Virus en pagaille - à l'aide !! :)

salut afideg

finalement j'ai refait des scans
et plus un seul virus "à priori"
je te remercie pour ta patience et ton efficacité
big merci
a un de ses jours peut être

bye bye

Fabien976

salut

Ok afideg je fais ça et je poste le rapport

a+++

Salut afideg,

impossible d'installer antivir !!
alors je laisse antivir de côté, je me suis assez pris la tête avec lollll

je te remercie beaucoup pour ton aide, mais j'ai encore des virus détectés malgré toutes les étapes, je n'arrive pas a m'en débarrasser !!

je sais que c'est long !!

mais que faire !!

merci encore

a++++

kaspersky ne veut rien savoir il me demande de supprimer avast même s'il la protection résidente est arrêtée, que faire ??

Bonne nuit à toi
a++

'lu AL.
MP.
Bizz

c'est reparti !!!!
a tout

Re afideg voici ce que tu m’as demandé :

-----------------------------------------------------------------------------------------------------------------
Rapport clean :

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 07/07/2007 a 16:06:07,04

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
-----------------------------------------------------------------------------------------------------------------
Rapport sdfix :

SDFix: Version 1.90

Run by TitouTitou on 07/07/2007 at 16:14

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

Checking C:\WINDOWS
C:\WINDOWS
No streams found.

Checking C:\WINDOWS\system32
C:\WINDOWS\system32
No streams found.

Checking C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Checking C:\WINDOWS\system32\ntoskrnl.exe
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------
Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------
Files with Hidden Attributes:

C:\Documents and Settings\TitouTitou\Application Data\Microsoft\Word\~WRL0003.tmp

Finished
-----------------------------------------------------------------------------------------------------------------
Rapport kaspersky :

J’ai fait toutes les étapes nécessaire mais au bout d’un moment on me demande de supprimer avast pour faire le scan kaspersky

Kaspersky est valable 1 mois, avast 14 mois par 14 mois

Que faire ?? J'attends ton avis sur la question lolll
-----------------------------------------------------------------------------------------------------------------

Pour la question que tu me poses sur la ligne ci dessous je n’explique rien du tout, je ne sais pas du tout à quoi sa correspond désolé lolll

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;*windowsupdate.microsoft.com;*windowsupdate.com;download.microsoft.com;codecs.microsoft.com; ............................ ; id.orange.fr .

----------------------------------------------------------------------------------------------------------------
De plus :

Tu dis : Je doute de ta protection PC à partir de ce système Wanadoo.
Tu sais je n’ai protéger mon ordi qu’avec avast et rien d’autre. Alors question de protection je suis loin d’imaginer ce que je peux faire. Si tu as une protection maximale, pas de probléme, donne mi le tuyau lol

Dis moi ce que tu penses de tout ça
Merci pour ta patience et ta persévérance (et bien sur pour ton aide !!!)

A+++

Bonjour afideg,

Voici le rapport de AVG :
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 16:49:50 06/07/2007

+ Résultat de l'analyse:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Erreur lors du nettoyage.
HKU\S-1-5-21-1960408961-117609710-725345543-1004\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Nettoyé.
C:\RECYCLER\S-1-5-21-1960408961-117609710-725345543-1004\Dc5\MSNFix\04072007_18120525.zip/backup/myalbum2007.zip/photo album-2007.scr -> Backdoor.IRCBot.acd : Nettoyé.
D:\Téléchargement internet\Traque Anti virus\MSNFix\MSNFix\04072007_18120525.zip/backup/myalbum2007.zip/photo album-2007.scr -> Backdoor.IRCBot.acd : Nettoyé.
C:\Documents and Settings\TitouTitou\Local Settings\Temporary Internet Files\Content.IE5\NZWBERVB\addy[1].exe/ghost.exe -> Downloader.IstBar : Nettoyé.
C:\Program Files\Fichiers communs\System\Mapi\1036\NT\swwagb.exe/ghost.exe -> Downloader.IstBar : Nettoyé.
D:\System Volume Information\_restore{6FBBB220-3841-44FC-A143-A59C65D94A8E}\RP391\A0582494.exe -> Trojan.Small.edz : Nettoyé.
C:\Documents and Settings\TitouTitou\Local Settings\Temporary Internet Files\Content.IE5\NZWBERVB\addy[1].exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\Documents and Settings\TitouTitou\fpjzcf.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\Documents and Settings\TitouTitou\gptszn.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\Documents and Settings\TitouTitou\hhmcos.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\Documents and Settings\TitouTitou\mhfwzc.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\Program Files\Fichiers communs\System\Mapi\1036\NT\swwagb.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\System Volume Information\_restore{8E9B0C97-300C-43A9-9A32-E99040B0E550}\RP33\A0011182.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\System Volume Information\_restore{8E9B0C97-300C-43A9-9A32-E99040B0E550}\RP33\A0011183.exe/install.exe -> Trojan.VB.aqc : Nettoyé.
C:\System Volume Information\_restore{8E9B0C97-300C-43A9-9A32-E99040B0E550}\RP36\A0011315.exe -> Trojan.VB.aqc : Nettoyé.
C:\install\install.exe -> Trojan.VB.aqc : Nettoyé.

Fin du rapport

Et j’en ai refait un scan et il est vierge de chez vierge par un truc de trouvé !!

-------------------------------------------------------------------------------

Pour OTMoveIt.exe :

C:\Documents and Settings\TitouTitou\heijsg.exe
C:\Documents and Settings\TitouTitou\pxwqvk.exe
C:\Documents and Settings\TitouTitou\qfyjar.exe

Je ne trouve plus les fichier ils ont été détruit !!! logiquement c’est bon, non ?

----------------------------------------------------------------------------------
Voici le rapport de virus total :

Complete scanning result of "slrundll.exe", received in VirusTotal at 07.06.2007, 22:13:07 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.7.7.0 07.06.2007 no virus found
AntiVir 7.4.0.39 07.06.2007 no virus found
Authentium 4.93.8 07.06.2007 no virus found
Avast 4.7.997.0 07.06.2007 no virus found
AVG 7.5.0.476 07.06.2007 no virus found
BitDefender 7.2 07.06.2007 no virus found
CAT-QuickHeal 9.00 07.06.2007 no virus found
ClamAV devel-20070416 07.06.2007 no virus found
DrWeb 4.33 07.06.2007 no virus found
eSafe 7.0.15.0 07.06.2007 no virus found
eTrust-Vet 30.8.3767 07.06.2007 no virus found
Ewido 4.0 07.06.2007 no virus found
FileAdvisor 1 07.06.2007 no virus found
Fortinet 2.91.0.0 07.06.2007 no virus found
F-Prot 4.3.2.48 07.06.2007 no virus found
F-Secure 6.70.13260.0 07.06.2007 no virus found
Ikarus T3.1.1.8 07.06.2007 no virus found
Kaspersky 4.0.2.24 07.06.2007 no virus found
McAfee 5069 07.06.2007 no virus found
Microsoft 1.2704 07.06.2007 no virus found
NOD32v2 2383 07.06.2007 no virus found
Norman 5.80.02 07.06.2007 no virus found
Panda 9.0.0.4 07.06.2007 no virus found
Sophos 4.19.0 07.06.2007 no virus found
Sunbelt 2.2.907.0 07.06.2007 no virus found
Symantec 10 07.06.2007 no virus found
TheHacker 6.1.6.143 07.05.2007 no virus found
VBA32 3.12.0.2 07.06.2007 no virus found
VirusBuster 4.3.23:9 07.06.2007 no virus found
Webwasher-Gateway 6.0.1 07.06.2007 no virus found
Aditional Information
File size: 24576 bytes
MD5: 7ee7bb26389c988581289837536c2337
SHA1: 8fa87c757cf00fc9a604c4940b29d62f61a0ec25
VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

---------------------------------------------------------------------------------------

Voici le rapport de combofix :

"TitouTitou" - 2007-07-07 0:25:01 - ComboFix 07-07-06 - Service Pack 1 [SAFE MODE]

/wow section - STAGE #3

((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 )))))))))))))))))))))))))))))))

2007-07-06 17:34 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-05 17:19 <REP> d-------- C:\Program Files\Kerio
2007-07-05 15:46 524,288 --ah----- C:\DOCUME~1\ADMINI~1.000\NTUSER.DAT
2007-07-05 15:46 <REP> dr------- C:\DOCUME~1\ADMINI~1.000\Menu D‚marrer
2007-07-05 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1.000\Voisinage r‚seau
2007-07-05 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1.000\Voisinage d'impression
2007-07-05 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1.000\ModŠles
2007-07-05 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1.000\Mes documents
2007-07-05 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1.000\Favoris
2007-07-05 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1.000\Bureau
2007-07-04 22:01 <REP> d-------- C:\DOCUME~1\TITOUT~1\DoctorWeb
2007-07-04 15:53 <REP> d-------- C:\VundoFix Backups
2007-07-03 03:42 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-02 19:04 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-07-02 12:38 <REP> d-------- C:\install
2007-06-25 17:12 262,144 --ah----- C:\DOCUME~1\ADMINI~1.TIT\NTUSER.DAT
2007-06-25 17:12 <REP> dr------- C:\DOCUME~1\ADMINI~1.TIT\Menu D‚marrer
2007-06-25 17:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1.TIT\Voisinage r‚seau
2007-06-25 17:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1.TIT\Voisinage d'impression
2007-06-25 17:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1.TIT\ModŠles
2007-06-25 17:12 <REP> d-------- C:\DOCUME~1\ADMINI~1.TIT\Mes documents
2007-06-25 17:12 <REP> d-------- C:\DOCUME~1\ADMINI~1.TIT\Favoris
2007-06-25 17:12 <REP> d-------- C:\DOCUME~1\ADMINI~1.TIT\Bureau
2007-06-25 17:09 <REP> d-------- C:\Program Files\WinAVI MP4 Converter
2007-06-25 15:46 262,144 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-25 15:46 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2007-06-25 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2007-06-25 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2007-06-25 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2007-06-25 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1\Mes documents
2007-06-25 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1\Favoris
2007-06-25 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2007-06-23 12:10 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-06-23 12:10 14,976 --a------ C:\WINDOWS\system32\drivers\SBKUPNT.SYS
2007-06-23 12:10 13,312 --a------ C:\WINDOWS\system32\DEVLOAD.EXE
2007-06-23 11:42 <REP> d-------- C:\Program Files\windirstat
2007-06-23 11:24 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2007-06-21 12:18 <REP> d-------- C:\DOCUME~1\TITOUT~1\APPLIC~1\MapInfo
2007-06-14 19:28 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-06-14 19:28 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-06-14 19:28 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2007-06-14 19:28 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2007-06-14 19:28 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2007-06-14 19:28 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2007-06-14 19:28 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2007-06-14 19:28 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-02 14:27:35 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-06-25 12:26:53 -------- d-----w C:\Program Files\SuperCopier2
2007-06-23 08:23:32 -------- d--h--w C:\Program Files\WindowsUpdate
2007-06-06 06:34:04 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\dvdcss
2007-06-02 16:55:50 -------- d-----w C:\Program Files\REAPER
2007-06-02 16:55:23 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\REAPER
2007-06-02 09:00:09 -------- d-----w C:\Program Files\4Musics Multiformat Converter
2007-06-02 08:48:44 -------- d-----w C:\Program Files\Free Audio Pack
2007-05-29 13:51:43 -------- d-----w C:\Program Files\DivX
2007-05-25 15:58:59 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-25 15:58:59 -------- d-----w C:\Program Files\Micro Application
2007-05-24 18:17:44 -------- d-----w C:\Program Files\MV
2007-05-24 17:39:16 -------- d-----w C:\Program Files\MV_Partner
2007-05-20 11:37:11 2,940 ----a-w C:\WINDOWS\mozver.dat
2007-05-19 17:14:01 -------- d-----w C:\Program Files\Audacity
2007-05-19 12:30:47 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\vlc
2007-05-19 12:06:51 -------- d-----w C:\Program Files\DVD Decrypter
2007-05-19 10:37:48 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\InterTrust
2007-05-19 09:08:30 -------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-05-19 09:08:27 -------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-05-19 08:01:04 0 ----a-w C:\WINDOWS\nsreg.dat
2007-05-19 07:47:45 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\Help
2007-05-19 07:46:02 -------- d-----w C:\Program Files\Ahead
2007-05-19 07:43:12 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\Microsoft Web Folders
2007-05-19 07:43:08 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-19 07:41:14 48,616 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-05-19 07:41:14 367,658 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-05-19 07:40:06 -------- d-----w C:\Program Files\Alwil Software
2007-05-19 07:39:44 -------- d-----w C:\Program Files\VideoLAN
2007-05-19 07:39:13 -------- d-----w C:\Program Files\ATI Technologies
2007-05-19 07:38:30 -------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-05-19 07:35:43 -------- d-----w C:\Program Files\Booster Wanadoo
2007-05-19 07:34:11 -------- d-----w C:\Program Files\VIA
2007-05-19 07:22:56 0 --sha-r C:\MSDOS.SYS
2007-05-19 07:22:56 0 --sha-r C:\IO.SYS
2007-05-19 07:22:56 0 ----a-w C:\CONFIG.SYS
2007-05-19 07:22:56 0 ----a-w C:\AUTOEXEC.BAT
2007-05-19 07:21:53 -------- d-----w C:\Program Files\Services en ligne
2007-05-19 07:21:26 -------- d-----w C:\Program Files\Movie Maker
2007-05-19 07:20:49 -------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-05-19 07:20:19 21,892 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-19 07:19:38 -------- d-----w C:\Program Files\Messenger
2007-05-19 07:19:31 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-19 07:19:28 -------- d-----w C:\Program Files\Windows NT
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2001-04-16 16:39 37808 --a------ C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 18:42]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" []
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-07-03 12:00]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-30 15:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 19:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoDesktop"=0 (0x0)
"NoControlPanel"=0 (0x0)
"NoClose"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"HideClock"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 15:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-07 00:25:23
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\TITOUT~1\LOCALS~1\Temp\mc21.tmp"

Completion time: 2007-07-07 0:25:44
C:\ComboFix2.txt ... 2007-07-06 17:35

--- E O F ---

---------------------------------------------------------------------------------------

Dr dre est vide de tout virus : pas de rapport donné

-----------------------------------------------------------------------------------------

Et le rapport de Panda scan en ligne :

Incident Statut Analyse

Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\TitouTitou\Application Data\Mozilla\Firefox\Profiles\1b1d6ah8.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Apmebf No Désinfecté C:\Documents and Settings\TitouTitou\Application Data\Mozilla\Firefox\Profiles\1b1d6ah8.default\cookies.txt[.apmebf.com/]
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\TitouTitou\Bureau\VirtumundoBeGone.exe
Spyware:Cookie/Toplist No Désinfecté C:\Documents and Settings\TitouTitou\Cookies\titoutitou@toplist[1].txt
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\TitouTitou\Cookies\titoutitou@xiti[1].txt
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\TitouTitou\DoctorWeb\Quarantine\A0011471.exe
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\TitouTitou\Local Settings\Application Data\Mozilla\Firefox\Profiles\1b1d6ah8.default\Cache\038E337Bd01
Outil indésirable:Application/Processor No Désinfecté D:\Téléchargement internet\Traque Anti virus\VirtumundoBeGone.exe
Virus:Generic Trojan
---------------------------------------------------------------------------------------------

dis moi si ça te semble bon tout ça !!

j’espère que j’ai rien oublié

merci

a++

je t'envoie tout ce que j'ai dés que j'ai fini

ça à l'air pas mal du tout
j'ai réussi a avoir un rapport avec AVG

Par contre quand je colle les dossiers suivants dans OTMoveIt.exe :

C:\Documents and Settings\TitouTitou\heijsg.exe
C:\Documents and Settings\TitouTitou\pxwqvk.exe
C:\Documents and Settings\TitouTitou\qfyjar.exe

On me répond :”Cannot create file C:\_otmoveit\move files\07062007-230748.log”

a++

Re afideg

J'ai bien fait la suppression sur AVG mais il supprime 6 fichiers sur 7 et déclare une erreur !
que faire??

Pour le serveur proxy je ne sais pas du tout

et pour le reste je suis tes instruction aveuglément

je te fais signe dés que c'est fini

merci

a+++

ok je te bipe quand j'aurais terminé

merci infiniment

a++

PS: titou c'est mon surnom lolll

Re salut afideg,
voici les différents résultats que tu m’as demandé :
-----------------------------------------------------------------------------------------------------------------
1 - AVG Anti-Spyware
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 08:30:12 05/07/2007

+ Résultat de l'analyse:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\S-1-5-21-1960408961-117609710-725345543-1004\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
C:\Documents and Settings\TitouTitou\Bureau\MSNFix\MSNFix\04072007_18120525.zip/backup/myalbum2007.zip/photo album-2007.scr -> Backdoor.IRCBot.acd : Ignoré.
C:\Documents and Settings\TitouTitou\Local Settings\Temporary Internet Files\Content.IE5\NZWBERVB\addy[1].exe/ghost.exe -> Downloader.IstBar : Ignoré.
C:\Program Files\Fichiers communs\System\Mapi\1036\NT\swwagb.exe/ghost.exe -> Downloader.IstBar : Ignoré.
D:\System Volume Information\_restore{6FBBB220-3841-44FC-A143-A59C65D94A8E}\RP391\A0582494.exe -> Trojan.Small.edz : Ignoré.

Fin du rapport

---------------------------------------------------------

2 - COMBO FIX

"TitouTitou" - 2007-07-06 17:34:54 - ComboFix 07-07-06 - Service Pack 1 [SAFE MODE]

/wow section - STAGE #3

((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 )))))))))))))))))))))))))))))))

2007-07-06 17:34 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-05 17:19 <REP> d-------- C:\Program Files\Kerio
2007-07-05 15:46 524,288 --ah----- C:\DOCUME~1\ADMINI~1.000\NTUSER.DAT
2007-07-05 15:46 <REP> dr------- C:\DOCUME~1\ADMINI~1.000\Menu D‚marrer
2007-07-05 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1.000\Voisinage r‚seau
2007-07-05 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1.000\Voisinage d'impression
2007-07-05 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1.000\ModŠles
2007-07-05 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1.000\Mes documents
2007-07-05 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1.000\Favoris
2007-07-05 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1.000\Bureau
2007-07-04 22:01 <REP> d-------- C:\DOCUME~1\TITOUT~1\DoctorWeb
2007-07-04 15:53 <REP> d-------- C:\VundoFix Backups
2007-07-03 03:42 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-02 19:04 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-07-02 12:38 <REP> d-------- C:\install
2007-06-25 17:12 262,144 --ah----- C:\DOCUME~1\ADMINI~1.TIT\NTUSER.DAT
2007-06-25 17:12 <REP> dr------- C:\DOCUME~1\ADMINI~1.TIT\Menu D‚marrer
2007-06-25 17:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1.TIT\Voisinage r‚seau
2007-06-25 17:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1.TIT\Voisinage d'impression
2007-06-25 17:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1.TIT\ModŠles
2007-06-25 17:12 <REP> d-------- C:\DOCUME~1\ADMINI~1.TIT\Mes documents
2007-06-25 17:12 <REP> d-------- C:\DOCUME~1\ADMINI~1.TIT\Favoris
2007-06-25 17:12 <REP> d-------- C:\DOCUME~1\ADMINI~1.TIT\Bureau
2007-06-25 17:09 <REP> d-------- C:\Program Files\WinAVI MP4 Converter
2007-06-25 15:46 262,144 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-25 15:46 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2007-06-25 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2007-06-25 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2007-06-25 15:46 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2007-06-25 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1\Mes documents
2007-06-25 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1\Favoris
2007-06-25 15:46 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2007-06-23 12:10 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-06-23 12:10 14,976 --a------ C:\WINDOWS\system32\drivers\SBKUPNT.SYS
2007-06-23 12:10 13,312 --a------ C:\WINDOWS\system32\DEVLOAD.EXE
2007-06-23 11:42 <REP> d-------- C:\Program Files\windirstat
2007-06-23 11:24 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2007-06-21 12:18 <REP> d-------- C:\DOCUME~1\TITOUT~1\APPLIC~1\MapInfo
2007-06-14 19:28 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-06-14 19:28 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-06-14 19:28 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2007-06-14 19:28 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2007-06-14 19:28 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2007-06-14 19:28 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2007-06-14 19:28 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2007-06-14 19:28 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-02 14:27:35 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-06-25 12:26:53 -------- d-----w C:\Program Files\SuperCopier2
2007-06-23 08:23:32 -------- d--h--w C:\Program Files\WindowsUpdate
2007-06-06 06:34:04 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\dvdcss
2007-06-02 16:55:50 -------- d-----w C:\Program Files\REAPER
2007-06-02 16:55:23 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\REAPER
2007-06-02 09:00:09 -------- d-----w C:\Program Files\4Musics Multiformat Converter
2007-06-02 08:48:44 -------- d-----w C:\Program Files\Free Audio Pack
2007-05-29 13:51:43 -------- d-----w C:\Program Files\DivX
2007-05-25 15:58:59 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-25 15:58:59 -------- d-----w C:\Program Files\Micro Application
2007-05-24 18:17:44 -------- d-----w C:\Program Files\MV
2007-05-24 17:39:16 -------- d-----w C:\Program Files\MV_Partner
2007-05-20 11:37:11 2,940 ----a-w C:\WINDOWS\mozver.dat
2007-05-19 17:14:01 -------- d-----w C:\Program Files\Audacity
2007-05-19 12:30:47 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\vlc
2007-05-19 12:06:51 -------- d-----w C:\Program Files\DVD Decrypter
2007-05-19 10:37:48 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\InterTrust
2007-05-19 09:08:30 -------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-05-19 09:08:27 -------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-05-19 08:01:04 0 ----a-w C:\WINDOWS\nsreg.dat
2007-05-19 07:47:45 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\Help
2007-05-19 07:46:02 -------- d-----w C:\Program Files\Ahead
2007-05-19 07:43:12 -------- d-----w C:\DOCUME~1\TITOUT~1\APPLIC~1\Microsoft Web Folders
2007-05-19 07:43:08 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-19 07:41:14 48,616 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-05-19 07:41:14 367,658 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-05-19 07:40:06 -------- d-----w C:\Program Files\Alwil Software
2007-05-19 07:39:44 -------- d-----w C:\Program Files\VideoLAN
2007-05-19 07:39:13 -------- d-----w C:\Program Files\ATI Technologies
2007-05-19 07:38:30 -------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-05-19 07:35:43 -------- d-----w C:\Program Files\Booster Wanadoo
2007-05-19 07:34:11 -------- d-----w C:\Program Files\VIA
2007-05-19 07:22:56 0 --sha-r C:\MSDOS.SYS
2007-05-19 07:22:56 0 --sha-r C:\IO.SYS
2007-05-19 07:22:56 0 ----a-w C:\CONFIG.SYS
2007-05-19 07:22:56 0 ----a-w C:\AUTOEXEC.BAT
2007-05-19 07:21:53 -------- d-----w C:\Program Files\Services en ligne
2007-05-19 07:21:26 -------- d-----w C:\Program Files\Movie Maker
2007-05-19 07:20:49 -------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-05-19 07:20:19 21,892 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-19 07:19:38 -------- d-----w C:\Program Files\Messenger
2007-05-19 07:19:31 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-19 07:19:28 -------- d-----w C:\Program Files\Windows NT
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2001-04-16 16:39 37808 --a------ C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 18:42]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" []
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-07-03 12:00]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-30 15:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 19:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoDesktop"=0 (0x0)
"NoControlPanel"=0 (0x0)
"NoClose"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"HideClock"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 15:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-06 17:35:17
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\TITOUT~1\LOCALS~1\Temp\mc22.tmp"

Completion time: 2007-07-06 17:35:42

--- E O F ---
---------------------------------------------------------------------------------------------------------------

3 - SYSTEM SCAN

SystemScan - www.suspectfile.com - ver. 3.2.0

Running on: Windows XP HOME Edition, Service Pack 1 (2600.5.1)
System directory: C:\WINDOWS

Date: 06/07/2007
Time: 17:37:23

Output limited to:
-Recent files
-Registry Run Keys

===================== Recent files (60 days old)=====================

----- recent files in C:\
19/05/2007 10:18:04 199 byte 48 days old -- boot.ini
19/05/2007 10:22:56 0 byte 48 days old -- MSDOS.SYS
19/05/2007 10:22:56 0 byte 48 days old -- IO.SYS
19/05/2007 10:22:56 0 byte 48 days old -- CONFIG.SYS
19/05/2007 10:22:56 0 byte 48 days old -- AUTOEXEC.BAT
19/05/2007 10:25:43 (DIR) 0 byte 48 days old -- System Volume Information
19/05/2007 10:31:17 (DIR) 0 byte 48 days old -- NVIDIA
19/05/2007 10:34:22 (DIR) 0 byte 48 days old -- download
19/05/2007 11:18:07 (DIR) 0 byte 48 days old -- WebCamNXPro
19/05/2007 14:15:38 (DIR) 0 byte 48 days old -- RECYCLER
19/05/2007 15:07:05 (DIR) 0 byte 48 days old -- ECOLE_POUR_TOUS
23/05/2007 20:02:42 (DIR) 0 byte 44 days old -- SAMANTHA_AU_GITE_VOL1
24/05/2007 21:16:33 4239906 byte 43 days old -- Ugly.mp3
29/05/2007 16:55:22 (DIR) 0 byte 38 days old -- EasyDivX
03/07/2007 02:28:01 2239 byte 3 days old -- MP4debug.log
04/07/2007 15:53:56 (DIR) 0 byte 2 days old -- VundoFix Backups
04/07/2007 15:55:11 186 byte 2 days old -- VundoFix.txt
05/07/2007 15:46:03 (DIR) 0 byte 1 days old -- Documents and Settings
05/07/2007 17:19:14 (DIR) 0 byte 1 days old -- Program Files
06/07/2007 16:29:08 1239 byte 0 days old -- sti.log
06/07/2007 16:29:46 (DIR)805306368 byte 0 days old -- pagefile.sys
06/07/2007 16:49:06 (DIR) 0 byte 0 days old -- install
06/07/2007 17:35:13 (DIR) 0 byte 0 days old -- QooBox
06/07/2007 17:35:42 9120 byte 0 days old -- ComboFix.txt
06/07/2007 17:35:44 (DIR) 0 byte 0 days old -- WINDOWS
06/07/2007 17:37:23 (DIR) 0 byte 0 days old -- suspectfile

----- recent files in C:\WINDOWS\
19/05/2007 10:19:28 (DIR) 0 byte 48 days old -- Cursors
19/05/2007 10:20:00 1059 byte 48 days old -- sessmgr.setup.log
19/05/2007 10:20:03 128 byte 48 days old -- DtcInstall.log
19/05/2007 10:20:09 36 byte 48 days old -- vb.ini
19/05/2007 10:20:09 37 byte 48 days old -- vbaddin.ini
19/05/2007 10:20:22 11537 byte 48 days old -- FaxSetup.log
19/05/2007 10:20:22 870 byte 48 days old -- msgsocm.log
19/05/2007 10:20:22 15462 byte 48 days old -- ocgen.log
19/05/2007 10:20:22 1065 byte 48 days old -- ocmsn.log
19/05/2007 10:21:00 (DIR) 0 byte 48 days old -- Help
19/05/2007 10:21:46 (DIR) 0 byte 48 days old -- srchasst
19/05/2007 10:21:59 749 byte 48 days old -- WindowsShell.Manifest
19/05/2007 10:22:03 (DIR) 0 byte 48 days old -- Offline Web Pages
19/05/2007 10:22:42 (DIR) 0 byte 48 days old -- Registration
19/05/2007 10:22:45 4207 byte 48 days old -- ODBCINST.INI
19/05/2007 10:22:46 (DIR) 0 byte 48 days old -- java
19/05/2007 10:22:53 299552 byte 48 days old -- WMSysPrx.prx
19/05/2007 10:22:56 0 byte 48 days old -- control.ini
19/05/2007 10:23:04 (DIR) 0 byte 48 days old -- security
19/05/2007 10:23:04 (DIR) 0 byte 48 days old -- repair
19/05/2007 10:23:04 (DIR) 0 byte 48 days old -- ime
19/05/2007 10:24:49 15912 byte 48 days old -- comsetup.log
19/05/2007 10:24:49 8329 byte 48 days old -- tsoc.log
19/05/2007 10:24:49 695 byte 48 days old -- iis6.log
19/05/2007 10:24:49 4382 byte 48 days old -- imsins.log
19/05/2007 10:24:49 7824 byte 48 days old -- ntdtcsetup.log
19/05/2007 10:25:32 8192 byte 48 days old -- REGLOCS.OLD
19/05/2007 10:26:53 833 byte 48 days old -- OEWABLog.txt
19/05/2007 10:34:33 (DIR) 0 byte 48 days old -- Modio
19/05/2007 10:35:55 (DIR) 0 byte 48 days old -- CtDrvInstall
19/05/2007 10:39:13 (DIR) 0 byte 48 days old -- Web
19/05/2007 10:43:08 (DIR) 0 byte 48 days old -- msapps
19/05/2007 10:43:08 (DIR) 0 byte 48 days old -- system
19/05/2007 10:44:02 (DIR) 0 byte 48 days old -- ShellNew
19/05/2007 10:44:26 (DIR) 0 byte 48 days old -- Fonts
19/05/2007 10:44:30 568 byte 48 days old -- win.ini
19/05/2007 10:44:41 379 byte 48 days old -- ODBC.INI
19/05/2007 10:46:17 316640 byte 48 days old -- WMSysPr9.prx
19/05/2007 11:01:04 0 byte 48 days old -- nsreg.dat
19/05/2007 11:21:44 (DIR) 0 byte 48 days old -- twain_32
19/05/2007 12:07:28 0 byte 48 days old -- setuperr.log
19/05/2007 12:08:26 1470 byte 48 days old -- regopt.log
19/05/2007 12:10:31 0 byte 48 days old -- Sti_Trace.log
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- Driver Cache
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- mui
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- addins
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- Resources
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- Connection Wizard
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- Config
19/05/2007 13:04:24 (DIR) 0 byte 48 days old -- msagent
19/05/2007 13:04:49 (DIR) 0 byte 48 days old -- Media
19/05/2007 13:06:11 (DIR) 0 byte 48 days old -- AppPatch
19/05/2007 13:37:50 (DIR) 0 byte 48 days old -- Profiles
20/05/2007 14:37:11 2940 byte 47 days old -- mozver.dat
22/05/2007 11:35:18 919631 byte 45 days old -- setuplog.txt
25/05/2007 19:12:33 74 byte 42 days old -- NAVIGMA.INI
28/05/2007 15:32:14 12 byte 39 days old -- MAres.ini
28/05/2007 15:32:32 15 byte 39 days old -- MAPBS1.ini
28/05/2007 16:20:21 5 byte 39 days old -- MAPBS4.ini
28/05/2007 16:31:40 9 byte 39 days old -- MAPBS2.ini
28/05/2007 16:31:47 17 byte 39 days old -- MAPB.ini
28/05/2007 16:34:14 9 byte 39 days old -- MAPBS3.ini
29/05/2007 16:44:21 187574 byte 38 days old -- setupact.log
12/06/2007 18:04:18 8624 byte 24 days old -- MAPINFOW.PRF
12/06/2007 18:04:18 2708 byte 24 days old -- MAPINFOW.WOR
14/06/2007 19:24:51 (DIR) 0 byte 22 days old -- Downloaded Program Files
17/06/2007 00:11:58 51200 byte 19 days old -- nircmd.exe
25/06/2007 15:27:49 6010 byte 11 days old -- Windows Update.log
25/06/2007 16:52:29 197 byte 11 days old -- wmsetup.log
27/06/2007 19:29:43 29578 byte 9 days old -- ModemLog_TRUST 56K USB MODEM.txt
02/07/2007 17:26:07 (DIR) 0 byte 4 days old -- PCHealth
02/07/2007 17:26:14 (DIR) 0 byte 4 days old -- inf
02/07/2007 17:26:23 (DIR) 0 byte 4 days old -- WinSxS
02/07/2007 17:27:33 (DIR) 0 byte 4 days old -- Tasks
03/07/2007 18:40:24 454697 byte 3 days old -- setupapi.log
04/07/2007 19:21:04 104960 byte 2 days old -- catchme.exe
05/07/2007 15:57:01 823 byte 1 days old -- msnfix.txt
05/07/2007 17:19:17 (DIR) 0 byte 1 days old -- Installer
05/07/2007 17:21:00 281 byte 1 days old -- system.ini
06/07/2007 16:13:48 (DIR) 0 byte 0 days old -- Debug
06/07/2007 16:14:02 0 byte 0 days old -- 0.log
06/07/2007 16:24:48 (DIR) 0 byte 0 days old -- Prefetch
06/07/2007 16:28:45 13924 byte 0 days old -- ModemLog_TRUST 56K USB MODEM #2.txt
06/07/2007 16:29:07 275 byte 0 days old -- wiadebug.log
06/07/2007 16:29:08 32498 byte 0 days old -- SchedLgU.Txt
06/07/2007 16:29:08 50 byte 0 days old -- wiaservc.log
06/07/2007 16:29:52 2048 byte 0 days old -- bootstat.dat
06/07/2007 17:35:12 (DIR) 0 byte 0 days old -- system32
06/07/2007 17:35:44 (DIR) 0 byte 0 days old -- temp
06/07/2007 17:37:22 669408 byte 0 days old -- ntbtlog.txt

----- recent files in C:\WINDOWS\Downloaded Program Files\
19/05/2007 10:22:03 65 byte 48 days old -- desktop.ini

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
19/05/2007 10:18:21 (DIR) 0 byte 48 days old -- spool
19/05/2007 10:20:03 (DIR) 0 byte 48 days old -- MsDtc
19/05/2007 10:20:19 21892 byte 48 days old -- emptyregdb.dat
19/05/2007 10:20:21 (DIR) 0 byte 48 days old -- Com
19/05/2007 10:20:43 (DIR) 0 byte 48 days old -- Macromed
19/05/2007 10:21:22 (DIR) 0 byte 48 days old -- oobe
19/05/2007 10:21:38 (DIR) 0 byte 48 days old -- DirectX
19/05/2007 10:21:59 749 byte 48 days old -- wuaucpl.cpl.manifest
19/05/2007 10:21:59 749 byte 48 days old -- nwc.cpl.manifest
19/05/2007 10:21:59 749 byte 48 days old -- ncpa.cpl.manifest
19/05/2007 10:21:59 749 byte 48 days old -- cdplayer.exe.manifest
19/05/2007 10:21:59 749 byte 48 days old -- sapi.cpl.manifest
19/05/2007 10:22:03 488 byte 48 days old -- WindowsLogon.manifest
19/05/2007 10:22:03 488 byte 48 days old -- logonui.exe.manifest
19/05/2007 10:22:34 (DIR) 0 byte 48 days old -- ias
19/05/2007 10:22:54 23392 byte 48 days old -- nscompat.tlb
19/05/2007 10:22:54 16832 byte 48 days old -- amcompat.tlb
19/05/2007 10:23:04 (DIR) 0 byte 48 days old -- wbem
19/05/2007 10:23:04 (DIR) 0 byte 48 days old -- xircom
19/05/2007 10:24:45 261 byte 48 days old -- $winnt$.inf
19/05/2007 10:25:42 (DIR) 0 byte 48 days old -- Restore
19/05/2007 10:26:51 25065 byte 48 days old -- wmpscheme.xml
19/05/2007 10:31:48 (DIR) 0 byte 48 days old -- ReinstallBackups
19/05/2007 10:36:16 (DIR) 0 byte 48 days old -- Microsoft
19/05/2007 10:41:13 775210 byte 48 days old -- PerfStringBackup.INI
19/05/2007 10:41:14 311604 byte 48 days old -- perfh009.dat
19/05/2007 10:41:14 48616 byte 48 days old -- perfc00C.dat
19/05/2007 10:41:14 39992 byte 48 days old -- perfc009.dat
19/05/2007 10:41:14 367658 byte 48 days old -- perfh00C.dat
19/05/2007 10:47:07 110992 byte 48 days old -- FNTCACHE.DAT
19/05/2007 10:47:54 22 byte 48 days old -- ati64hl2.stb
19/05/2007 11:09:52 3121 byte 48 days old -- CONFIG.NT
19/05/2007 11:41:36 (DIR) 0 byte 48 days old -- config
19/05/2007 11:41:48 22 byte 48 days old -- ati64hlp.stb
19/05/2007 12:17:56 0 byte 48 days old -- h323log.txt
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- ShellExt
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1025
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1028
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1031
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- mui
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 3076
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 2052
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- export
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- dhcp
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- wins
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 3com_dmi
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1054
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1041
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1037
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- inetsrv
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- 1042
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- IME
19/05/2007 13:04:11 (DIR) 0 byte 48 days old -- 1033
19/05/2007 13:04:36 (DIR) 0 byte 48 days old -- icsxml
19/05/2007 13:04:41 (DIR) 0 byte 48 days old -- ras
19/05/2007 13:04:50 (DIR) 0 byte 48 days old -- 1036
19/05/2007 13:05:59 (DIR) 0 byte 48 days old -- npp
19/05/2007 13:06:15 (DIR) 0 byte 48 days old -- usmt
19/05/2007 13:06:15 (DIR) 0 byte 48 days old -- Setup
22/05/2007 11:35:13 2422 byte 45 days old -- wpa.bak
23/06/2007 11:24:35 (DIR) 0 byte 13 days old -- dllcache
25/06/2007 15:33:16 (DIR) 0 byte 11 days old -- CatRoot
30/06/2007 20:44:57 2422 byte 6 days old -- wpa.dbl
02/07/2007 17:26:15 (DIR) 0 byte 4 days old -- DRVSTORE
03/07/2007 18:42:23 (DIR) 0 byte 3 days old -- CatRoot2
06/07/2007 17:35:42 (DIR) 0 byte 0 days old -- drivers

----- recent files in C:\WINDOWS\system32\drivers\
19/05/2007 13:03:03 (DIR) 0 byte 48 days old -- disdn
19/05/2007 13:04:38 (DIR) 0 byte 48 days old -- etc
30/05/2007 15:10:42 10872 byte 37 days old -- AvgAsCln.sys
06/07/2007 16:29:50 163 byte 0 days old -- fwdrv.err

----- recent files in C:\WINDOWS\temp\

----- recent files in C:\Program Files\
19/05/2007 10:19:28 (DIR) 0 byte 48 days old -- Windows NT
19/05/2007 10:19:31 (DIR) 0 byte 48 days old -- MSN Gaming Zone
19/05/2007 10:19:38 (DIR) 0 byte 48 days old -- Messenger
19/05/2007 10:19:42 (DIR) 0 byte 48 days old -- MSN
19/05/2007 10:20:10 (DIR) 0 byte 48 days old -- ComPlus Applications
19/05/2007 10:20:56 (DIR) 0 byte 48 days old -- Outlook Express
19/05/2007 10:20:59 (DIR) 0 byte 48 days old -- NetMeeting
19/05/2007 10:21:26 (DIR) 0 byte 48 days old -- Movie Maker
19/05/2007 10:21:53 (DIR) 0 byte 48 days old -- Services en ligne
19/05/2007 10:22:03 (DIR) 0 byte 48 days old -- Internet Explorer
19/05/2007 10:23:04 (DIR) 0 byte 48 days old -- xerox
19/05/2007 10:26:47 (DIR) 0 byte 48 days old -- Uninstall Information
19/05/2007 10:34:11 (DIR) 0 byte 48 days old -- VIA
19/05/2007 10:35:43 (DIR) 0 byte 48 days old -- Booster Wanadoo
19/05/2007 10:39:13 (DIR) 0 byte 48 days old -- ATI Technologies
19/05/2007 10:39:44 (DIR) 0 byte 48 days old -- VideoLAN
19/05/2007 10:40:06 (DIR) 0 byte 48 days old -- Alwil Software
19/05/2007 10:43:08 (DIR) 0 byte 48 days old -- microsoft frontpage
19/05/2007 10:43:12 (DIR) 0 byte 48 days old -- Microsoft Office
19/05/2007 10:46:02 (DIR) 0 byte 48 days old -- Ahead
19/05/2007 10:46:12 (DIR) 0 byte 48 days old -- Windows Media Player
19/05/2007 13:37:48 (DIR) 0 byte 48 days old -- Fichiers communs
19/05/2007 15:06:51 (DIR) 0 byte 48 days old -- DVD Decrypter
19/05/2007 20:14:01 (DIR) 0 byte 48 days old -- Audacity
24/05/2007 20:39:16 (DIR) 0 byte 43 days old -- MV_Partner
24/05/2007 21:17:44 (DIR) 0 byte 43 days old -- MV
25/05/2007 18:58:59 (DIR) 0 byte 42 days old -- InstallShield Installation Information
25/05/2007 18:58:59 (DIR) 0 byte 42 days old -- Micro Application
29/05/2007 16:51:43 (DIR) 0 byte 38 days old -- DivX
02/06/2007 11:48:44 (DIR) 0 byte 34 days old -- Free Audio Pack
02/06/2007 12:00:09 (DIR) 0 byte 34 days old -- 4Musics Multiformat Converter
02/06/2007 19:55:50 (DIR) 0 byte 34 days old -- REAPER
07/06/2007 13:59:20 (DIR) 0 byte 29 days old -- Adobe
23/06/2007 11:23:32 (DIR) 0 byte 13 days old -- WindowsUpdate
23/06/2007 11:42:16 (DIR) 0 byte 13 days old -- windirstat
23/06/2007 12:25:28 (DIR) 0 byte 13 days old -- Unlocker
25/06/2007 15:26:53 (DIR) 0 byte 11 days old -- SuperCopier2
25/06/2007 17:09:29 (DIR) 0 byte 11 days old -- WinAVI MP4 Converter
01/07/2007 13:21:01 (DIR) 0 byte 5 days old -- Mozilla Firefox
02/07/2007 17:27:35 (DIR) 0 byte 4 days old -- Windows Live Toolbar
03/07/2007 03:42:35 (DIR) 0 byte 3 days old -- Grisoft
05/07/2007 00:00:01 (DIR) 0 byte 1 days old -- a-squared Anti-Malware
05/07/2007 17:19:14 (DIR) 0 byte 1 days old -- Kerio
06/07/2007 08:14:01 (DIR) 0 byte 0 days old -- hijackthis

----- recent files in C:\Program Files\Fichiers communs\
19/05/2007 10:20:49 (DIR) 0 byte 48 days old -- MSSoap
19/05/2007 10:20:57 (DIR) 0 byte 48 days old -- Services
19/05/2007 10:38:30 (DIR) 0 byte 48 days old -- InstallShield
19/05/2007 10:44:03 (DIR) 0 byte 48 days old -- System
19/05/2007 10:44:16 (DIR) 0 byte 48 days old -- Designer
19/05/2007 12:08:27 (DIR) 0 byte 48 days old -- SpeechEngines
19/05/2007 12:08:30 (DIR) 0 byte 48 days old -- ODBC
07/06/2007 13:59:20 (DIR) 0 byte 29 days old -- Adobe
02/07/2007 17:26:48 (DIR) 0 byte 4 days old -- Microsoft Shared

----- recent files in C:\Documents and Settings\TitouTitou\Application Data\
19/05/2007 10:26:51 (DIR) 0 byte 48 days old -- Identities
19/05/2007 10:43:12 (DIR) 0 byte 48 days old -- Microsoft Web Folders
19/05/2007 10:47:45 (DIR) 0 byte 48 days old -- Help
19/05/2007 11:01:02 (DIR) 0 byte 48 days old -- Mozilla
19/05/2007 12:08:01 62 byte 48 days old -- desktop.ini
19/05/2007 13:37:41 (DIR) 0 byte 48 days old -- Macromedia
19/05/2007 13:37:48 (DIR) 0 byte 48 days old -- InterTrust
19/05/2007 15:30:47 (DIR) 0 byte 48 days old -- vlc
02/06/2007 19:55:23 (DIR) 0 byte 34 days old -- REAPER
06/06/2007 09:34:04 (DIR) 0 byte 30 days old -- dvdcss
07/06/2007 14:00:50 (DIR) 0 byte 29 days old -- Adobe
21/06/2007 12:18:40 (DIR) 0 byte 15 days old -- MapInfo
03/07/2007 03:42:48 (DIR) 0 byte 3 days old -- Grisoft
03/07/2007 11:49:10 (DIR) 0 byte 3 days old -- Microsoft

----- recent files in C:\DOCUME~1\TITOUT~1\LOCALS~1\Temp\
06/07/2007 16:31:21 16384 byte 0 days old -- Perflib_Perfdata_358.dat
06/07/2007 17:35:44 9120 byte 0 days old -- log.txt
06/07/2007 17:36:40 16384 byte 0 days old -- ~DFFA7A.tmp
06/07/2007 17:36:40 (DIR) 0 byte 0 days old -- nsw2.tmp

===================== REGISTRY SCAN =====================

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
"UnlockerAssistant"="\"C:\Program Files\Unlocker\UnlockerAssistant.exe\""
"a-squared"="\"C:\Program Files\a-squared Anti-Malware\a2guard.exe\""
"!AVG Anti-Spyware"="\"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe\" /minimized"

[Run\OptionalComponents]

[Run\OptionalComponents\IMAIL]
"Installed"="1"

[Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[Run\OptionalComponents\MSFS]
"Installed"="1"

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe"
"MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
"AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"%SystemRoot%\System32\webcheck.dll"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\System32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
#### HKCR\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\InprocServer32 @="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"@="Quota du disque Microsoft"
"DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"DllName"=expand:"iedkcs32.dll"
"@="Personnalisation de Internet Explorer"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="EFS recovery"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"@="Installation de logiciel"
"DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"
"Logoff"="ChainWlxLogoffEvent"

[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"
"Logoff"="CryptnetWlxLogoffEvent"

[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"StartShell"="WinlogonStartShellEvent"

[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001

[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"

[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"ParseAutoexec"="1"
"ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
"BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
"BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
"cmdline"=expand:"%SystemRoot%\system32\ntvdm.exe"
"wowcmdline"=expand:"%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\System32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\System32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
#### HKCR\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\InprocServer32 @="C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @=expand:"%SystemRoot%\System32\shdocvw.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
@="\"%1\" /S"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
@="C:\WINDOWS\System32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
@="http://"

[URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]
"Authentication Packages"=multi:"msv1_0\00\00"
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=multi:"kerberos\00msv1_0\00schannel\00wdigest\00\00"
"LsaPid"=dword:00000100
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nodefaultadminowner"=dword:00000001
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=multi:"scecli\00\00"
"enabledcom"="y"

[Lsa\AccessProviders]
"ProviderOrder"=multi:"Windows NT Access Provider\00\00"

[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"

[Lsa\Data]
@Class="fdf3beba"
"Pattern"=hex:06,6c,26,f8,7e,2d,4f,d4,81,1d,71,f9,6b,da,29,cc,66,64,66,33,62,\
65,62,61,00,68,07,00,01,00,00,00,d8,00,00,00,dc,00,00,00,48,fa,06,00,d6,48,\
51,74,04,00,00,00,a0,fd,06,00,b8,fd,06,00,f9,db,62,dc

[Lsa\GBG]
@Class="f95e794c"
"GrafBlumGroup"=hex:e6,e6,5c,76,b4,5e,26,6f,3e

[Lsa\JD]
@Class="cc6fdc11"
"Lookup"=hex:62,da,37,ae,a2,30

[Lsa\Kerberos]

[Lsa\Kerberos\Domains]

[Lsa\Kerberos\SidCache]

[Lsa\msv1_0]
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000

[Lsa\Skew1]
@Class="62dbd6c0"
"SkewMatrix"=hex:93,dd,cb,3a,2a,39,47,82,a9,64,5f,7c,39,88,3a,b6

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[Lsa\SspiCache]
"Time"=hex:d8,e1,d2,82,f1,99,c7,01

[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,20,27,c4,1c,50,c2,01
"Type"=dword:00000031

[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,20,27,c4,1c,50,c2,01
"Type"=dword:00000031

[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,20,27,c4,1c,50,c2,01
"Type"=dword:00000031

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=expand:"%SystemRoot%\System32\svchost.exe -k netsvcs"
"DisplayName"="Internet Connection Sharing"
"DependOnService"=multi:"Netman\00NLA\00RasMan\00ALG\00\00"
"DependOnGroup"=multi:"\00"
"ObjectName"="LocalSystem"
"Description"="Provides network address translation, addressing, and name resolution services for all computers on your home network through a dial-up connection."

[SharedAccess\Epoch]
"Epoch"=dword:00002cd5

[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"
"1900:UDP"="1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"

[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,\
00,00,05,12,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,5f,84,1f,\
5e,2e,6b,49,ce,12,03,03,f4,01,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,\
5f,84,1f,5e,2e,6b,49,ce,12,03,03,f4,01,00,00
"EnableDCOM"="Y"

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
"FirewallDisableNotify"=dword:00000000

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{8E9B0C97-300C-43A9-9A32-E99040B0E550}"

[SystemRestore\SnapshotCallbacks]
@=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

[MountPoints2]

[MountPoints2\C]
"BaseClass"="Drive"

[MountPoints2\D]
"BaseClass"="Drive"

[MountPoints2\E]
"BaseClass"="Drive"

[MountPoints2\F]
"BaseClass"="Drive"

[MountPoints2\G]
"BaseClass"="Drive"

[MountPoints2\H]
"BaseClass"="Drive"

[MountPoints2\I]
"BaseClass"="Drive"

[MountPoints2\J]
"BaseClass"="Drive"

[MountPoints2\K]
"BaseClass"="Drive"

[MountPoints2\L]
"BaseClass"="Drive"

[MountPoints2\{38c2a438-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{38c2a439-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{38c2a43a-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{38c2a43b-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,01,5f,ee,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,10,00,00,08,\
02,00,00

[MountPoints2\{38c2a43c-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{38c2a43d-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{38c2a43e-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{38c2a43f-05ef-11dc-b84f-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{4dc8b514-0de9-11dc-b1b4-00e04cb9b0eb}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,ee,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,01,00,00,00,08,\
06,00,00

[MountPoints2\{4dc8b514-0de9-11dc-b1b4-00e04cb9b0eb}\shell]
@="None"

[MountPoints2\{4dc8b514-0de9-11dc-b1b4-00e04cb9b0eb}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{4dc8b514-0de9-11dc-b1b4-00e04cb9b0eb}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{4fc24520-101d-11dc-b1ba-00e04cb9b0eb}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,00,ee,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,10,00,00,08,\
02,00,00

[MountPoints2\{b4e9c74e-05db-11dc-b194-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
cf,cf,cf,5f,5f,cf,cf,cf,5f,5f,cf,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,00,ee,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,e0,00,00,00,08,\
01,00,00

[MountPoints2\{b88159aa-0840-11dc-b19f-00e04cb9b0eb}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,00,ee,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,10,00,00,08,\
02,00,00

[MountPoints2\{c728bb10-215e-11dc-840f-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,cf,5f,5f,5f,\
cf,cf,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,5f,5f,5f,5f,5f,00,00,00,00,10,00,00,00,\
00,00,00

[MountPoints2\{c728bb11-215e-11dc-840f-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,cf,5f,5f,5f,\
cf,cf,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,5f,5f,5f,5f,5f,00,00,00,00,10,00,00,00,\
00,00,00

[MountPoints2\{c728bb12-215e-11dc-840f-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,00,ee,5f,\
cf,cf,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,5f,5f,5f,5f,5f,00,00,00,00,10,00,00,08,\
01,00,00

[MountPoints2\{c728bb13-215e-11dc-840f-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,cf,5f,5f,5f,\
cf,cf,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,5f,5f,5f,5f,5f,00,00,00,00,10,00,00,00,\
00,00,00

[MountPoints2\{f55e7298-1fd5-11dc-b1df-00e04cb9b0eb}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,00,ee,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,10,00,00,08,\
02,00,00

[MountPoints2\{f55e7298-1fd5-11dc-b1df-00e04cb9b0eb}\shell]
@="None"

[MountPoints2\{f55e7298-1fd5-11dc-b1df-00e04cb9b0eb}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{f55e7298-1fd5-11dc-b1df-00e04cb9b0eb}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{f55e7299-1fd5-11dc-b1df-00e04cb9b0eb}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
df,df,df,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,01,00,ee,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,10,00,00,08,\
02,00,00

[MountPoints2\{f55e7299-1fd5-11dc-b1df-00e04cb9b0eb}\shell]
@="None"

[MountPoints2\{f55e7299-1fd5-11dc-b1df-00e04cb9b0eb}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{f55e7299-1fd5-11dc-b1df-00e04cb9b0eb}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\System32\msdxm.ocx"
"Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
"@="Microsoft Windows Media Player"
"ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
"@="Personnalisation du navigateur"
"ComponentID"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
"@="Microsoft VM"
"ComponentID"="JAVAVM"
"KeyFileName"=expand:"%systemroot%\system32\msjava.dll"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}]
"@="Internet Explorer Classes for Java"
"ComponentID"="IEJAVA"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
"@="Rendu VML (Vector Graphics Rendering)"
"ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer

@Fabien976Voici la suite :

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer
@="C:\WINDOWS\System32\msdxm.ocx"
"ComponentID"="NetShow"
"StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\System32\msdxm.ocx"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT"
"@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
#### HKCR\CLSID\{283807B5-2C60-11D0-A31D-00AA00B92C03}\InprocServer32 @="C:\WINDOWS\System32\danim.dll"
"@="DirectAnimation"
"ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"@="Themes Setup"
"ComponentID"="Theme Component"
"StubPath"=expand:"%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll"

[Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
"StubPath"="\"C:\WINDOWS\System32\rundll32.exe\" \"C:\Program Files\Messenger\msgsc.dll\",ShowIconsUser"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
"@="Liaison de données Dynamic HTML pour Java"
"ComponentID"="TridataJava"

[Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
"@="Logiciel de navigation hors connexion"
"ComponentID"="MobilePk"

[Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
"@="Uniscribe"
"ComponentID"="USP10"

[Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}]
"@="Création avancée"
"ComponentID"="AdvAuth"

[Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"@="Microsoft Outlook Express 6"
"ComponentID"="MailNews"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install"

[Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
"@="NetMeeting 3.01"
"ComponentID"="NetMeeting"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT"

[Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
"@="DirectShow"
"ComponentID"="activemovie"

[Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
"@="DirectDrawEx"
"ComponentID"="DirectDrawEx"

[Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
"@="Aide sur Internet Explorer"
"ComponentID"="HelpCont"

[Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
"@="Classes Java DirectAnimation"
"ComponentID"="DAJava"

[Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
"@="Microsoft Windows Script 5.6"
"ComponentID"="MSVBScript"

[Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
"KeyFileName"="C:\Program Files\Messenger\msmsgs.exe"
"@="Windows Messenger 4.7"
"ComponentID"="Messenger"
"StubPath"=expand:"rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser"

[Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
"(Default)"="Internet Connection Wizard"
"ComponentID"="ICW"

[Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
"@="Outils d'installation Internet Explorer"
"ComponentID"="GenSetup"

[Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
"@="Améliorations pour la navigation"
"ComponentID"="ExtraPack"
"KeyFileName"="C:\WINDOWS\System32\msieftp.dll"

[Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
#### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\System32\wmp.ocx"
"@="Microsoft Windows Media Player 8"
"ComponentID"="Microsoft Windows Media Player 8"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub"

[Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
"@="Accès au site MSN"
"ComponentID"="MSN_Auth"

[Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"@="Carnet d'adresses 6"
"ComponentID"="WAB"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
"@="Mise à jour du Bureau Windows"
"ComponentID"="IE4Shell_NT"
"StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
"@="Internet Explorer 6"
"ComponentID"="BASEIE40_W2K"
"StubPath"=expand:"%SystemRoot%\system32\ie4uinit.exe"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix]

[Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
"@="Liaison de données Dynamic HTML"
"ComponentID"="Tridata"

[Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]

[Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
"@="Polices de base Internet Explorer"
"ComponentID"="Fontcore"

[Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
"@="Planificateur de tâches"
"ComponentID"="MSTASK"

[Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"@="Adobe Flash Player 9 ActiveX"
"ComponentID"="Flash"

[Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
"@="Aide HTML"
"ComponentID"="HTMLHelp"

[Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
"@="Active Directory Service Interface"
"ComponentID"="ADSI"

-----Comparing registry keys CCS1 vs CCS2 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS\Parameters ServiceDll REG_EXPAND_SZ C:\WINDOWS\system32\qmgr.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\BITS\Parameters ServiceDll REG_EXPAND_SZ C:\WINDOWS\System32\qmgr.dll
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\catchme
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\CiSvc Description REG_SZ Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\CiSvc Description REG_SZ Construit un index des contenus et des propriétés des fichiers sur les ordinateurs locaux et distants ; fournit un accès rapide aux fichiers par le biais d'un langage d'interrogation flexible.
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\CiSvc DisplayName REG_SZ Indexing Service
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\CiSvc DisplayName REG_SZ Service d'indexation
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ERSvc Description REG_SZ Allows error reporting for services and applictions running in non-standard environments.
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\ERSvc Description REG_SZ Active le rapport d'erreurs pour les services et les applications s'exécutant sur des environnements non standard.
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ERSvc DisplayName REG_SZ Error Reporting Service
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\ERSvc DisplayName REG_SZ Service de rapport d'erreurs
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\System32\ESENT.dll
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\System32\ESENT.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 0219524E74F289FFBE21618D230C3C6B
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 002027C41C50C201
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 24064 (0x5E00)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 002027C41C50C201
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileSignature REG_BINARY 2D3058CCB243C4C233A26DF7FB2EFE75
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileTime REG_BINARY 002027C41C50C201
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileSize REG_DWORD 24576 (0x6000)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance Disable Performance Counters REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileSignature REG_BINARY 34F6A3C36C3EA308109681F666488C27
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileTime REG_BINARY 002027C41C50C201
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileSize REG_DWORD 33280 (0x8200)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance Disable Performance Counters REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\RpcSs\Parameters ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\rpcss.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\RpcSs\Parameters ServiceDll REG_EXPAND_SZ %SystemRoot%\system32\rpcss.dll
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess DisplayName REG_SZ Internet Connection Sharing
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess DisplayName REG_SZ Pare-feu de connexion Internet (ICF) / Partage de connexion Internet (ICS)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess Description REG_SZ Provides network address translation, addressing, and name resolution services for all computers on your home network through a dial-up connection.
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess Description REG_SZ Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique.
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Parameters\FirewallPolicy
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Setup
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY CA66E0A5C883DFA6723D62F501C90083
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 002027C41C50C201
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 132608 (0x20600)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 002027C41C50C201
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\UPS Description REG_SZ Manages an uninterruptible power supply (UPS) connected to the computer.
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\UPS Description REG_SZ Gère un onduleur connecté à l'ordinateur.
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\UPS DisplayName REG_SZ Uninterruptible Power Supply
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\UPS DisplayName REG_SZ Onduleur
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\UPS ObjectName REG_EXPAND_SZ LocalSystem
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\UPS ObjectName REG_SZ NT AUTHORITY\LocalService

Result compared: Different

-----Comparing registry keys CCS1 vs CCS3 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services

Result compared: Identical

==========================================
Scan completed in 0,1 minutes
End of report
-----------------------------------------------------------------------------------------------------------------

Bon courage ya pas mal de ligne à voir !!!

Merci encore pour ton aide, ça fait bien plaisir !!! J

A+

Salut afideg, comment ça vas, je me permet de te reposer une petite question

J’ai suivi tes instructions voici les rapports obtenus avec hijackthis et AVG Antispyware à ce jour et regarde le résultat et dis moi ce que tu en penses :

Logfile of HijackThis v1.99.1
Scan saved at 08:14:01, on 06/07/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\slrundll.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7180
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;*windowsupdate.microsoft.com;*windowsupdate.com;download.microsoft.com;codecs.microsoft.com;activex.microsoft.com;liveupdate.symantecliveupdate.com;liveupdate.symantec.com;services.wanadoo.fr;secure.wanadoo.fr;webgen.wanadoo.fr;images.wanadoo.fr;images2.wanadoo.fr;wanadoo.wha.com;wha.wanadoo.fr;pay.www.wanadoo.fr;www.wanadoo.fr;webmail*.wanadoo.fr;iapref.wanadoo.fr;wip2.wanadoo.fr;vip.voila.fr;maj.wanadoo.fr;qos.wanadoo.fr;guidejuniorscontroleparental.wanadoo.fr;wip2pro.wanadoo.fr;wpms.wanadoo.fr;mobile.wanadoo.fr;wpms.wanadoo.fr;photos.wanadoo.fr;musicb.wanadoo.fr;wassup.wanadoo.fr;majkit1.orange.fr;majkit2.orange.fr;guidejuniors.orange.fr;wpms.orange.fr;smsmms.orange.fr;smsmms1.orange.fr;smsmms2.orange.fr;photos.orange.fr;services.orange.fr;compte.orange.fr;compte.wanadoo.fr;secure.orange.fr;wha.orange.fr;wassup.orange.fr;www.orange.fr;webmail*.orange.fr;iapref.orange.fr;wip2.orange.fr;id.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Booster Wanadoo.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Afficher l'image non compressée - res://C:\Program Files\Booster Wanadoo\wanadoo_booster.exe/227
O8 - Extra context menu item: Afficher toutes les images non compressées - res://C:\Program Files\Booster Wanadoo\wanadoo_booster.exe/250
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://moofi.spaces.live.com//PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{415D3FDD-4E74-44F8-AADF-8AC49EE785C1}: NameServer = 80.10.246.5 80.10.246.136
O17 - HKLM\System\CS1\Services\Tcpip\..\{415D3FDD-4E74-44F8-AADF-8AC49EE785C1}: NameServer = 80.10.246.5 80.10.246.136
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 08:30:12 05/07/2007

+ Résultat de l'analyse:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\S-1-5-21-1960408961-117609710-725345543-1004\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
C:\Documents and Settings\TitouTitou\Bureau\MSNFix\MSNFix\04072007_18120525.zip/backup/myalbum2007.zip/photo album-2007.scr -> Backdoor.IRCBot.acd : Ignoré.
C:\Documents and Settings\TitouTitou\Local Settings\Temporary Internet Files\Content.IE5\NZWBERVB\addy[1].exe/ghost.exe -> Downloader.IstBar : Ignoré.
C:\Program Files\Fichiers communs\System\Mapi\1036\NT\swwagb.exe/ghost.exe -> Downloader.IstBar : Ignoré.
D:\System Volume Information\_restore{6FBBB220-3841-44FC-A143-A59C65D94A8E}\RP391\A0582494.exe -> Trojan.Small.edz : Ignoré.

Fin du rapport

J’ai toujours des bons virus, tous les logiciel télécharger n'ont rien changer lol, espérons que tu pourras me trouver une superbe solution loll

Merci a toi a+++

dans 10 ou 15 minutes je te poste le tout du moins je pense 10-15 mn loll
merci

finalement un peu plus de temps j'en suis à 25 % du dernier scan
je te le poste dés qu'il est fini
a tout