\program files\MeuhMeuhTV
                          2009-10-18 10:18 . 2008-10-16 12:09 43544 ----a-w- c:\windows\system32\wups2.dll
                          2009-10-16 19:59 . 2009-10-19 09:49 -------- d-----w- C:\FindyKill
                          2009-10-16 19:13 . 2009-10-18 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
                          2009-10-16 19:13 . 2009-10-16 19:14 -------- d-----w- c:\program files\Spybot - Search & Destroy
                          2009-10-15 11:31 . 2009-10-15 23:19 9941024 --sha-w- c:\windows\system32\drivers\fidbox.dat
                          2009-10-15 11:23 . 2009-10-19 08:40 -------- d-----w- c:\program files\trend micro
                          2009-10-14 18:47 . 2009-10-16 20:15 -------- d-----w- c:\program files\Poker Tournament Manager Demo
                          2009-10-14 18:47 . 1998-06-17 13:00 89360 ----a-w- c:\windows\system32\VB5DB.DLL
                          2009-10-10 10:44 . 2009-10-10 10:44 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
                          2009-10-10 10:44 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                          2009-10-10 10:44 . 2009-10-10 10:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                          2009-10-10 10:44 . 2009-10-10 10:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
                          2009-10-10 10:44 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
                          2009-10-09 13:13 . 2009-10-09 13:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
                          2009-10-09 07:36 . 2009-10-09 09:15 -------- d-----w- c:\program files\Messenger Plus! Live
                          2009-10-08 22:54 . 2009-10-08 22:54 -------- d-----w- c:\documents and settings\Administrateur\Application Data\pdfforge
                          2009-10-08 22:02 . 2009-10-08 22:03 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Adobe
                          2009-10-08 22:00 . 2009-10-20 19:37 -------- d-----w- c:\program files\pdfforge Toolbar
                          2009-10-08 21:57 . 2009-10-08 21:57 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory
                          2009-10-08 21:57 . 2009-10-08 21:57 137 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
                          2009-10-08 21:57 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
                          2009-10-08 21:56 . 1998-07-13 00:08 119568 ----a-w- c:\windows\system32\VB6FR.DLL
                          2009-10-08 21:56 . 1998-07-13 00:08 59904 ----a-w- c:\windows\system32\MSCC2FR.DLL
                          2009-10-08 21:56 . 1998-07-13 00:08 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
                          2009-10-08 21:56 . 2009-10-08 22:02 -------- d-----w- c:\program files\PDFCreator
                          2009-10-08 21:56 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
                          2009-10-08 21:51 . 2009-10-08 21:52 -------- d-----w- c:\program files\Fichiers communs\Adobe
                          2009-10-08 21:13 . 2009-10-08 21:13 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\P5
                          2009-10-08 21:13 . 2009-10-15 21:28 -------- d-----w- C:\bwinPoker
                          2009-10-08 21:02 . 2009-10-08 21:02 101888 --sh--r- c:\windows\usb_drv.exe
                          2009-10-08 20:58 . 2009-10-08 20:58 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
                          2009-10-08 18:15 . 2009-10-18 18:06 -------- d-----w- c:\documents and settings\Administrateur\Application Data\FileZilla
                          2009-10-08 14:39 . 2009-10-08 14:39 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
                          2009-10-08 14:30 . 2009-10-08 14:30 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\CAPCOM
                          2009-10-08 14:25 . 2009-10-08 14:25 -------- d-----w- c:\program files\CAPCOM
                          2009-10-08 14:25 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
                          2009-10-08 14:25 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
                          2009-10-08 14:25 . 2009-03-16 12:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
                          2009-10-08 14:25 . 2009-03-16 12:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
                          2009-10-08 14:09 . 2009-10-08 14:09 -------- d-----w- c:\windows\system32\xlive
                          2009-10-08 14:09 . 2009-10-08 14:09 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
                          2009-10-08 13:41 . 2008-05-03 03:46 442368 ----a-w- c:\windows\system32\nvudisp.exe
                          2009-10-08 13:40 . 2008-04-30 15:27 442368 ----a-w- c:\windows\system32\NVUNINST.EXE
                          2009-10-08 13:40 . 2009-10-08 15:32 -------- d-----w- C:\NVIDIA
                          2009-10-08 13:21 . 2009-10-08 13:21 -------- d-----w- c:\program files\Driver Cleaner Pro
                          2009-10-08 10:03 . 2009-10-08 10:03 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ACD Systems
                          2009-10-06 16:55 . 2009-10-07 11:42 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
                          2009-10-06 12:21 . 2009-10-06 12:21 -------- d-----w- c:\program files\SuperCopier2
                          2009-10-06 12:21 . 2009-10-18 19:57 -------- d-----w- c:\program files\SpeedFan
                          2009-10-05 22:37 . 2009-10-05 22:37 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Media Player Classic
                          2009-10-05 15:03 . 2009-10-20 19:09 -------- d-----w- c:\documents and settings\Administrateur\Tracing
                          2009-10-05 15:01 . 2009-10-05 15:01 -------- d-----w- c:\program files\Microsoft
                          2009-10-05 15:00 . 2009-10-05 15:00 -------- d-----w- c:\program files\Windows Live SkyDrive
                          2009-10-05 15:00 . 2009-10-05 15:00 -------- d-----w- c:\program files\Windows Live

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2009-10-18 20:57 . 2009-10-05 14:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\uTorrent
                          2009-10-18 14:48 . 2009-10-05 13:58 -------- d-----w- c:\program files\Fichiers communs\ACD Systems
                          2009-10-16 20:06 . 2001-08-28 18:00 83924 ----a-w- c:\windows\system32\perfc00C.dat
                          2009-10-16 20:06 . 2001-08-28 18:00 507248 ----a-w- c:\windows\system32\perfh00C.dat
                          2009-10-15 23:19 . 2009-10-15 11:31 120704 --sha-w- c:\windows\system32\drivers\fidbox.idx
                          2009-10-08 15:18 . 2009-10-05 14:36 68464 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                          2009-10-08 14:14 . 2009-10-05 13:52 -------- d-----w- c:\program files\MSBuild
                          2009-10-08 14:13 . 2009-10-08 14:13 159480 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
                          2009-10-08 14:10 . 2009-10-08 14:10 -------- d-----w- c:\program files\Reference Assemblies
                          2009-10-07 23:29 . 2009-10-05 14:25 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
                          2009-10-05 14:57 . 2009-10-05 14:56 -------- d-----w- c:\program files\hp deskjet 930c series
                          2009-10-05 14:56 . 2009-10-05 14:56 -------- d-----w- c:\program files\Hewlett-Packard
                          2009-10-05 14:53 . 2009-10-05 14:53 -------- d-----w- c:\program files\Fichiers communs\Windows Live
                          2009-10-05 14:27 . 2009-10-05 14:27 -------- d-----w- c:\program files\K-Lite Codec Pack
                          2009-10-05 14:25 . 2009-10-05 14:25 -------- d-----w- c:\program files\uTorrent
                          2009-10-05 14:24 . 2009-10-05 14:24 -------- d-----w- c:\program files\Freeplayer
                          2009-10-05 14:13 . 2009-10-05 13:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
                          2009-10-05 14:00 . 2009-10-05 13:44 -------- d-----w- c:\program files\DAEMON Tools Lite
                          2009-10-05 13:58 . 2009-10-05 13:58 10368 ----a-w- c:\windows\system32\drivers\pfc.sys
                          2009-10-05 13:57 . 2009-10-05 13:57 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer
                          2009-10-05 13:57 . 2009-10-05 13:57 -------- d-----w- c:\program files\iTunes
                          2009-10-05 13:57 . 2009-10-05 13:57 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
                          2009-10-05 13:57 . 2009-10-05 13:57 -------- d-----w- c:\program files\iPod
                          2009-10-05 13:57 . 2009-10-05 13:55 -------- d-----w- c:\program files\Fichiers communs\Apple
                          2009-10-05 13:57 . 2009-10-05 13:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
                          2009-10-05 13:56 . 2009-10-05 13:56 -------- d-----w- c:\program files\Bonjour
                          2009-10-05 13:56 . 2009-10-05 13:56 -------- d-----w- c:\program files\QuickTime
                          2009-10-05 13:55 . 2009-10-05 13:55 -------- d-----w- c:\program files\Apple Software Update
                          2009-10-05 13:55 . 2009-10-05 13:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
                          2009-10-05 13:53 . 2009-10-05 13:38 -------- d--h--w- c:\program files\InstallShield Installation Information
                          2009-10-05 13:52 . 2009-10-05 13:52 -------- d-----w- c:\program files\Microsoft Works
                          2009-10-05 13:52 . 2009-10-05 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle
                          2009-10-05 13:51 . 2009-10-05 13:51 -------- d-----w- c:\program files\Microsoft.NET
                          2009-10-05 13:49 . 2009-10-05 13:49 -------- d-----w- c:\program files\MozBackup
                          2009-10-05 13:49 . 2009-10-05 13:49 -------- d-----w- c:\program files\Microsoft Visual Studio 8
                          2009-10-05 13:47 . 2009-10-05 13:34 -------- d-----w- c:\documents and settings\Administrateur\Application Data\DAEMON Tools Lite
                          2009-10-05 13:44 . 2009-10-05 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
                          2009-10-05 13:39 . 2009-10-05 13:39 -------- d-----w- c:\program files\Intel
                          2009-10-05 13:38 . 2009-10-05 13:38 -------- d-----w- c:\program files\Analog Devices
                          2009-10-05 13:38 . 2009-10-05 13:34 -------- d-----w- c:\program files\Fichiers communs\InstallShield
                          2009-10-05 13:36 . 2009-10-05 13:36 -------- d-----w- c:\program files\FileZilla FTP Client
                          2009-08-16 15:08 . 2009-10-05 14:27 178176 ----a-w- c:\windows\system32\unrar.dll
                          2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
                          .

                          ------- Sigcheck -------

                          [-] 2008-04-29 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

                          [-] 2008-06-04 . 4332A55A3B40A1B97AA124E6CD6E5420 . 2287104 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe

                          [-] 2008-06-04 . D1EA0A366973ECA3E03F1ACBEFDA8F43 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe

                          [-] 2008-04-28 . 1697B0EFD4E0FF0181F70CB73F04A518 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

                          [-] 2008-06-15 . 574412116E1B190B325C390A515C4E3E . 2165760 . . [5.1.2600.5512] . . c:\windows\system32\ntkrnlpa.exe

                          c:\windows\system32\wscntfy.exe ... manque !!
                          .
                          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                          REGEDIT4

                          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
                          2009-07-31 00:00 698880 ----a-w- c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                          "{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll" [2009-07-31 698880]

                          [HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "LClock"="c:\windows\LSD\LClock\lclock.exe" [2004-09-19 65536]
                          "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
                          "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
                          "SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
                          "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
                          "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
                          "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
                          "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
                          "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-12-12 196608]
                          "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
                          "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
                          "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
                          "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
                          "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-18 149280]
                          "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]
                          "Universal Bus device"="usb_drv.exe" - c:\windows\usb_drv.exe [2009-10-08 101888]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                          "nltide_2"="shell32" [X]
                          "WinLSD_SP3"="c:\windows\LSD\end.cmd" [2008-06-17 9944]
                          "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

                          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
                          "NoSMBalloonTip"= 0 (0x0)

                          [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
                          "NoSMHelp"= 1 (0x1)

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                          "EnableFirewall"= 0 (0x0)
                          "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                          "%windir%\\system32\\sessmgr.exe"=
                          "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
                          "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                          "c:\\Program Files\\iTunes\\iTunes.exe"=
                          "c:\\Program Files\\uTorrent\\uTorrent.exe"=
                          "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
                          "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                          "c:\\Program Files\\CAPCOM\\STREETFIGHTERIV\\StreetFighterIV.exe"=

                          R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [05/10/2009 15:35 114768]
                          R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05/10/2009 15:35 20560]
                          R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:\windows\system32\drivers\3xHybrid.sys [05/10/2009 15:56 1121536]

                          --- Autres Services/Pilotes en mémoire ---

                          *Deregistered* - mchInjDrv
                          .
                          .
                          ------- Examen supplémentaire -------
                          .
                          mWindow Title =
                          uInternet Connection Wizard,ShellNext = hxxp://dt-updates.com/activate?query=DQ3o0IVRO0mrscpJB5J2%2fclHZwJrvYUaRD%2b1%2b8E1xiFGoiWUqYSnXQ8j2xetHwTuZdz8DU16kYIvCdg8oLqZIzdcCGuNzd35nvCCnfGm2mLFnv0a1PNTlq64zxxovn9nxuQxszRjTjS%2f%2bdI4iakKLrcuLk33lo3HpfyGWfKhyfNGk7vZKdNYn2tNXuvriJyRmUmArauHS4Lrsd6uL42zL%2b%2fsYuMpB7bxk1ptVYoQdGpZaENfk%2bba7OlM1hPcikCVmaUm7XS0KPXG5o%2f0Xcr9RVLclupgmj%2fKKY6E6sA00xc%3d
                          uInternet Settings,ProxyOverride = *.local
                          IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
                          FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\jmzgulko.default\
                          FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
                          FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig
                          FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
                          FF - prefs.js: network.proxy.type - 4
                          .
                          - - - - ORPHELINS SUPPRIMES - - - -

                          WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
                          HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe

                          **************************************************************************

                          catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2009-10-20 21:38
                          Windows 5.1.2600 Service Pack 3 NTFS

                          Recherche de processus cachés ...

                          Recherche d'éléments en démarrage automatique cachés ...

                          Recherche de fichiers cachés ...

                          Scan terminé avec succès
                          Fichiers cachés: 0

                          **************************************************************************

                          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
                          "ImagePath"="\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp"
                          .
                          --------------------- CLES DE REGISTRE BLOQUEES ---------------------

                          [HKEY_USERS\S-1-5-21-789336058-583907252-842925246-500\SOFTWARE\Microsoft\Internet Explorer\User Preferences]
                          @Denied: (2) (Administrator)
                          "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
                          d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,40,88,0f,24,c8,ca,40,a4,d8,95,\
                          "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
                          d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,40,88,0f,24,c8,ca,40,a4,d8,95,\
                          .
                          --------------------- DLLs chargées dans les processus actifs ---------------------

                          - - - - - - - > 'lsass.exe'(744)
                          c:\windows\system32\scecli.dll
                          .
                          Heure de fin: 2009-10-20 21:39
                          ComboFix-quarantined-files.txt 2009-10-20 19:39

                          Avant-CF: 30 856 175 616 octets libres
                          Après-CF: 30 832 017 408 octets libres

                          WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
                          [boot loader]
                          timeout=2
                          default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
                          [operating systems]
                          c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                          multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

                          - - End Of File - - ABF864420E66BADB0DD6757EAC670FBF
                      3. pwet31
                        c'est fait.. tjrs le message d'avast au démarrage de windows.

                        voici le rapport usbfix

                        ############################## | UsbFix V6.042 |

                        User : Administrateur (Administrateurs) # PERSO
                        Update on 15/10/2009 by Chiquitine29, C_XX & Chimay8
                        Start at: 16:35:21 | 20/10/2009
                        Website : http://pagesperso-orange.fr/NosTools/index.html

                        Intel(R) Pentium(R) 4 CPU 3.20GHz
                        Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                        Internet Explorer 8.0.6001.18702
                        Windows Firewall Status : Disabled

                        A:\ -> Lecteur de disquettes 3 ½ pouces
                        C:\ -> Disque fixe local # 48,83 Go (28,27 Go free) [System] # NTFS
                        D:\ -> Disque fixe local # 141,08 Go (38,64 Go free) [Temp] # NTFS
                        E:\ -> Disque CD-ROM
                        F:\ -> Disque CD-ROM
                        G:\ -> Disque CD-ROM
                        H:\ -> Disque amovible # 955,73 Mo (129,09 Mo free) [JUL] # FAT
                        I:\ -> Disque fixe local # 195,31 Go (38,13 Go free) [Data] # NTFS
                        J:\ -> Disque fixe local # 37,57 Go (17,22 Go free) [Sauvegarde] # NTFS
                        K:\ -> Disque amovible # 974,48 Mo (974,47 Mo free) # FAT32

                        ############################## | Processus actifs |

                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\csrss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Alwil Software\Avast4\setup\avast.setup
                        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        C:\Program Files\Bonjour\mDNSResponder.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Java\jre6\bin\jqs.exe
                        C:\WINDOWS\system32\nvsvc32.exe
                        C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        C:\WINDOWS\system32\wbem\wmiprvse.exe
                        C:\WINDOWS\System32\alg.exe

                        ################## | Fichiers # Dossiers infectieux |

                        ################## | Registre # Clés Run infectieuses |

                        ################## | Registre # Mountpoints2 |

                        ################## | Listing des fichiers présent |

                        [05/10/2009 15:13|--a------|0] C:\AUTOEXEC.BAT
                        [05/10/2009 15:09|---hs----|212] C:\boot.ini
                        [28/08/2001 20:00|-rahs----|4952] C:\Bootfont.bin
                        [05/10/2009 15:13|--a------|0] C:\CONFIG.SYS
                        [19/10/2009 11:49|--a------|2147] C:\FindyKill.txt
                        [05/10/2009 15:13|-rahs----|0] C:\IO.SYS
                        [05/10/2009 15:13|-rahs----|0] C:\MSDOS.SYS
                        [13/04/2008 15:43|-rahs----|47564] C:\NTDETECT.COM
                        [13/04/2008 17:31|-rahs----|252240] C:\ntldr
                        [05/10/2009 15:23|--ahs----|2145386496] C:\pagefile.sys
                        [20/10/2009 12:21|--a------|2694] C:\TB.txt
                        [20/10/2009 16:36|--a------|2768] C:\UsbFix.txt
                        [25/12/2005 18:37|--a------|385648] D:\aswclnr.exe
                        [25/12/2005 18:52|--a------|962] D:\aswclnr.log
                        [29/09/2009 15:06|--a------|81282048] D:\backupOutlookrentree2008.pst
                        [15/03/2006 20:35|--a------|566784] D:\BF2AutoLoader.msi
                        [26/09/2006 12:36|--a------|220342] D:\bookmarks.html
                        [17/12/2005 00:37|--a------|18944] D:\Classeur1.xls
                        [30/03/2006 19:59|--a------|3824] D:\config.cfg
                        [09/01/2007 21:55|--a------|71676] D:\goats.jpg
                        [07/02/2006 22:01|--a------|3858] D:\h.cfg
                        [07/02/2006 00:53|--a------|3643] D:\hold.cfg
                        [07/02/2006 12:15|--a------|463] D:\server.cfg
                        [25/12/2005 18:40|--a------|536308] D:\SPNG2.2.397.exe
                        [30/04/2008 21:44|--a------|281] D:\System (C).lnk
                        [23/11/2006 19:03|--ahs----|5632] D:\Thumbs.db
                        [05/03/2006 16:42|--a------|83870743] D:\TRiiAD.-.HouZessioN.Vol.9.mp3
                        [07/02/2006 22:03|--a------|1244] D:\userconfig.cfg
                        [04/08/2009 23:52|--a------|285325] H:\bcn2009.JPG
                        [13/09/2009 18:14|--a------|3154944] H:\Soutenance_Stage_14-09-2009.ppt
                        [06/10/2007 15:44|---h-----|233472] H:\bsu.dat
                        [13/11/2007 20:49|---h-----|108336] H:\MSWINSCK.OCX
                        [13/09/2009 18:14|--a------|3154944] H:\Copie de Soutenance_Stage_14-09-2009.ppt
                        [23/12/2008 02:02|--a------|865] I:\iPodBackupLibrary_1.xml
                        [23/12/2008 02:02|--a------|1846] I:\iPodBackupLibrary_2.xml
                        [05/10/2009 12:18|--a------|46744576] J:\archive.pst
                        [05/10/2009 16:15|--a------|225526784] J:\backupOutlook_Oct2009.pst
                        [05/10/2009 12:18|--a------|227558400] J:\Outlook 16-10-2008.pst
                        [06/10/2009 00:36|--a------|62997504] J:\Outlook.pst

                        ################## | Vaccination |

                        # C:\autorun.inf -> Folder created by UsbFix.
                        # D:\autorun.inf -> Folder created by UsbFix.
                        # H:\autorun.inf -> Folder created by UsbFix.
                        # I:\autorun.inf -> Folder created by UsbFix.
                        # J:\autorun.inf -> Folder created by UsbFix.

                        ################## | Upload |

                        Veuillez envoyer le fichier : C:\DOCUME~1\ADMINI~1\Bureau\UsbFix_Upload_Me_PERSO.zip : https://www.androidworld.fr/
                        Merci pour votre contribution .

                        ################## | ! Fin du rapport # UsbFix V6.042 ! |
                        1. jlpjlp Contributeur sécurité
                          oui fais usbfix il va virer x.bat

                          (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

                          • Double clic sur le raccourci UsbFix présent sur ton bureau

                          • Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

                          • Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée]

                          • Ton bureau disparaitra et le pc redémarrera .

                          • Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

                          • Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

                          • Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

                          ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
                          1. pwet31
                            mais ça va virer le x.bat qu'avast me detecte au démarrage ??

                            mes clés usb n'étaient pas branché depuis un moment où j'ai eu ce virus detecté
                            • 1
                            • 2

                            Discussions similaires

                            Impossible de joindre Avast
                            soleil12

                            8 réponses
                            Livebox 4 Réseau Orange non détecté
                            Azfun

                            10 réponses
                            Livebox s'allume mais marque pas de réseau orange
                            Bebelle

                            9 réponses
                            Le pc charge le telephone mais n'ouvre pas ses fichiers
                            SayenDz

                            5 réponses
                            ecran non détécté par mon PC, ma tour
                            floeau

                            5 réponses