Virus I liebe you

Salut

J'ai lancé FIREFOX comme indiqué. Le rapport se trouve ci-dessous :

D:\yukongold.exe a variant of Win32/PrimeCasino application cleaned by deleting - quarantined

Salut NEMESIS,

Comme indiqué dans le lien, j'ai tenté de scanner on line avec Bitdefender mais en vain, la mise à jour des signatures virales échoue à chaque tentative et l'analyse n'a pu être effectuée. Que dois-je faire?

De toutes les façons, aucune trace du virus jusqu'à aujourd'hui. ReReReReReRe merci.

Salut,

Pas grave, tant que le virus ne réapparaît pas, on reste tranquille. A bientôt.

J'ai refait un RSIT dont voici le rapport :

Logfile of random's system information tool 1.06 (written by random/random)
Run by User at 2009-12-02 19:32:55
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 7 GB (21%) free of 34 GB
Total RAM: 1023 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:33:00, on 02/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\User\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\User.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ww12.cherche.us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [kubernscan] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [E09FXLRD_415031] "C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - https://benchmarks.ul.com?redirected=true
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F141915-CC39-40D8-A9BF-793EA4BFD039}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{466A185E-9B18-4A09-A7EB-0FBC1BB6C8E3}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Google Update (gupdate1c9bf591942390) (gupdate1c9bf591942390) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

Suite,

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - https://benchmarks.ul.com?redirected=true
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F141915-CC39-40D8-A9BF-793EA4BFD039}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{466A185E-9B18-4A09-A7EB-0FBC1BB6C8E3}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Google Update (gupdate1c9bf591942390) (gupdate1c9bf591942390) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

Salut,

J'ai relancé OTM comme indiqué. Ci-dessous le rapport :

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­­­n\Run not found.
========== COMMANDS ==========

OTM by OldTimer - Version 3.1.2.0 log created on 11262009_210022

Salut NEMESIS31

J'ai Lancé OTM et il me semble que kuberscan.vbe n'a pas été trouvé. J'ai vérifié dans l'explorateur windows et effectivement il n'y est pas. A bientôt. Ci-dessous le rapport OTM :

All processes killed
========== FILES ==========
File/Folder C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 329839 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: User
->Temp folder emptied: 831516 bytes
->Temporary Internet Files folder emptied: 4490489 bytes
->Java cache emptied: 11556 bytes
->FireFox cache emptied: 21986495 bytes
->Google Chrome cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1120835 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 49152 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 27,52 mb

OTM by OldTimer - Version 3.1.2.0 log created on 11252009_212530

Files moved on Reboot...
File C:\WINDOWS\temp\JET30EE.tmp not found!
File C:\WINDOWS\temp\Perflib_Perfdata_bc.dat not found!

Registry entries deleted on Reboot...

re,

bug sur CCM ! fais ce que j'ai écrit au-dessus :)

@Nemesis31Salut NEMESIS31

Bravo à toi, je pense que le virus anna a été éliminé. Mille merci.

J'ai passé Malwarebytes'Anti-Malware avec succès (il a tourné pendant plus 6 heures) mais je n'ai pas trouvé son logfile (rapport).

J'ai passé ensuite Toolcleaner, puis CCleaner, puis RSIT et enfin Hijackthis (because RSIT n'a pas pu le lancer).

Je t'envois ci-dessous les rapports : Toolcleaner, RSIT et Hijackthis.

Rapport Toolcleaner :
[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Documents and Settings\User\Bureau\ComboFix.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\User\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!

Corbeille vidée!
Fichiers temporaires nettoyés !
Sauvegarde du registre crée !

Rapport RSIT :
ogfile of random's system information tool 1.06 (written by random/random)
Run by User at 2009-11-21 13:54:45
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 7 GB (21%) free of 34 GB
Total RAM: 1023 MB (29% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-492894223-725345543-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-492894223-725345543-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-02-04 1082880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll [2009-11-02 378736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL [2009-11-02 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2007-10-22 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll [2009-11-01 762864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll [2008-03-20 757760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2007-10-22 2436160]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll [2008-03-20 757760]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll [2009-11-02 378736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [2006-04-26 237568]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"YMailAdvisor"=C:\Program Files\Yahoo!\Common\YMailAdvisor.exe [2008-06-05 125208]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]
"kubernscan"=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe []
"Corel Photo Downloader"=C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [2007-08-28 531272]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [2006-04-11 1409024]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-27 4670704]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-05-05 68856]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]
"Google Update"=C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-14 133104]
"E09FXLRD_415031"=C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE [2008-05-28 351000]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe [2005-06-23 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
C:\Program Files\Ares\Ares.exe -h []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe [2006-03-01 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [2007-08-28 531272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\System32\ctfmon.exe [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE [2007-03-01 180736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\System32\hkcmd.exe [2005-01-23 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\System32\igfxtray.exe [2005-01-23 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X Configure]
C:\WINDOWS\System32\JMRaidTool.exe [2006-07-12 352256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\System32\NvCpl.dll [2008-05-16 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\System32\NvMcTray.dll [2008-05-16 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar]
C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe /AtBootTime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [2003-12-08 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2009-02-04 23975720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2006-03-02 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2005-09-07 716800]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe [2005-05-20 925696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
C:\WINDOWS\system32\VTTimer.exe [2006-08-03 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
C:\WINDOWS\system32\VTtrayp.exe [2006-08-30 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^InterVideo WinCinema Manager.lnk]
C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE [2005-07-27 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2005-01-23 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 183808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=128
"NoDriveAutoRun"=128
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\InterVideo\DVD7\WinDVD.exe"="C:\Program Files\InterVideo\DVD7\WinDVD.exe:*:Enabled:WinDVD"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\RY's Games\empires2\empires2.exe"="C:\Program Files\RY's Games\empires2\empires2.exe:*:Enabled:Age of Empires II"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:Bluetooth Application"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-11-21 13:54:45 ----DC---- C:\rsit
2009-11-21 13:32:34 ----AC---- C:\TCleaner.txt
2009-11-17 23:02:26 ----DC---- C:\Documents and Settings\User\Application Data\Malwarebytes
2009-11-17 23:02:16 ----DC---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-11-17 23:02:15 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-11-14 17:11:43 ----AC---- C:\UsbFix 04.txt
2009-11-14 17:04:03 ----RASHDC---- C:\autorun.inf
2009-11-13 14:07:14 ----AC---- C:\UsbFix 03.txt
2009-11-12 20:51:45 ----AC---- C:\Boot.bak
2009-11-12 20:51:36 ----RASHDC---- C:\cmdcons
2009-11-12 20:38:19 ----A---- C:\WINDOWS\zip.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\SWSC.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\SWREG.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\sed.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\PEV.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\NIRCMD.exe
2009-11-12 20:38:19 ----A---- C:\WINDOWS\grep.exe
2009-11-12 20:38:08 ----D---- C:\WINDOWS\ERDNT
2009-11-05 22:53:25 ----AC---- C:\UsbFix 02.txt
2009-11-03 13:34:41 ----DC---- C:\Documents and Settings\All Users\Application Data\Symantec
2009-11-02 18:59:46 ----RA---- C:\WINDOWS\system32\GEARAspi.dll
2009-11-02 18:59:23 ----D---- C:\Program Files\Symantec
2009-11-02 18:59:23 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
2009-11-02 18:59:23 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL
2009-11-02 18:58:20 ----D---- C:\Program Files\Norton 360
2009-11-02 18:58:19 ----D---- C:\Program Files\Windows Sidebar
2009-11-02 18:58:18 ----DC---- C:\Documents and Settings\All Users\Application Data\Norton
2009-11-02 18:57:59 ----DC---- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2009-11-02 18:57:59 ----D---- C:\Program Files\NortonInstaller
2009-11-01 22:19:44 ----D---- C:\Program Files\Panda Security
2009-11-01 20:41:24 ----D---- C:\WINDOWS\avxoscan
2009-10-31 21:59:29 ----DC---- C:\Documents and Settings\User\Application Data\HouseCall 6.6
2009-10-31 21:59:27 ----D---- C:\WINDOWS\system32\HouseCall 6.6
2009-10-31 21:27:34 ----D---- C:\Program Files\Trend Micro
2009-10-31 20:21:41 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-10-30 21:14:50 ----D---- C:\Program Files\PhotoFiltre
2009-10-30 21:02:09 ----D---- C:\Program Files\xat.com JPEG Optimizer(2)
2009-10-27 23:47:38 ----D---- C:\Program Files\Keronsoft

======List of files/folders modified in the last 1 months======

2009-11-21 13:54:49 ----D---- C:\WINDOWS\Temp
2009-11-21 13:40:25 ----D---- C:\WINDOWS\Debug
2009-11-21 13:40:24 ----D---- C:\WINDOWS
2009-11-21 12:57:21 ----SD---- C:\WINDOWS\Tasks
2009-11-21 12:57:21 ----DC---- C:\Documents and Settings\All Users\Application Data\Google Updater
2009-11-21 00:16:58 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-11-18 19:43:13 ----RD---- C:\Program Files
2009-11-17 23:02:19 ----D---- C:\WINDOWS\system32\drivers
2009-11-14 23:36:24 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-14 19:28:48 ----HD---- C:\WINDOWS\inf
2009-11-14 19:14:51 ----HD---- C:\WINDOWS\$hf_mig$
2009-11-14 18:28:51 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-11-14 18:27:34 ----D---- C:\WINDOWS\system32
2009-11-14 17:39:41 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-11-14 17:39:41 ----D---- C:\WINDOWS\system32\CatRoot
2009-11-14 17:21:09 ----D---- C:\WINDOWS\Help
2009-11-14 17:03:36 ----SHD---- C:\RECYCLER
2009-11-12 21:17:28 ----AC---- C:\WINDOWS\system.ini
2009-11-12 21:14:15 ----D---- C:\WINDOWS\system32\config
2009-11-12 21:12:52 ----D---- C:\Program Files\Internet Explorer
2009-11-12 21:02:09 ----D---- C:\WINDOWS\AppPatch
2009-11-12 21:02:03 ----D---- C:\Program Files\Fichiers communs
2009-11-12 20:51:46 ----RASHC---- C:\boot.ini
2009-11-06 23:13:53 ----HD---- C:\Program Files\InstallShield Installation Information
2009-11-06 23:13:53 ----D---- C:\Program Files\CyberLink DVD Solution
2009-11-06 23:13:22 ----D---- C:\Program Files\MyPlayCity.com
2009-11-06 23:12:46 ----DC---- C:\games
2009-11-06 23:10:58 ----D---- C:\Program Files\RY's Games
2009-11-04 21:29:11 ----SHD---- C:\WINDOWS\Installer
2009-11-04 21:29:10 ----D---- C:\Program Files\Pando Networks
2009-11-04 21:28:57 ----DC---- C:\Config.Msi
2009-11-04 19:29:43 ----D---- C:\WINDOWS\Prefetch
2009-11-02 18:59:50 ----SHD---- C:\System Volume Information
2009-11-02 18:59:44 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-11-01 22:11:58 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-11-01 20:13:49 ----A---- C:\WINDOWS\NeroDigital.ini
2009-11-01 08:50:40 ----D---- C:\Program Files_
2009-11-01 08:50:38 ----DC---- C:\Adobe Creative suite 3 Master collection
2009-10-31 21:00:22 ----D---- C:\WINDOWS\system32\wbem
2009-10-31 21:00:21 ----D---- C:\WINDOWS\Registration
2009-10-31 20:59:03 ----D---- C:\Program Files\Windows NT
2009-10-31 20:58:54 ----D---- C:\WINDOWS\security
2009-10-31 20:18:16 ----D---- C:\WINDOWS\Cursors
2009-10-31 20:17:31 ----D---- C:\WINDOWS\system32\inetsrv
2009-10-24 23:07:05 ----AC---- C:\WINDOWS\ModemLog_U.S. Robotics 56K FAX EXT.txt
2009-10-24 19:48:18 ----D---- C:\EPCE

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; C:\WINDOWS\system32\drivers\N360\0305020.00B\BHDrvx86.sys [2009-11-02 259632]
R1 ccHP;Symantec Hash Provider; C:\WINDOWS\system32\drivers\N360\0305020.00B\ccHPx86.sys [2009-11-02 482432]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\eeCtrl.sys []
R1 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20091111.001\IDSxpx86.sys []
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-19 40320]
R1 SRTSP;Symantec Real Time Storage Protection; C:\WINDOWS\system32\drivers\N360\0305020.00B\SRTSP.SYS [2009-11-02 308272]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\WINDOWS\system32\drivers\N360\0305020.00B\SRTSPX.SYS [2009-11-02 43696]
R1 SYMTDI;Symantec Network Dispatch Driver; C:\WINDOWS\system32\drivers\N360\0305020.00B\SYMTDI.SYS [2009-11-02 217136]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-05-19 3965056]
R3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2005-05-31 20480]
R3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2005-04-30 10804]
R3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-04-30 11860]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-11-02 26600]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091120.050\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091120.050\NAVEX15.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-28 5888]
R3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\System32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;Symantec Network Filter Driver; C:\WINDOWS\system32\drivers\N360\0305020.00B\SYMFW.SYS [2009-11-02 89904]
R3 SYMIDS;Symantec Network Filter Driver; C:\WINDOWS\system32\drivers\N360\0305020.00B\SYMIDS.SYS [2009-11-02 33072]
R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-11-02 36400]
R3 SYMNDIS;Symantec Network Filter Driver; C:\WINDOWS\system32\drivers\N360\0305020.00B\SYMNDIS.SYS [2009-11-02 36400]
R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\System32\DRIVERS\torususb.sys [2005-12-28 683085]
R3 usbehci;Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
R3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2005-03-25 82148]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-19 14848]
S3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-05 141312]
S3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 127872]
S3 bdfdll;bdfdll; \??\C:\Program Files\Softwin\BitDefender9\bdfdll.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-05-31 23000]
S3 BthEnum;Pilote de bloc de demande Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-03 17024]
S3 BTHMODEM;Pilote de communications modem Bluetooth; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2004-08-03 38016]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992]
S3 BTHPORT;Pilote de port Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272768]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-03 18944]
S3 BTNetFilter;Bluetooth Network Filter; \??\C:\WINDOWS\system32\drivers\BTNetFilter.sys []
S3 CAM1690;USB 2.0 Compliance JPEG Video Camera Test Driver; C:\WINDOWS\System32\Drivers\cam1690.sys [2006-09-01 50944]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2003-12-12 784832]
S3 cpuz130;cpuz130; \??\C:\DOCUME~1\User\LOCALS~1\Temp\cpuz130\cpuz_x32.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\System32\DRIVERS\fetnd5bv.sys [2005-10-17 42496]
S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2007-08-24 101120]
S3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2005-01-23 804317]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-03-24 8704]
S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-03-24 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-03-24 127488]
S3 Nokia USB Port;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2006-03-24 13312]
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-03 59648]
S3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-11-02 36400]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 viagfx;viagfx; C:\WINDOWS\System32\DRIVERS\vtmini.sys [2006-08-31 264704]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-28 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BlueSoleil Hid Service;BlueSoleil Hid Service; C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe [2005-04-06 110592]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-19 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 N360;Norton 360; C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe [2009-11-02 117640]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]
R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2006-11-02 174656]
R3 ServiceLayer;ServiceLayer; C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe [2006-04-12 176640]
S2 gupdate1c9bf591942390;Service Google Update (gupdate1c9bf591942390); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-17 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-26 183280]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-03-25 72704]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2008-03-30 77944]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-19 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Rapport Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:06:48, on 21/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ww12.cherche.us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [kubernscan] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [E09FXLRD_415031] "C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - https://benchmarks.ul.com?redirected=true
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F141915-CC39-40D8-A9BF-793EA4BFD039}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{466A185E-9B18-4A09-A7EB-0FBC1BB6C8E3}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Google Update (gupdate1c9bf591942390) (gupdate1c9bf591942390) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

Salut,

Pour le moment, toujours pas de trace de ce satané virus, c'est tant mieux et je touche du bois.

Quand j'ai ouvert, sous IE, Outils - Options internet - onglet Général, je n'ai pas trouvé cherche.us dans Page de demarrage mais un lien vers une page de msn. D'ailleurs, depuis le dernier scan, mon IE demarre avec cette page au lieu de Page vierge, option que j'applique depuis longtemps.

J'ai fais quand même remplacer ce lien par celui de google.fr. Je te remercie pour tes efforts et, pour ma part, et à la moindre anomalie, je ne manquerai de t'en faire signe.

Bonne soirée.

Salut,
J'ai passé USBFIX (option suppression) et envoyé le rapport à l'adresse indiquée. J'ai passé ensuite RSIT. Je t'envois ci-dessous les deux rapports USBFIX et RSIT. Je ne voudrai pas crier victoire tout de suite, mais pour le moment le virus semble avoir disparu. Merci pour ton aide et ta patience.

Rapport USBFIX :
############################## | UsbFix V6.052 |

User : User (Administrateurs) # HOME
Update on 13/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 16:55:48 | 14/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) 4 CPU 3.06GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : Norton 360 3.5.2.11 [ Enabled | Updated ]
FW : Norton 360[ Enabled ]3.5.2.11

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 33,11 Go (6,94 Go free) # NTFS
D:\ -> Disque fixe local # 43,58 Go (6,92 Go free) [Data] # NTFS
E:\ -> Disque CD-ROM # 4,23 Go (0 Mo free) [MANCESTER] # CDFS
F:\ -> Disque CD-ROM
G:\ -> Disque amovible # 3,72 Go (2,66 Go free) # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 964
C:\WINDOWS\system32\csrss.exe 1012
C:\WINDOWS\system32\winlogon.exe 1036
C:\WINDOWS\system32\services.exe 1080
C:\WINDOWS\system32\lsass.exe 1092
C:\WINDOWS\system32\svchost.exe 1268
C:\WINDOWS\system32\svchost.exe 1312
C:\WINDOWS\System32\svchost.exe 1352
C:\WINDOWS\System32\svchost.exe 1476
C:\WINDOWS\system32\svchost.exe 1500
C:\WINDOWS\system32\logonui.exe 1588
C:\WINDOWS\system32\spoolsv.exe 1696
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe 1992
C:\WINDOWS\system32\svchost.exe 128
C:\Program Files\Google\Update\GoogleUpdate.exe 164
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe 160
C:\Program Files\Google\Update\GoogleUpdate.exe 256
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 296
C:\WINDOWS\Explorer.EXE 356
C:\Program Files\Java\jre6\bin\jqs.exe 368
C:\Program Files\Google\Update\GoogleUpdate.exe 404
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 436
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe 536
C:\WINDOWS\system32\nvsvc32.exe 596
C:\WINDOWS\system32\HPZipm12.exe 608
C:\WINDOWS\system32\PSIService.exe 644
C:\WINDOWS\System32\svchost.exe 724
C:\WINDOWS\System32\alg.exe 1664
C:\WINDOWS\system32\wscntfy.exe 1980
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe 2304
C:\WINDOWS\System32\wbem\wmiprvse.exe 2324

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\WINDOWS\kubernesis.dll.vbe
Supprimé ! C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\kubernscan.vbe
Supprimé ! C:\kubernesis.vbe
Supprimé ! D:\kubernesis.vbe
Supprimé ! G:\kubernesis.vbe

################## | Registre # Clés Run infectieuses |

Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "kubernesis.dll"
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Registre # Mountpoints2 |

################## | Listing des fichiers présent |

[02/11/2009 23:14|--a--c---|17018] C:\Ad-Report-CLEAN[1].log
[12/07/2009 15:44|--a--c---|0] C:\AILog.txt
[02/03/2009 22:09|--a--c---|1936360] C:\aresregular211_installer.exe
[05/02/2007 03:13|--a--c---|0] C:\AUTOEXEC.BAT
[31/08/2007 21:28|--a--c---|212] C:\Boot.bak
[12/11/2009 20:51|-rahsc---|282] C:\boot.ini
[28/08/2001 13:00|-rahsc---|4952] C:\Bootfont.bin
[03/11/2009 23:51|--a--c---|1944] C:\cleannavi.txt
[03/08/2004 23:00|--a--c---|263488] C:\cmldr
[12/11/2009 21:22|--a--c---|25740] C:\ComboFix.txt
[05/02/2007 03:13|--a--c---|0] C:\CONFIG.SYS
[03/02/2009 22:25|--a--c---|216] C:\DebugTrace-RockallDLL.log
[27/12/2007 22:52|--a--c---|305571] C:\dictionnaire_myspell_en_fran__ais__r__forme_1990_-1.6-fx+tb+sm.xpi
[04/02/2009 22:17|--a--c---|7055134] C:\directx_nov2007_redist.exe
[05/11/2008 20:54|--a--c---|0] C:\download.log
[14/03/2009 12:19|--a--c---|4179293] C:\everest_everest_2.20_francais_12281.exe
[20/02/2009 20:37|--a--c---|7620336] C:\Firefox Setup 3.0.6.exe
[05/02/2007 03:13|-rahsc---|0] C:\IO.SYS
[28/02/2009 21:45|--a--c---|3] C:\ks-urp-xhr-handler.php
[05/02/2007 03:13|-rahsc---|0] C:\MSDOS.SYS
[31/08/2007 21:19|-rahs----|47564] C:\NTDETECT.COM
[31/08/2007 21:19|-rahs----|251712] C:\ntldr
[?|?|?] C:\pagefile.sys
[07/05/2009 14:05|--a--c---|1489] C:\PlotandPublishLog.CSV
[29/07/2009 22:20|--a--c---|140408] C:\Super-Mario-World-(Unl)-[c][!].gs0
[03/11/2009 23:39|--a--c---|3936] C:\TB.txt
[05/11/2009 22:53|--a--c---|4182] C:\UsbFix 02.txt
[13/11/2009 14:07|--a--c---|3888] C:\UsbFix 03.txt
[14/11/2009 17:04|--a--c---|4704] C:\UsbFix.txt
[24/08/2008 21:04|--a--c---|127839] C:\VISA USA ds157fr.pdf
[04/09/2007 21:35|--a--c---|146] C:\YServer.txt
[01/01/2007 16:27|--a------|116730] D:\1-AberdeenMall-popup.jpg
[01/01/2007 16:26|--a------|110446] D:\1-CapeTownTerminal-popup.jpg
[23/04/2009 09:34|--a------|136047880] D:\182.50_geforce_winvista_64bit_international_whql.exe
[01/01/2007 16:26|--a------|128372] D:\2-MetripolitanHotel-popup.jpg
[05/11/2008 21:02|--a------|204] D:\20081105
[01/01/2007 16:26|--a------|97594] D:\4-Praha Airport-popup.jpg
[01/01/2007 16:25|--a------|122584] D:\5-KartodromiSchumacher-popup.jpg
[01/01/2007 16:25|--a------|63536] D:\6-JLennonMuseum-popup.jpg
[01/01/2007 16:25|--a------|112084] D:\7-LandRover-popup.jpg
[01/01/2007 16:24|--a------|76266] D:\8-ResidenzaPrivPilsen-popup.jpg
[09/05/2008 13:26|--a------|2643392] D:\age2upa-frn1.exe
[11/05/2007 00:11|--a------|0] D:\AILog.txt
[15/05/2009 13:18|--a------|3121664] D:\alex4_install.exe
[19/01/2007 18:15|--a------|49083656] D:\AoE2demo.exe
[12/04/2009 22:33|--a------|22] D:\aoe3-110-french_JeuxVideo.com_13108.zip
[22/06/2008 21:46|--a------|1226074] D:\aresregular193.exe
[24/06/2008 21:39|--a------|2018372] D:\aresregular209_installer.exe
[07/05/2009 10:16|--a------|289080] D:\AutodeskDesignRevSetup.exe
[12/12/2006 00:02|--a------|0] D:\AUTOEXEC.BAT
[09/04/2008 19:21|--a------|14544031] D:\Azteca.exe
[12/08/2007 12:08|-rahs----|211] D:\boot.ini
[28/08/2001 13:00|-rahs----|4952] D:\Bootfont.bin
[09/04/2008 19:30|--a------|4324863] D:\BubbleSnooker.exe
[03/04/2008 13:34|--a------|750505] D:\Caesar_PC_jeu_gratuit.zip
[08/05/2009 22:09|--a------|2771] D:\CARTE VISITE de ARADJ SAFIR.rtf
[08/05/2009 21:54|--a------|18545] D:\CARTE VISITE.docx
[11/05/2009 21:52|--a------|3227248] D:\ccsetup219.exe
[05/01/2007 22:10|--a------|67287] D:\CNIL.PDF
[01/01/2007 22:01|--a------|6899193] D:\cobra.zip
[12/12/2006 00:02|--a------|0] D:\CONFIG.SYS
[12/12/2006 16:49|--a------|32] D:\csb.log
[09/05/2008 22:43|--a------|8577048] D:\dap86.exe
[05/01/2007 22:06|--a------|373446] D:\Deroulement.PDF
[05/01/2007 22:09|--a------|786971] D:\Descriptives.pdf
[08/05/2009 22:06|--a------|3158085] D:\Docx2Rtf.zip
[05/01/2007 22:07|--a------|582413] D:\Donnees.pdf
[11/01/2007 00:14|--a------|5415774] D:\freeciv-1.14.0-win32-sound.exe
[05/05/2008 21:17|--a------|878856] D:\Google Updater.exe
[15/05/2009 13:10|--a------|4025856] D:\haroldshills_install.exe
[31/10/2009 21:27|--a------|812344] D:\HJTInstall.exe
[15/05/2009 11:41|--a------|4616192] D:\icytower13_install.exe
[17/04/2009 23:18|--a------|19418864] D:\ie8-setup-full.exe
[12/12/2006 00:02|-rahs----|0] D:\IO.SYS
[27/10/2009 23:13|--a------|14936193] D:\iPhoto_712.dmg
[31/12/2006 23:32|--a------|36808256] D:\iTunesSetup.exe
[01/01/2007 21:17|--a------|855597] D:\JPuzzles.exe
[28/11/2008 14:06|--a------|28494185] D:\Kriegspiel_Win_beta_v14.zip
[05/01/2007 22:06|--a------|190371] D:\Logiciels.pdf
[08/01/2007 22:10|--a------|24631975] D:\logomaker_fr_trial.exe
[01/01/2009 13:34|--a------|1132032] D:\MEILLEURS_VOEUX_POUR_ANNEE_2009.ppt
[04/07/2008 19:17|--a------|13122160] D:\MPSetup.exe
[12/12/2006 00:02|-rahs----|0] D:\MSDOS.SYS
[05/01/2007 22:10|--a------|220584] D:\Neurones.PDF
[28/08/2002 20:08|-rahs----|47580] D:\NTDETECT.COM
[29/08/2002 00:05|-rahs----|235824] D:\ntldr
[01/01/2006 01:11|--ahs----|704643072] D:\PAGEFILE.SYS
[30/04/2009 16:25|--a------|6687800] D:\PandoSetup.exe
[05/01/2007 22:08|--a------|905332] D:\Predictives.PDF
[05/01/2007 22:06|--a------|224828] D:\Presentation.PDF
[27/11/2008 21:19|--a------|5934255] D:\Risk_install_1.0.9.8.jar
[01/01/2007 16:24|--a------|97840] D:\rupertus-terme-popup.jpg
[31/12/2006 22:50|--a------|7101481] D:\SADDAM.mov
[05/01/2007 22:16|--a------|3031822] D:\setup_tanagra.exe
[15/05/2009 13:19|--a------|4755968] D:\smpe_install.exe
[19/01/2007 18:25|--a------|17372875] D:\stellarium-0.8.2.exe
[21/04/2008 18:04|--a------|292352] D:\STOPzilla_Setup.exe
[05/01/2007 22:10|--a------|284774] D:\Textmining.PDF
[26/07/2007 10:56|--ahs----|40448] D:\Thumbs.db
[13/07/2000 13:46|--a------|112] D:\vdebug.txt
[23/12/2008 21:19|--a------|2532838] D:\yahooqrguide.pdf
[11/04/2009 20:00|--a------|462800] D:\yukongold.exe
[15/05/2009 13:12|--a------|2679808] D:\zombiepox_install.exe
[16/05/2008 23:10|-r-------|882053354] E:\8MM.divx
[06/06/2007 11:25|-r-------|731994112] E:\Les Ailes De L'enfer (1997) De Simon West Avec Nicolas Cage, John Cusack, Monica Potter Et Landry.avi
[18/05/2007 12:52|-r-------|733933568] E:\Les.associ‚s_DVDRip_fr_[Ripped.by.Sel.2.mer.(2004)].VERSION.FR.par.eMule-Paradise.com.avi
[27/10/2006 13:06|-r-------|733720576] E:\Lord.of.War.FRENCH.DVDRip-HELLSING.avi
[08/02/2006 01:47|-r-------|726591488] E:\the weather man.avi
[27/04/2007 23:07|-r-------|732624896] E:\wintalkers.avi
[20/02/2007 11:26|-ra------|1598680] G:\Lilia M‚d‚a.JPG
[12/04/2009 10:17|--a------|238119] G:\img061.jpg
[12/04/2009 00:49|--a------|2863854] G:\Lilia M‚d‚a modŠle.bmp
[25/10/2008 18:57|--a------|4892382] G:\ELENA 01.jpg
[01/04/2002 09:57|--a------|155795] G:\img053.jpg
[17/03/2002 11:08|--a------|286620] G:\img047.jpg
[17/03/2002 11:28|--a------|241713] G:\img048.jpg
[12/04/2009 00:48|--a------|2541558] G:\Bd Tlemcen simul‚ Lilia.bmp
[01/04/2002 09:58|--a------|186247] G:\img054.jpg
[19/03/2009 10:15|--a------|43216] G:\LETTRE INVITATION MOHAMMED BRAHIM Mustapha.pdf
[17/02/2009 09:04|--a------|175908358] G:\video alger.avi
[20/03/2009 17:19|--a------|18579935] G:\Pr‚sentation ALGER - 210309 - 01.pptx
[12/04/2009 00:51|--a------|1155102] G:\Autoroute temouchent simul‚e Lilia.bmp
[12/04/2009 00:52|--a------|2359350] G:\Autoroute temouchent simul‚e Bailen.bmp
[21/03/2009 11:15|--a------|14392320] G:\Pr‚sentation Wilaya d'Alger du 22-03-09.ppt
[25/10/2008 19:00|--a------|4400454] G:\ELENA 02.jpg
[25/10/2008 19:02|--a------|4335583] G:\ELENA 03.jpg
[07/12/2008 12:41|--a------|83968] G:\rapport de visite Alger.doc
[09/03/2009 19:35|--a------|362496] G:\BEP EL BAYADH.VD.doc
[01/04/2002 09:59|--a------|156626] G:\img055.jpg
[25/04/2009 15:12|--a------|1173323] G:\DSC00791.JPG
[10/06/2008 18:26|--a------|398098] G:\10062008369.jpg
[10/06/2008 18:25|--a------|553665] G:\10062008367.jpg
[14/04/2009 21:21|--a------|217088] G:\C.V Brahmia nor eddine Mars 2009.doc
[12/09/1991 12:46|--a------|147584] G:\KLOTSKI.EXE
[25/04/2009 15:27|--a------|1290728] G:\DSC00828.JPG
[25/04/2009 15:39|--a------|1202900] G:\DSC00838.JPG
[05/04/2009 16:56|--a------|21504] G:\Note d'honoraires EGGR RELIZANE.doc
[22/05/2009 23:00|--a------|125952] G:\Le MCO en D1.xls
[05/04/2009 17:01|--a------|23040] G:\Dossier fournitures et autres d‚penses.xls
[18/07/2009 13:01|--a------|24576] G:\Note d'honoraires CNAT.doc
[05/04/2009 17:01|--a------|25600] G:\D‚penses.xls
[25/04/2009 15:21|--a------|1421369] G:\DSC00819.JPG
[01/07/2009 18:54|--a------|3238] G:\BOOTEX.LOG
[01/01/2050 00:00|--a------|84834] G:\_0504140439_001.pdf
[31/03/2009 15:59|--a------|11197446] G:\REALISATION FEUX ROUGE.dwg
[07/05/2009 13:58|--a------|34852] G:\Mus 01.XBC
[08/05/2009 19:17|--a------|35421] G:\Mus 02.XBC
[09/05/2009 10:17|--a------|28160] G:\Certificat de travail MELIANI.doc
[31/05/2009 16:05|--a------|81408] G:\DRIM secteur militaire Ain T‚mouchent.xls
[25/04/2009 15:09|---------|1200299] G:\DSC00783.JPG
[02/06/2009 16:30|--a------|27136] G:\LISTE ACTIONNAIRES POUR AGO 2008.xls
[25/04/2009 15:10|---------|1268882] G:\DSC00786.JPG
[03/06/2009 15:36|--a------|4440064] G:\Cahier de charge Feux tricolores.doc
[25/04/2009 15:11|---------|1267570] G:\DSC00787.JPG
[25/04/2009 15:15|---------|1127304] G:\DSC00803.JPG
[30/03/2009 16:34|--a------|71168] G:\Cahier de charge signalisation5 verticale.doc
[25/04/2009 15:21|---------|1354955] G:\DSC00818.JPG
[12/01/2008 16:31|--a------|303616] G:\Cahier de charge signalisation verticale.doc
[25/04/2009 15:21|---------|1465803] G:\DSC00820.JPG
[12/01/2008 17:26|--a------|4413952] G:\Cahier de charge signalisation verticale_Feux tricolor.doc
[25/04/2009 15:25|---------|1296363] G:\DSC00823.JPG
[30/03/2008 14:34|--a------|32256] G:\ENIP entretien ‚clairage sites ORAN et ARZEW.xls
[25/04/2009 15:25|---------|1203393] G:\DSC00824.JPG
[25/04/2009 15:26|---------|1272015] G:\DSC00827.JPG
[01/07/2009 11:17|--a------|313943] G:\Invitation IVAN DESSIN AXIMUM.jpg
[25/04/2009 15:40|---------|1187314] G:\DSC00839.JPG
[13/07/2002 14:53|--a------|41984] G:\Le Bordereau PU 138 LOGTS aadl.doc
[25/04/2009 15:43|---------|1445660] G:\DSC00851.JPG
[08/04/2009 11:48|---------|1398255] G:\DSC00720.JPG
[09/11/2009 14:08|--a------|69632] G:\Rapport compl‚mentaire assainissement EGGR safir.doc
[19/04/2009 16:18|---------|2471218] G:\DSC00765.JPG
[09/11/2009 16:03|--a------|52736] G:\DRIM 2RM branchements blocs unit‚ transport TLEMCEN modifi‚.xls
[25/04/2009 15:07|---------|1270327] G:\DSC00776.JPG
[14/09/2009 11:28|--a------|52224] G:\Etat EP secteurs urb bouamama mokrani grds arteres.doc
[25/04/2009 15:08|---------|1437135] G:\DSC00780.JPG
[01/10/2009 12:20|--a------|172544] G:\Salon SPS IPC DRIVES Nuremberg nov 24 26 2009.doc
[11/05/2009 18:06|--a------|28160] G:\EURL IRRIPLAINE.doc
[05/10/2002 09:26|--a------|344576] G:\cahier des charges DUC ORAN EP 226 LOT A MISSERGHINE.doc
[05/10/2009 22:33|--a------|345600] G:\Cahier des charges APC 31 Installation panneaux directionnels lumineux.doc
[06/10/2009 15:04|--a------|1698816] G:\FICHE TECHNIQUE PANNEAUX DIRECTIONNELS APC 31.doc
[19/10/2009 14:03|--a------|24064] G:\djamel carte prof.doc
[10/11/2009 09:52|--a------|44544] G:\DRIM 13 Unit‚ transport.xls
[19/10/2009 23:01|--a------|45568] G:\djamel carte prof 02.doc
[20/10/2009 00:18|--a------|5329284] G:\LUMIPRIX_1er_septembre_2009.pdf
[28/10/2009 21:45|--a------|156672] G:\Site kouadria com Appel d'offres Alg‚rie.doc
[28/10/2009 23:12|--a------|133632] G:\Abonnement … Algeriatenders com.doc
[28/10/2009 23:12|--a------|330240] G:\Appels d'offres Kouadria com.doc
[09/11/2009 16:03|--a------|37376] G:\Rencontre avec son Excellence Mohamed Ahmed Khaleefa AL Sawaidi.doc
[29/10/2009 08:41|--a------|115712] G:\Algeriatenders appels d'offres.xls
[02/11/2009 22:19|--a------|20480] G:\Coordonn‚es algeriatenders.doc
[05/11/2009 13:46|--a------|44032] G:\Diplomatie SUR TSA.doc

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.
# D:\autorun.inf -> Dossier créé par UsbFix.
# G:\autorun.inf -> Dossier créé par UsbFix.

################## | Suspect | https://www.virustotal.com/gui/ |

################## | Cracks / Keygens / Serials |

################## | Upload |

Veuillez envoyer le fichier : C:\DOCUME~1\User\Bureau\UsbFix_Upload_Me_HOME.zip : https://www.androidworld.fr/
Merci pour votre contribution .

Rapport RSIT :
Logfile of random's system information tool 1.06 (written by random/random)
Run by User at 2009-11-14 17:16:46
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 7 GB (21%) free of 34 GB
Total RAM: 1023 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:16:58, on 14/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\User\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\User.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ww12.cherche.us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [kubernscan] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [E09FXLRD_415031] "C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - https://benchmarks.ul.com?redirected=true
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F141915-CC39-40D8-A9BF-793EA4BFD039}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Google Update (gupdate1c9bf591942390) (gupdate1c9bf591942390) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

Salut,

Voici le rapport USBFIX :

############################## | UsbFix V6.052 |

User : User (Administrateurs) # HOME
Update on 13/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 14:00:59 | 13/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) 4 CPU 3.06GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : Norton 360 3.5.2.11 [ Enabled | Updated ]
FW : Norton 360[ Enabled ]3.5.2.11

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 33,11 Go (6,97 Go free) # NTFS
D:\ -> Disque fixe local # 43,58 Go (6,92 Go free) [Data] # NTFS
E:\ -> Disque CD-ROM # 4,23 Go (0 Mo free) [MANCESTER] # CDFS
F:\ -> Disque CD-ROM
G:\ -> Disque amovible # 3,72 Go (2,66 Go free) # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 964
C:\WINDOWS\system32\csrss.exe 1012
C:\WINDOWS\system32\winlogon.exe 1036
C:\WINDOWS\system32\services.exe 1080
C:\WINDOWS\system32\lsass.exe 1092
C:\WINDOWS\system32\svchost.exe 1272
C:\WINDOWS\system32\svchost.exe 1316
C:\WINDOWS\System32\svchost.exe 1356
C:\WINDOWS\System32\svchost.exe 1416
C:\WINDOWS\system32\svchost.exe 1504
C:\WINDOWS\system32\spoolsv.exe 1692
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe 1900
C:\WINDOWS\system32\svchost.exe 124
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe 280
C:\Program Files\Java\jre6\bin\jqs.exe 352
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 436
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe 480
C:\WINDOWS\Explorer.EXE 504
C:\WINDOWS\system32\nvsvc32.exe 544
C:\WINDOWS\system32\HPZipm12.exe 556
C:\WINDOWS\system32\PSIService.exe 584
C:\WINDOWS\System32\svchost.exe 708
C:\WINDOWS\system32\rundll32.exe 752
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE 760
C:\WINDOWS\system32\rundll32.exe 768
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe 776
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe 800
C:\WINDOWS\system32\RUNDLL32.EXE 1008
C:\Program Files\Java\jre6\bin\jusched.exe 112
C:\WINDOWS\System32\WScript.exe 1216
C:\WINDOWS\System32\WScript.exe 1280
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe 1384
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe 1488
C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE 1832
C:\WINDOWS\system32\ctfmon.exe 1828
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe 1824
C:\WINDOWS\System32\WScript.exe 2288
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe 2316
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe 2440
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe 2448
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe 2820
C:\WINDOWS\system32\wscntfy.exe 2924
C:\WINDOWS\System32\alg.exe 3120
C:\WINDOWS\System32\wbem\wmiprvse.exe 852

################## | Fichiers # Dossiers infectieux |

C:\WINDOWS\kubernesis.dll.vbe
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\kubernscan.vbe
C:\kubernesis.vbe
D:\kubernesis.vbe
G:\kubernesis.vbe

################## | Registre # Clés Run infectieuses |

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "kubernesis.dll"
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Registre # Mountpoints2 |

################## | Suspect | https://www.virustotal.com/gui/ |

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # UsbFix V6.052 ! |

Salut,

Ca ne fait rien, moi aussi j'étais occupé (longs déplacements).

J'ai appliqué lancé COMBOFIX puis RSIT comme tu m'as demandé. Je t'en envois les rapports ci-dessous. Je te signale cependant que l'inscription : anna I Liebe YOU est toujours là. Merci pour ton aide.

Rapport COMBOFIX :

ComboFix 09-11-13.02 - User 12/11/2009 20:53.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1023.512 [GMT 1:00]
Lancé depuis: c:\documents and settings\User\Bureau\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Bureau\EVEREST.Ultimate.Edition.v2.20.405.Multilingual.WinALL.Incl.Keygen-ViRiLiTY\Desktop_.ini
c:\program files\INSTALL.LOG
c:\program files\Internet Explorer\fxavx.ini
c:\program files\PandoBar
c:\program files\PandoBar\bar\1.bin\NPPANDBR.DLL
c:\program files\PandoBar\bar\1.bin\P4FFXTBR.JAR
c:\program files\PandoBar\bar\1.bin\P4FFXTBR.MANIFEST
c:\program files\PandoBar\bar\1.bin\P4HIGHIN.EXE
c:\program files\PandoBar\bar\1.bin\P4NTSTBR.JAR
c:\program files\PandoBar\bar\1.bin\P4NTSTBR.MANIFEST
c:\program files\PandoBar\bar\1.bin\P4PLUGIN.DLL
c:\program files\PandoBar\bar\Cache\006A20E2
c:\program files\PandoBar\bar\Cache\006A313D
c:\program files\PandoBar\bar\Cache\006A346A.bin
c:\program files\PandoBar\bar\Cache\006A434E.bin
c:\program files\PandoBar\bar\Cache\006A466B.bin
c:\program files\PandoBar\bar\Cache\006A4969.bin
c:\program files\PandoBar\bar\Cache\006A585D.bin
c:\program files\PandoBar\bar\Cache\006A5B99.bin
c:\program files\PandoBar\bar\Cache\006AFB63.bin
c:\program files\PandoBar\bar\Cache\files.ini
c:\program files\PandoBar\bar\History\search2
c:\program files\PandoBar\bar\Settings\prevcfg2.htm
c:\program files\PandoBar\SrchAstt\1.bin\P4SRCHAS.DLL
c:\windows\system32\setup.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-12 au 2009-11-12 ))))))))))))))))))))))))))))))))))))
.

2009-11-12 20:16 . 2009-11-02 17:58 165240 -c--a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2009-11-12 19:11 . 2009-11-10 02:24 84912 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\NAVENG.SYS
2009-11-12 19:11 . 2009-11-10 02:24 177520 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\NAVENG32.DLL
2009-11-12 19:11 . 2009-11-10 02:24 1647984 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\NAVEX32A.DLL
2009-11-12 19:11 . 2009-11-10 02:24 1323568 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\NAVEX15.SYS
2009-11-12 19:11 . 2009-11-10 02:24 371248 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\EECTRL.SYS
2009-11-12 19:11 . 2009-11-10 02:24 2747952 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\CCERASER.DLL
2009-11-12 19:11 . 2009-11-10 02:24 259440 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\ECMSVR32.DLL
2009-11-12 19:11 . 2009-11-10 02:24 102448 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091112.005\ERASER.SYS
2009-11-11 22:33 . 2009-10-28 22:37 343088 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSvix86.sys
2009-11-11 22:33 . 2009-10-28 22:37 329592 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys
2009-11-11 22:33 . 2009-10-28 22:37 811896 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\Scxpx86.dll
2009-11-11 22:33 . 2009-10-28 22:37 488312 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSxpx86.dll
2009-11-11 22:33 . 2009-10-28 22:37 466992 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSviA64.sys
2009-11-07 19:10 . 2009-11-12 20:17 5304 -csha-r- C:\kubernesis.vbe
2009-11-07 19:10 . 2009-11-12 20:17 5304 --sha-r- c:\windows\kubernesis.dll.vbe
2009-11-06 20:51 . 2009-10-28 22:37 343088 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSvix86.sys
2009-11-06 20:51 . 2009-10-28 22:37 329592 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSXpx86.sys
2009-11-06 20:51 . 2009-10-28 22:37 811896 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\Scxpx86.dll
2009-11-06 20:51 . 2009-10-28 22:37 488312 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSxpx86.dll
2009-11-06 20:51 . 2009-10-28 22:37 466992 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091105.001\IDSviA64.sys
2009-11-03 22:43 . 2009-11-03 22:52 -------- d-----w- c:\program files\Navilog1
2009-11-03 22:37 . 2009-11-03 22:39 -------- dc----w- C:\ToolBar SD
2009-11-03 12:34 . 2009-11-03 12:34 -------- dc----w- c:\documents and settings\All Users\Application Data\Symantec
2009-11-02 22:22 . 2009-11-07 14:34 -------- dc----w- C:\RSIT
2009-11-02 21:52 . 2009-11-02 22:14 -------- d-----w- c:\program files\Ad-Remover
2009-11-02 17:59 . 2009-11-02 17:58 554352 -c--a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2009-11-02 17:59 . 2009-11-02 17:59 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-11-02 17:59 . 2009-11-02 17:58 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2009-11-02 17:59 . 2009-11-02 17:59 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-11-02 17:59 . 2009-11-02 18:23 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-11-02 17:59 . 2009-11-02 17:59 -------- d-----w- c:\program files\Symantec
2009-11-02 17:59 . 2009-11-02 17:59 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-11-02 17:59 . 2009-11-02 17:59 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-02 17:59 . 2009-11-02 17:59 1291104 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-11-02 17:59 . 2009-11-02 17:59 136840 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-11-02 17:58 . 2009-11-02 17:58 771440 -c--a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-11-02 17:58 . 2009-11-02 17:58 -------- d-----w- c:\windows\system32\drivers\N360
2009-11-02 17:58 . 2009-11-02 17:58 -------- d-----w- c:\program files\Norton 360
2009-11-02 17:58 . 2009-11-02 17:58 -------- d-----w- c:\program files\Windows Sidebar
2009-11-02 17:58 . 2009-11-02 18:00 -------- dc----w- c:\documents and settings\All Users\Application Data\Norton
2009-11-02 17:57 . 2009-11-02 17:58 -------- dc----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-11-02 17:57 . 2009-11-02 17:57 -------- d-----w- c:\program files\NortonInstaller
2009-11-01 21:19 . 2009-11-06 22:14 -------- d-----w- c:\program files\Panda Security
2009-11-01 19:41 . 2009-11-01 19:46 -------- d-----w- c:\windows\avxoscan
2009-11-01 07:41 . 2009-11-07 13:41 -------- dc----w- C:\UsbFix
2009-10-31 21:12 . 2008-03-30 17:55 1213784 -c--a-w- c:\documents and settings\User\Application Data\HouseCall 6.6\vsapi32.dll
2009-10-31 21:12 . 2006-11-22 16:48 91744 -c--a-w- c:\documents and settings\User\Application Data\HouseCall 6.6\BPMNT.dll
2009-10-31 21:10 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-10-31 21:10 . 2007-12-24 16:37 138384 -c--a-w- c:\documents and settings\User\Application Data\HouseCall 6.6\tmcomm.sys
2009-10-31 21:10 . 2006-07-07 15:29 1197584 -c--a-w- c:\documents and settings\User\Application Data\HouseCall 6.6\ssapi32.dll
2009-10-31 21:09 . 2009-03-27 16:38 366344 -c--a-w- c:\documents and settings\User\Application Data\HouseCall 6.6\tsc.exe
2009-10-31 20:59 . 2009-11-03 21:42 -------- dc----w- c:\documents and settings\User\Application Data\HouseCall 6.6
2009-10-31 20:59 . 2009-10-31 20:59 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-10-31 20:27 . 2009-10-31 20:27 -------- d-----w- c:\program files\Trend Micro
2009-10-31 20:00 . 2009-10-31 20:00 -------- d-----w- c:\windows\system32\wbem\Repository
2009-10-30 20:14 . 2009-10-31 19:59 -------- d-----w- c:\program files\PhotoFiltre
2009-10-30 20:02 . 2009-10-31 19:59 -------- d-----w- c:\program files\xat.com JPEG Optimizer(2)
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091102.002\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091102.002\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091102.002\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091102.002\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091102.002\IDSviA64.sys
2009-10-27 22:47 . 2009-10-27 22:47 -------- d-----w- c:\program files\Keronsoft

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-11 22:27 . 2008-05-05 20:14 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-06 22:13 . 2006-10-04 16:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-06 22:13 . 2006-10-04 16:40 -------- d-----w- c:\program files\CyberLink DVD Solution
2009-11-06 22:13 . 2009-07-24 22:33 -------- d-----w- c:\program files\MyPlayCity.com
2009-11-06 22:10 . 2008-03-08 20:18 -------- d-----w- c:\program files\RY's Games
2009-11-04 20:29 . 2009-04-30 15:41 -------- d-----w- c:\program files\Pando Networks
2009-11-02 17:59 . 2009-11-02 17:59 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-11-02 17:59 . 2009-11-02 17:59 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-10-31 19:19 . 2001-08-28 12:00 85404 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-31 19:19 . 2001-08-28 12:00 513080 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-25 11:40 . 2007-09-10 20:46 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-21 22:17 . 2007-08-31 00:23 -------- d-----w- c:\program files\Java
2009-09-21 20:49 . 2009-09-21 20:49 152576 -c--a-w- c:\documents and settings\User\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-26 18:44 . 2008-06-02 19:13 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-08-24 13:07 . 2007-02-05 02:18 118112 -c--a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 . 2006-10-04 16:40 40960 -c--a-w- c:\program files\Uninstall_CDS.exe
2008-08-13 19:25 . 2008-03-27 21:57 88 --sh--r- c:\windows\system32\1C900E4A16.sys
2008-08-13 19:26 . 2008-03-27 21:57 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 1409024]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-27 4670704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-05 68856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-14 133104]
"E09FXLRD_415031"="c:\program files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" [2008-05-28 351000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"kubernesis.dll"="c:\windows\kubernesis.dll.vbe" [2009-11-12 5304]
"Corel Photo Downloader"="c:\program files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 531272]
"AdslTaskBar"="stmctrl.dll" - c:\windows\system32\stmctrl.dll [2005-09-22 151552]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-19 110592]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-16 1630208]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
kubernscan.vbe [2009-11-12 5304]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\RY's Games\\empires2\\empires2.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0305020.00B\SymEFA.sys [02/11/2009 18:59 310320]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [24/07/2007 18:53 11264]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0305020.00B\BHDrvx86.sys [02/11/2009 18:59 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0305020.00B\cchpx86.sys [02/11/2009 18:59 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091107.001\IDSXpx86.sys [11/11/2009 23:33 329592]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe [02/11/2009 18:59 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/11/2009 03:24 102448]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [19/08/2007 04:54 60255]
R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [19/08/2007 04:54 683085]
S2 gupdate1c9bf591942390;Service Google Update (gupdate1c9bf591942390);c:\program files\Google\Update\GoogleUpdate.exe [17/04/2009 13:35 133104]
S3 CAM1690;USB 2.0 Compliance JPEG Video Camera Test Driver;c:\windows\system32\drivers\cam1690.sys [01/09/2006 14:28 50944]
S3 cpuz130;cpuz130;\??\c:\docume~1\User\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\User\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-09-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]

2009-11-12 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-05 22:45]

2009-11-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-17 12:35]

2009-11-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-17 12:35]

2009-11-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-492894223-725345543-1003Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-14 20:44]

2009-11-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-492894223-725345543-1003UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-14 20:44]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
uSearchMigratedDefaultUrl = hxxp://www.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uWindow Title = // ;) anna I Liebe YOU ==> MILK@3|_!!!
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.cherche.us
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: chat-land.org
TCP: {1F141915-CC39-40D8-A9BF-793EA4BFD039} = 192.168.0.1
TCP: {466A185E-9B18-4A09-A7EB-0FBC1BB6C8E3} = 208.67.222.222 208.67.220.220
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\6ec61vqk.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT1392740&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://www.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPandBr.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{F4F10C1D-87C7-404A-B4B3-000000000000} - c:\progra~1\DAP\SBSearch.dll
URLSearchHooks-{06663B56-0D73-4f9f-BCC5-4AA941470AFD} - c:\program files\PandoBar\SrchAstt\1.bin\P4SRCHAS.DLL
Toolbar-SITEguard - (no file)
Notify-AtiExtEvent - (no file)
Notify-opnmklk - opnmklk.dll

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.5.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-117609710-492894223-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bd,6e,89,b8,b9,a1,44,d0,40,9a,f8,bd,22,dc,1b,79,05,c0,01,b7,20,a0,f1,
27,68,0d,ec,46,70,c1,b9,ea,49,ec,80,5d,a8,1b,54,13,fe,70,0b,52,bb,db,19,49,\
"??"=hex:b5,c1,15,1e,a4,23,a4,96,0d,b9,b3,39,f7,ba,ab,98

[HKEY_USERS\S-1-5-21-117609710-492894223-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:a1,23,e1,b6,40,5e,39,16,9b,39,f9,f0,4c,f0,03,71,70,c9,0d,e0,29,
d6,3c,87,56,d7,e6,8f,6c,d3,4a,1a,e9,34,08,2b,bc,04,d6,30,56,e9,63,48,23,85,\
"rkeysecu"=hex:86,eb,2d,c3,dd,2a,e8,74,6c,dd,eb,4e,6e,65,eb,c9
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2044)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_fre.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PSIService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
c:\windows\system32\rundll32.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\System32\WScript.exe
c:\program files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\windows\System32\WScript.exe
c:\progra~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\NORTON 360\ENGINE\3.5.2.11\cltLMH.exe
.
**************************************************************************
.
Heure de fin: 2009-11-12 21:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-12 20:21

Avant-CF: 7 603 523 584 octets libres
Après-CF: 7 495 147 520 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn

- - End Of File - - EFB39104A0F8DC7B2B696BE3D1206141

Rapport RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by User at 2009-11-12 21:25:50
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 7 GB (21%) free of 34 GB
Total RAM: 1023 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:26:00, on 12/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\User\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\User.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ww12.cherche.us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = // ;) anna I Liebe YOU ==> MILK@3|_!!!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [kubernesis.dll] C:\WINDOWS\kubernesis.dll.vbe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [kubernscan] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [E09FXLRD_415031] "C:\Program Files\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: kubernscan.vbe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - https://benchmarks.ul.com?redirected=true
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F141915-CC39-40D8-A9BF-793EA4BFD039}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Google Update (gupdate1c9bf591942390) (gupdate1c9bf591942390) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

Salut,

Je n'arrive toujours pas à supprimer Kubernscan.vbe. J'ai pourtant fermé toutes les fenêtres et me suis déconnecté, mais rien à faire.

Dois-je quand même lancer : OTM, puis COMBO puis RSIT?

Mon système n'a pas été mis à jour, c'est vrai, on verra ça après comme tu as dis. Et merci.

Mon pc est infecté par le virus I Liebe you, voici le rapport
############################## | UsbFix 7.037 | [Recherche]

Utilisateur: Mohamed.Benabdellah (Administrateur) # MRO_BENABDELLAH [ ]
Mis à jour le 10/01/2011 par El Desaparecido / C_XX
Lancé à 09:40:46 | 20/02/2012
Site Web: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 6.0.2900.5512

Pare-feu Windows: Désactivé /!\
RAM -> 503 Mo
C:\ (%systemdrive%) -> Disque fixe # 37 Go (19 Go libre(s) - 50%) [] # NTFS
D:\ -> CD-ROM
E:\ -> Disque amovible # 7 Go (2 Go libre(s) - 30%) [BENALI] # FAT32

################## | Éléments infectieux |

Présent! E:\u.lnk
Présent! E:\IDM+6.07+build+14+Inclus+Patch+32bits-64bits+++serial+&+patch+by+stratimes+forum+45+Dr+akkira.lnk
Présent! E:\New Folder.lnk
Présent! E:\Passwords.lnk
Présent! E:\Documents.lnk
Présent! E:\Pictures.lnk
Présent! E:\Music.lnk
Présent! E:\Video.lnk
Présent! E:\Nouveau dossierf.lnk
Présent! E:\Nouveau dossier (4bhgf).lnk
Présent! E:\Qibla Touch_by Dr Rabah.lnk
Présent! E:\Camera-Pro-v-1.1.5-by-imad.lnk
Présent! E:\Azan-Mobile_phones.lnk
Présent! E:\image mariage.lnk
Présent! E:\qpiano_by couissi-soft.lnk
Présent! E:\talking_ted-retail-Dan123456.lnk
Présent! E:\signed_razz35.lnk
Présent! E:\serv.lnk
Présent! E:\1dalila live cheraton.lnk
Présent! E:\Nouveau dossier.lnk
Présent! E:\themesU5.lnk
Présent! C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe
Présent! C:\WINDOWS\system32\com.run
Présent! C:\WINDOWS\system32\dp1.fne
Présent! C:\WINDOWS\system32\eAPI.fne
Présent! C:\WINDOWS\system32\internet.fne
Présent! C:\WINDOWS\system32\krnln.fnr
Présent! C:\WINDOWS\system32\og.dll
Présent! C:\WINDOWS\system32\og.edt
Présent! C:\WINDOWS\system32\shell.fne
Présent! C:\WINDOWS\system32\spec.fne
Présent! C:\WINDOWS\system32\ul.dll
Présent! C:\Documents and Settings\Mohamed.benabdellah\autorun.inf
Présent! C:\Documents and Settings\Mohamed.benabdellah\Documents.lnk
Présent! C:\Documents and Settings\Mohamed.benabdellah\Music.lnk
Présent! C:\Documents and Settings\Mohamed.benabdellah\New Folder.lnk
Présent! C:\Documents and Settings\Mohamed.benabdellah\Passwords.lnk
Présent! C:\Documents and Settings\Mohamed.benabdellah\Pictures.lnk
Présent! C:\Documents and Settings\Mohamed.benabdellah\Video.lnk
Présent! C:\WINDOWS\kubernesis.dll.vbe
Présent! C:\autorun.inf
Présent! C:\kubernesis.vbe
Présent! E:\autorun.inf
Présent! E:\kubernesis.vbe
Présent! E:\WindowsXP-KB2347290-x86-FRA.exe

################## | Registre |

Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|kubernesis.dll
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|kubernscan

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{1b6777fe-d054-11df-b5ec-00118518312d}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wiUurU.ExE

HKCU\.\.\.\.\Explorer\MountPoints2\{204b518a-8abc-11e0-b42e-00118518312d}
Shell\AutoRun\Command = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe
Shell\open\Command = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{24734f01-811c-11e0-b6d2-00118518312d}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-5-4-41-8004146120-3860873730-276445161-6550\djBKUINM.exe
Shell\explore\Command = \RECYCLER\S-5-4-41-8004146120-3860873730-276445161-6550\djBKUINM.exe
Shell\Open\Command = \RECYCLER\S-5-4-41-8004146120-3860873730-276445161-6550\djBKUINM.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{52ee529c-d440-11df-b5ef-00118518312d}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-5-4-41-8004146120-3860873730-276445161-6550\iZkFwaTN.exe
Shell\explore\Command = \RECYCLER\S-5-4-41-8004146120-3860873730-276445161-6550\iZkFwaTN.exe
Shell\Open\Command = \RECYCLER\S-5-4-41-8004146120-3860873730-276445161-6550\iZkFwaTN.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{60eb9c26-be6f-11e0-8aeb-00118518312d}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-6-3-10-2886377343-6050582456-363572075-1735\ioDrBIVQ.exe
Shell\explore\Command = \RECYCLER\S-6-3-10-2886377343-6050582456-363572075-1735\ioDrBIVQ.exe
Shell\Open\Command = \RECYCLER\S-6-3-10-2886377343-6050582456-363572075-1735\ioDrBIVQ.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{ee161b3d-8441-11e0-b6d5-00118518312d}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe kubernesis.vbe

################## | Vaccin |

C:\Autorun.inf -> Dossier créé par Panda USB Vaccine
E:\Autorun.inf -> Dossier créé par Panda USB Vaccine

################## | E.O.F |