Suis je infecté???

voici ton rapport, le windows es peut etre craquer
mais la licence est corecte

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\seb.PC\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\seb.PC\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\seb.PC\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\seb.PC\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\seb.PC\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\seb.PC\Bureau\UsbFix.lnk: trouvé !
C:\Documents and Settings\seb.PC\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\seb.PC\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\UsbFix\UsbFix.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\seb.PC\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\seb.PC\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\seb.PC\Bureau\HJTInstall.exe: supprimé !
C:\Documents and Settings\seb.PC\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\seb.PC\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\seb.PC\Bureau\UsbFix.lnk: supprimé !
C:\Documents and Settings\seb.PC\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Program Files\UsbFix\UsbFix.exe: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\seb.PC\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\UsbFix: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis: supprimé !

le rapport ne s'affiche pas je le trouve ou

@the probon je revien demain suis crever pas dormi beaucoup, puis je me prend la tete sur le pc de ma femme, je hais mon frere grrrr

Je ne suis pas le legitime proprietaire, juste le legtime con qui fait tout pour elle

non sa ne marche pas la fenêtre s'ouvre( 1 millieme de seconde) puis se ferme

petit stress je n'arrive plus a ouvrir mon explorateur internet

@the proje vais faire le scan avec panda pas le choix ses le seul qui passe

@the pronon ... fais ce que je t' ai donné avant de faire le scan en ligne ( poste 35 ) ....

PS : il faut accepter le contôle activX pour que cela fonctionne ....

je n'utilise pas de dvd tout est sur iso sur mon pc je prefere

oui il va vraiment mieux j'avais mis le rapport par prevention mais je me doutais pas que avast laisse passer temps de crasse je fais direct se que tu m'as dit

@the proje me doutais pas que avast laisse passer temps de crasse
-> si tu veux , une fois le PC clean , on changera pour mieux ( gratuit , plus performant et plus légé ... ) .

Par contre , Avast est ce qu'il est , cela n'empêche que même avec le meilleurs AV du monde , si tu fais n'importe quoi avec ton PC , tu finiras tjrs par te faire infecté ... ^^

J'attends donc les résultats ...

@sKe69le voila,
-------------- UsbFix V2.413.1 ---------------

* User : seb - SEB
* Outils mis a jours le 24/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 17:54:47 le 25/11/2008
* Windows Xp - Internet Explorer 7.0.5730.13

--------------- [ Processus actifs ] ----------------

C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\csrss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS.0\system32\userinit.exe
C:\Program Files\Windows Media Connect 2\wmccds.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\DOCUME~1\seb.PC\LOCALS~1\Temp\1.tmp\b2e.exe
C:\WINDOWS.0\System32\alg.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

E: - Lecteur fixe

--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe

+- Listing des fichiers présents :

[06/08/2008 09:57][--a------] C:\AUTOEXEC.BAT
[03/08/2004 23:38][-rahs----] C:\NTDETECT.COM
[25/11/2008 13:12][-rahs----] C:\boot.ini
[25/11/2008 17:33][--a------] C:\ComboFix.txt
[25/11/2008 17:33][--a------] C:\fixnavi.txt
[25/11/2008 17:33][--a------] C:\TB.txt
[25/11/2008 17:33][--a------] C:\UsbFix.txt
[12/11/2008 21:06][-rahs----] C:\config.sys
[12/11/2008 21:06][-rahs----] C:\IO.SYS
[12/11/2008 21:06][-rahs----] C:\MSDOS.SYS
[12/11/2008 21:06][-rahs----] C:\pagefile.sys

--------------- [ Lecteur E ] ----------------

E: - Lecteur fixe

+- Listing des fichiers présents :

[03/08/2004 23:38][-rahs----] E:\NTDETECT.COM
[07/11/2008 03:48][-rahs----] E:\boot.ini
[01/01/2002 01:00][--ahs----] E:\PAGEFILE.SYS

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS.0\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS.0\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
SoundMAXPnP=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c05bc55f-a338-11dd-9606-806d6172696f}\Shell\AutoRun\command

--------------- [ Nettoyage des disques ] ----------------

Supprimé ! - [14/05/2006 00:25][--a------] C:\WINDOWS.0\system32\Autoruns.exe

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[06/08/2008 09:57][--a------] C:\AUTOEXEC.BAT
[03/08/2004 23:38][-rahs----] C:\NTDETECT.COM
[25/11/2008 13:12][-rahs----] C:\boot.ini
[03/08/2004 23:38][-rahs----] E:\NTDETECT.COM
[07/11/2008 03:48][-rahs----] E:\boot.ini

--------------- ! Fin du rapport ! ----------------

ComboFix 08-11-24.03 - seb 2008-11-25 17:22:53.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.389 [GMT 1:00]
Lancé depuis: c:\documents and settings\seb.PC\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\seb.PC\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

FILE ::
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
c:\windows.0\system32\c_dll.dll
c:\windows.0\system32\drivers\Partizan.sys
c:\windows.0\system32\Partizan.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
c:\windows.0\system32\c_dll.dll
c:\windows.0\system32\drivers\Partizan.sys
c:\windows.0\system32\Partizan.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASKSERVICE
-------\Legacy_PARTIZAN
-------\Service_ASKService
-------\Service_getPlus(R) Helper
-------\Service_Partizan

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-25 au 2008-11-25 ))))))))))))))))))))))))))))))))))))
.

2008-11-25 15:11 . 2008-11-25 15:11 207,312 --ah----- c:\windows.0\system32\mlfcache.dat
2008-11-25 15:03 . 2008-11-25 15:03 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Apple Computer
2008-11-25 15:00 . 2008-11-25 15:00 <REP> d-------- c:\program files\Safari
2008-11-25 14:59 . 2008-11-25 14:59 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-11-25 14:58 . 2008-11-25 14:59 <REP> d-------- c:\program files\QuickTime
2008-11-25 14:58 . 2008-11-25 14:58 <REP> d-------- c:\program files\Bonjour
2008-11-25 14:58 . 2008-11-25 14:58 <REP> d-------- c:\program files\Apple Software Update
2008-11-25 14:58 . 2008-11-25 14:58 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Apple Computer
2008-11-25 14:58 . 2008-11-25 14:58 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Apple
2008-11-25 13:25 . 2008-11-25 13:25 <REP> d-------- c:\program files\AskBardis
2008-11-25 10:22 . 2008-11-25 10:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-25 10:22 . 2008-11-25 10:22 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Malwarebytes
2008-11-25 10:22 . 2008-11-25 10:22 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-11-25 10:22 . 2008-10-22 16:10 38,496 --a------ c:\windows.0\system32\drivers\mbamswissarmy.sys
2008-11-25 10:22 . 2008-10-22 16:10 15,504 --a------ c:\windows.0\system32\drivers\mbam.sys
2008-11-25 09:26 . 2008-11-25 13:00 <REP> d-------- C:\ToolBar SD
2008-11-25 09:17 . 2008-11-25 09:17 <REP> d-------- c:\program files\Trend Micro
2008-11-25 08:34 . 2008-11-25 08:34 <REP> d-------- c:\program files\Microsoft Silverlight
2008-11-25 07:24 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows.0\system32\dllcache\ieapfltr.dat
2008-11-25 07:24 . 2007-03-08 06:10 1,048,576 -----c--- c:\windows.0\system32\dllcache\ieframe.dll.mui
2008-11-24 19:56 . 2008-11-24 19:56 <REP> d-------- c:\program files\Alwil Software
2008-11-24 19:56 . 2003-03-18 21:20 1,060,864 --a------ c:\windows.0\system32\MFC71.dll
2008-11-24 19:56 . 2003-03-18 20:14 499,712 --a------ c:\windows.0\system32\MSVCP71.dll
2008-11-24 19:05 . 2008-11-24 19:05 4,096 --a------ c:\windows.0\d3dx.dat
2008-11-24 18:07 . 2008-11-24 19:22 <REP> d-------- c:\program files\PC Wizard 2008
2008-11-24 18:07 . 2007-09-15 15:11 27,136 --a------ c:\windows.0\system32\PCWizard.cpl
2008-11-22 21:36 . 2008-11-22 21:36 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Bluetooth
2008-11-22 21:33 . 2008-11-22 21:35 32 --a------ c:\windows.0\[u]0/u
2008-11-22 21:33 . 2008-11-22 21:33 0 --a------ c:\windows.0\system32\[u]0/u
2008-11-22 16:51 . 2008-09-04 22:03 56,344 --a------ c:\windows.0\system32\drivers\fssfltr.sys
2008-11-22 16:46 . 2008-11-25 10:50 <REP> d-------- c:\documents and settings\seb.PC\amsn
2008-11-22 16:45 . 2008-11-22 16:46 <REP> d-------- c:\program files\aMSN
2008-11-22 00:20 . 2008-11-22 16:49 <REP> d-------- c:\program files\Windows Live Toolbar
2008-11-22 00:20 . 2008-11-22 00:20 <REP> d-------- c:\program files\Windows Live Favorites
2008-11-22 00:20 . 2008-11-22 00:20 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-11-22 00:05 . 2008-11-22 00:05 <REP> d-------- c:\program files\Windows Installer Clean Up
2008-11-22 00:00 . 2008-11-22 00:05 <REP> d-------- c:\program files\MSECACHE
2008-11-21 23:58 . 2008-10-16 14:08 27,672 --a------ c:\windows.0\system32\wuapi.dll.mui
2008-11-21 23:42 . 2008-11-21 23:42 <REP> d-------- c:\windows.0\RestoreSafeDeleted
2008-11-21 23:40 . 2008-11-21 23:40 (2) -rahs-ot- c:\windows.0\winstart.bat
2008-11-21 23:39 . 2008-11-21 23:40 <REP> d-------- c:\program files\UnHackMe
2008-11-21 23:39 . 2005-04-03 15:02 8,944 --a------ c:\windows.0\system32\drivers\UnHackMeDrv.sys
2008-11-21 22:26 . 2008-11-21 22:26 <REP> d-------- c:\program files\AxBx
2008-11-20 00:36 . 2008-11-24 18:57 1,632 --a------ c:\windows.0\system32\d3d8caps.dat
2008-11-20 00:20 . 2001-08-23 17:46 342,336 --a--c--- c:\windows.0\system32\dllcache\banshee.dll
2008-11-20 00:20 . 2001-08-23 17:46 342,336 --a------ c:\windows.0\system32\banshee.dll
2008-11-20 00:20 . 2001-08-17 20:48 36,128 --a------ c:\windows.0\system32\drivers\banshee.sys
2008-11-20 00:20 . 2001-08-17 20:48 36,128 --a--c--- c:\windows.0\system32\dllcache\banshee.sys
2008-11-19 23:26 . 2008-11-19 23:26 <REP> d-------- c:\program files\Absolutist_Games
2008-11-19 23:26 . 2008-11-19 23:26 <REP> d-------- c:\program files\Absolutist.com
2008-11-19 03:55 . 2008-11-19 03:55 <REP> d-------- c:\documents and settings\Administrateur.SEB\Application Data\EstSoft
2008-11-19 03:55 . 2008-11-19 03:55 <REP> d-------- c:\documents and settings\Administrateur.SEB\Application Data\DAEMON Tools
2008-11-19 01:41 . 2008-11-19 01:43 <REP> d--h----- c:\documents and settings\Administrateur.SEB\Voisinage réseau
2008-11-19 01:41 . 2008-10-26 09:48 <REP> d--h----- c:\documents and settings\Administrateur.SEB\Voisinage d'impression
2008-11-19 01:41 . 2008-10-26 08:54 <REP> d--h----- c:\documents and settings\Administrateur.SEB\Modèles
2008-11-19 01:41 . 2008-11-19 01:42 <REP> dr------- c:\documents and settings\Administrateur.SEB\Mes documents
2008-11-19 01:41 . 2008-10-26 09:48 <REP> dr------- c:\documents and settings\Administrateur.SEB\Menu Démarrer
2008-11-19 01:41 . 2008-11-19 01:42 <REP> dr------- c:\documents and settings\Administrateur.SEB\Favoris
2008-11-19 01:41 . 2008-11-19 03:55 <REP> d-------- c:\documents and settings\Administrateur.SEB\Bureau
2008-11-19 01:41 . 2008-11-19 01:41 <REP> d-------- c:\documents and settings\Administrateur.SEB
2008-11-18 17:27 . 2005-11-24 19:51 245,248 --a------ c:\windows.0\system32\rt73.sys
2008-11-18 17:27 . 2008-11-18 17:27 20,747 --a------ c:\windows.0\system32\drivers\AegisP.sys
2008-11-18 17:27 . 2005-12-06 04:24 7,846 --a------ c:\windows.0\system32\rt73.cat
2008-11-16 22:13 . 2008-11-16 22:17 <REP> d-------- c:\program files\Sims2Pack Clean Installer
2008-11-14 15:05 . 2008-11-14 15:05 <REP> d-------- c:\program files\PC Inspector File Recovery
2008-11-14 15:05 . 2002-02-18 18:40 6,200 --a------ c:\windows.0\system32\INT13EXT.VXD
2008-11-14 14:19 . 2002-01-01 01:20 <REP> d-a------ c:\documents and settings\All Users.WINDOWS.0\Application Data\TEMP
2008-11-14 12:39 . 2008-11-14 12:39 <REP> dr-h----- c:\documents and settings\seb.PC\Application Data\SecuROM
2008-11-14 10:00 . 2004-08-18 09:34 442,368 -ra------ c:\windows.0\system32\vp6vfw.dll
2008-11-13 03:16 . 2008-11-14 12:39 754 --a------ c:\windows.0\WORDPAD.INI
2008-11-13 01:47 . 2008-11-13 01:47 <REP> d-------- c:\program files\ValuSoft
2008-11-12 21:05 . 2008-11-12 21:05 <REP> d---s---- c:\windows.0\system32\%SystemDrive%
2008-11-12 21:05 . 2008-11-12 21:05 22 --a------ c:\windows.0\Wininit.ini
2008-11-12 21:02 . 2008-11-12 21:02 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Canneverbe_Limited
2008-11-12 21:01 . 2008-11-12 21:01 <REP> d-------- c:\program files\CDBurnerXP
2008-11-12 20:56 . 2008-11-12 21:07 <REP> d-------- c:\program files\NCH Swift Sound
2008-11-12 20:56 . 2008-11-12 21:06 <REP> d-------- c:\program files\NCH Software
2008-11-12 20:56 . 2008-11-12 21:06 <REP> d-------- c:\documents and settings\seb.PC\Application Data\NCH Swift Sound
2008-11-12 20:56 . 2008-11-12 20:57 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\NCH Swift Sound
2008-11-12 20:56 . 2008-11-12 20:56 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\NCH Software
2008-11-12 20:56 . 2008-11-12 20:56 27,136 --a------ c:\windows.0\system32\drivers\nchssvad.sys
2008-11-12 20:45 . 2008-11-12 23:58 620 --a------ c:\windows.0\eReg.dat
2008-11-12 20:39 . 2008-11-12 20:40 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-11-12 20:35 . 2008-11-12 20:35 <REP> d-------- c:\documents and settings\seb.PC\Application Data\DAEMON Tools
2008-11-12 20:21 . 2008-11-12 20:21 <REP> d-------- c:\documents and settings\seb.PC\Application Data\FarStone
2008-11-12 20:19 . 2008-11-12 20:19 65,536 --a------ c:\windows.0\system32\VDPersns.dat
2008-11-12 20:18 . 2004-09-22 11:46 37,409 --a------ c:\windows.0\system32\drivers\fsRamDsk.sys
2008-11-12 20:15 . 2004-09-22 11:46 77,824 --------- c:\windows.0\system32\RDrv2KInterface.dll
2008-11-12 20:15 . 2004-01-13 04:51 53,248 --------- c:\windows.0\system32\RDrvNTInterface.dll
2008-11-12 20:15 . 2004-03-12 07:44 36,864 --------- c:\windows.0\system32\unVHDDrvExe.exe
2008-11-12 20:15 . 2004-03-12 07:44 36,864 --------- c:\windows.0\system32\inVHDDrvExe.exe
2008-11-12 20:15 . 2004-07-17 08:33 32,768 --------- c:\windows.0\system32\RDrv9xInterface.dll
2008-11-12 20:15 . 2004-06-29 09:03 28,672 --------- c:\windows.0\system32\RDrvInterface.dll
2008-11-12 17:35 . 2008-11-12 20:36 717,296 --a------ c:\windows.0\system32\drivers\sptd.sys
2008-11-12 15:54 . 2008-11-12 15:54 <REP> d-------- c:\windows.0\Pastry Passion
2008-11-12 15:54 . 2008-11-12 15:54 <REP> d-------- c:\program files\Pastry Passion
2008-11-12 15:54 . 2008-11-12 15:54 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Zylom
2008-11-12 15:24 . 2008-11-19 00:10 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Azureus
2008-11-12 15:24 . 2008-11-12 15:24 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Azureus
2008-11-12 15:22 . 2008-11-12 15:23 <REP> d-------- c:\program files\Vuze
2008-11-12 15:22 . 2008-11-12 15:22 <REP> d-------- c:\program files\Fichiers communs\i4j_jres
2008-11-12 14:21 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows.0\system32\dllcache\msxml3.dll
2008-11-12 14:21 . 2008-10-24 12:21 455,296 -----c--- c:\windows.0\system32\dllcache\mrxsmb.sys
2008-11-12 02:28 . 2008-11-12 02:28 <REP> d-------- c:\program files\Fichiers communs\DirectX
2008-11-12 02:27 . 2008-11-18 11:19 <REP> d-------- c:\program files\EA GAMES
2008-11-12 02:06 . 2008-11-12 17:49 <REP> d-------- c:\program files\denouvel
2008-11-12 02:06 . 2008-11-12 02:06 796,672 --a------ c:\windows.0\GPInstall.exe
2008-11-12 02:06 . 2000-09-29 18:00 8,784 --a------ c:\windows.0\F_France.gpl
2008-11-12 01:07 . 2008-11-12 01:07 <REP> d-------- c:\program files\MSBuild
2008-11-12 01:01 . 2008-11-12 01:09 <REP> d-------- c:\windows.0\system32\XPSViewer
2008-11-12 01:00 . 2006-06-29 13:07 14,048 --------- c:\windows.0\system32\spmsg2.dll
2008-11-11 01:28 . 2008-11-11 01:28 <REP> d-------- C:\GamersFirst
2008-11-08 03:13 . 2008-11-08 03:13 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\NOS
2008-11-07 18:42 . 2008-11-07 18:43 <REP> d-------- c:\documents and settings\seb.PC\Application Data\dvdcss
2008-11-07 00:45 . 2008-11-12 21:04 <REP> d-------- c:\program files\My BootDisk
2008-11-04 10:53 . 2008-06-14 18:33 272,768 -----c--- c:\windows.0\system32\dllcache\bthport.sys
2008-11-04 10:53 . 2008-08-14 11:04 138,496 -----c--- c:\windows.0\system32\dllcache\afd.sys
2008-11-04 10:53 . 2008-06-24 17:44 74,240 -----c--- c:\windows.0\system32\dllcache\mscms.dll
2008-11-04 10:52 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows.0\system32\dllcache\ntoskrnl.exe
2008-11-04 10:52 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows.0\system32\dllcache\ntkrnlmp.exe
2008-11-04 10:52 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows.0\system32\dllcache\ntkrnlpa.exe
2008-11-04 10:52 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows.0\system32\dllcache\ntkrpamp.exe
2008-11-04 10:52 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows.0\system32\dllcache\win32k.sys
2008-11-04 10:52 . 2008-05-07 06:11 1,294,336 -----c--- c:\windows.0\system32\dllcache\quartz.dll
2008-11-04 10:52 . 2008-04-11 20:05 691,712 -----c--- c:\windows.0\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 07:06 --------- d-----w c:\program files\Opera
2008-11-23 12:18 98,304 ----a-w c:\windows.0\DUMP00f5.tmp
2008-11-22 15:51 --------- d-----w c:\program files\Windows Live
2008-11-22 15:38 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\WLInstaller
2008-11-22 04:25 --------- d-----w c:\program files\MSN Messenger
2008-11-21 16:27 --------- d-----w c:\documents and settings\seb.PC\Application Data\MSN6
2008-11-18 16:30 --------- d-----w c:\documents and settings\Anais\Application Data\Spyware Terminator
2008-11-18 16:27 --------- d-----w c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor
2008-11-15 19:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-14 14:51 --------- d-----w c:\program files\Navilog1
2008-11-12 20:04 --------- d-----w c:\program files\MagicISO
2008-11-08 02:15 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-10-27 19:35 --------- d-----w c:\program files\ma-config.com
2008-10-27 18:45 --------- d-----w c:\program files\Kill Process
2008-10-26 08:32 --------- d-----w c:\program files\Intel
2008-10-26 08:27 --------- d-----w c:\program files\Microsoft
2008-10-26 08:27 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\ma-config.com
2008-10-26 08:06 --------- d-----w c:\program files\JEUX
2008-10-26 07:59 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-25 17:31 --------- d-----w c:\program files\LimeWire
2008-10-25 12:49 --------- d-----w c:\program files\Elaborate Bytes
2008-10-24 20:21 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-10-24 19:01 --------- d-----w c:\program files\3D Driving-School
2008-10-24 11:21 455,296 ----a-w c:\windows.0\system32\drivers\mrxsmb.sys
2008-10-24 09:39 --------- d-----w c:\program files\Fichiers communs\Panda Software
2008-10-24 09:24 --------- d-----w c:\program files\Valve
2008-10-24 07:55 --------- d-----w c:\program files\Paint.NET
2008-10-24 07:55 --------- d-----w c:\program files\eMule
2008-10-24 07:52 --------- d-----w c:\program files\Dofus
2008-10-24 07:43 --------- d-----w c:\program files\FileZilla FTP Client
2008-10-23 20:11 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-10-23 19:22 --------- d-----w c:\documents and settings\Anais\Application Data\Zylom Games
2008-10-23 19:05 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller
2008-10-23 19:05 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-10-23 19:05 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-10-23 19:05 --------- d-----w c:\program files\Fichiers communs\Java
2008-10-23 19:04 --------- d-----w c:\program files\Fichiers communs\Thraex Software(2)
2008-10-23 19:04 --------- d-----w c:\program files\F-Secure
2008-10-21 00:58 --------- d-----w c:\program files\G DATA
2008-10-16 13:13 202,776 ----a-w c:\windows.0\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows.0\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows.0\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows.0\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows.0\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows.0\system32\wuauclt.exe
2008-10-16 13:09 43,544 -c--a-w c:\windows.0\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows.0\system32\wups.dll
2008-10-16 13:06 208,744 ----a-w c:\windows.0\system32\muweb.dll
2008-09-15 15:26 1,846,528 ----a-w c:\windows.0\system32\win32k.sys
2008-09-10 01:15 1,307,648 ------w c:\windows.0\system32\msxml6.dll
2008-09-08 23:03 51,712 ----a-w c:\windows.0\system32\sirenacm.dll
2008-09-05 15:04 288,768 ----a-w c:\windows.0\WLXPGSS.SCR
2008-09-04 17:16 1,106,944 ----a-w c:\windows.0\system32\msxml3.dll
2008-08-29 09:18 87,336 ----a-w c:\windows.0\system32\dns-sd.exe
2008-08-29 08:53 65,536 ----a-w c:\windows.0\system32\jdns_sd.dll
2008-08-29 08:53 61,440 ----a-w c:\windows.0\system32\dnssd.dll
2008-08-26 08:11 826,368 ----a-w c:\windows.0\system32\wininet.dll
2006-10-25 12:17 258 ----a-w c:\documents and settings\seb\dat.bin
2006-06-20 18:22 9,070,256 ----a-r c:\program files\coccipack.ccp
.

((((((((((((((((((((((((((((( snapshot@2008-11-25_13.22.53.67 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-06 01:34:38 216,800 -c----w c:\windows.0\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:47 394,976 -c----w c:\windows.0\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
+ 2007-08-13 17:54:10 765,952 -c----w c:\windows.0\ie7updates\KB938127-v2-IE7\vgx.dll
+ 2008-06-23 16:28:17 124,928 -c----w c:\windows.0\ie7updates\KB956390-IE7\advpack.dll
+ 2008-06-23 16:28:17 347,136 -c----w c:\windows.0\ie7updates\KB956390-IE7\dxtmsft.dll
+ 2008-06-23 16:28:17 214,528 -c----w c:\windows.0\ie7updates\KB956390-IE7\dxtrans.dll
+ 2008-06-23 16:28:17 133,120 -c----w c:\windows.0\ie7updates\KB956390-IE7\extmgr.dll
+ 2008-06-23 16:28:17 63,488 -c----w c:\windows.0\ie7updates\KB956390-IE7\icardie.dll
+ 2008-06-23 09:21:30 70,656 -c----w c:\windows.0\ie7updates\KB956390-IE7\ie4uinit.exe
+ 2008-06-23 16:28:18 153,088 -c----w c:\windows.0\ie7updates\KB956390-IE7\ieakeng.dll
+ 2008-06-23 16:28:18 230,400 -c----w c:\windows.0\ie7updates\KB956390-IE7\ieaksie.dll
+ 2008-06-21 05:23:54 161,792 -c----w c:\windows.0\ie7updates\KB956390-IE7\ieakui.dll
+ 2008-06-23 16:28:18 383,488 -c----w c:\windows.0\ie7updates\KB956390-IE7\ieapfltr.dll
+ 2008-06-23 16:28:18 384,512 -c----w c:\windows.0\ie7updates\KB956390-IE7\iedkcs32.dll
+ 2008-06-23 16:28:19 6,066,176 -c----w c:\windows.0\ie7updates\KB956390-IE7\ieframe.dll
+ 2008-06-23 16:28:19 44,544 -c----w c:\windows.0\ie7updates\KB956390-IE7\iernonce.dll
+ 2008-06-23 16:28:20 267,776 -c----w c:\windows.0\ie7updates\KB956390-IE7\iertutil.dll
+ 2008-06-23 09:20:26 13,824 -c----w c:\windows.0\ie7updates\KB956390-IE7\ieudinit.exe
+ 2008-06-23 09:21:49 625,664 -c----w c:\windows.0\ie7updates\KB956390-IE7\iexplore.exe
+ 2008-06-23 16:28:20 27,648 -c----w c:\windows.0\ie7updates\KB956390-IE7\jsproxy.dll
+ 2008-06-23 16:28:20 459,264 -c----w c:\windows.0\ie7updates\KB956390-IE7\msfeeds.dll
+ 2008-06-23 16:28:20 52,224 -c----w c:\windows.0\ie7updates\KB956390-IE7\msfeedsbs.dll
+ 2008-06-24 09:28:24 3,592,192 -c----w c:\windows.0\ie7updates\KB956390-IE7\mshtml.dll
+ 2008-06-23 16:28:22 477,696 -c----w c:\windows.0\ie7updates\KB956390-IE7\mshtmled.dll
+ 2008-06-23 16:28:22 193,024 -c----w c:\windows.0\ie7updates\KB956390-IE7\msrating.dll
+ 2008-06-23 16:28:22 671,232 -c----w c:\windows.0\ie7updates\KB956390-IE7\mstime.dll
+ 2008-06-23 16:28:22 102,912 -c----w c:\windows.0\ie7updates\KB956390-IE7\occache.dll
+ 2008-06-23 16:28:22 44,544 -c----w c:\windows.0\ie7updates\KB956390-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 -c----w c:\windows.0\ie7updates\KB956390-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w c:\windows.0\ie7updates\KB956390-IE7\spuninst\updspapi.dll
+ 2008-06-23 16:28:22 105,984 -c----w c:\windows.0\ie7updates\KB956390-IE7\url.dll
+ 2008-06-23 16:28:23 1,159,680 -c----w c:\windows.0\ie7updates\KB956390-IE7\urlmon.dll
+ 2008-06-23 16:28:23 233,472 -c----w c:\windows.0\ie7updates\KB956390-IE7\webcheck.dll
+ 2008-06-23 16:28:23 826,368 -c----w c:\windows.0\ie7updates\KB956390-IE7\wininet.dll
+ 2008-11-25 14:00:27 307,200 ----a-r c:\windows.0\Installer\{582D2A53-F426-4C5E-A2E6-43C1AB36B907}\SafariIco.exe
+ 2008-11-25 13:58:21 27,136 ----a-r c:\windows.0\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2008-11-25 13:58:33 86,016 ----a-r c:\windows.0\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\PrntWzrdIco.exe
- 2008-06-23 16:28:17 124,928 ----a-w c:\windows.0\system32\advpack.dll
+ 2008-08-26 08:11:45 124,928 ----a-w c:\windows.0\system32\advpack.dll
- 2008-06-23 16:28:17 124,928 ----a-w c:\windows.0\system32\dllcache\advpack.dll
+ 2008-08-26 08:11:45 124,928 -c--a-w c:\windows.0\system32\dllcache\advpack.dll
- 2008-06-23 16:28:17 347,136 ----a-w c:\windows.0\system32\dllcache\dxtmsft.dll
+ 2008-08-26 08:11:45 347,136 -c--a-w c:\windows.0\system32\dllcache\dxtmsft.dll
- 2008-06-23 16:28:17 214,528 ----a-w c:\windows.0\system32\dllcache\dxtrans.dll
+ 2008-08-26 08:11:45 214,528 -c--a-w c:\windows.0\system32\dllcache\dxtrans.dll
- 2008-06-23 16:28:17 133,120 ----a-w c:\windows.0\system32\dllcache\extmgr.dll
+ 2008-08-26 08:11:45 133,120 -c--a-w c:\windows.0\system32\dllcache\extmgr.dll
- 2008-06-23 16:28:17 63,488 ----a-w c:\windows.0\system32\dllcache\icardie.dll
+ 2008-08-26 08:11:45 63,488 -c--a-w c:\windows.0\system32\dllcache\icardie.dll
- 2008-06-23 09:21:30 70,656 ----a-w c:\windows.0\system32\dllcache\ie4uinit.exe
+ 2008-08-25 08:39:40 70,656 -c--a-w c:\windows.0\system32\dllcache\ie4uinit.exe
- 2008-06-23 16:28:18 153,088 ----a-w c:\windows.0\system32\dllcache\ieakeng.dll
+ 2008-08-26 08:11:45 153,088 -c--a-w c:\windows.0\system32\dllcache\ieakeng.dll
- 2008-06-23 16:28:18 230,400 ----a-w c:\windows.0\system32\dllcache\ieaksie.dll
+ 2008-08-26 08:11:45 230,400 -c--a-w c:\windows.0\system32\dllcache\ieaksie.dll
- 2008-06-21 05:23:54 161,792 ----a-w c:\windows.0\system32\dllcache\ieakui.dll
+ 2008-08-23 05:54:51 161,792 -c--a-w c:\windows.0\system32\dllcache\ieakui.dll
- 2008-06-23 16:28:18 383,488 ----a-w c:\windows.0\system32\dllcache\ieapfltr.dll
+ 2008-08-26 08:11:46 383,488 -c--a-w c:\windows.0\system32\dllcache\ieapfltr.dll
- 2008-06-23 16:28:18 384,512 ----a-w c:\windows.0\system32\dllcache\iedkcs32.dll
+ 2008-08-26 08:11:46 384,512 -c--a-w c:\windows.0\system32\dllcache\iedkcs32.dll
- 2008-06-23 16:28:19 6,066,176 ----a-w c:\windows.0\system32\dllcache\ieframe.dll
+ 2008-10-03 17:12:27 6,066,176 -c--a-w c:\windows.0\system32\dllcache\ieframe.dll
- 2008-06-23 16:28:19 44,544 ----a-w c:\windows.0\system32\dllcache\iernonce.dll
+ 2008-08-26 08:11:48 44,544 -c--a-w c:\windows.0\system32\dllcache\iernonce.dll
- 2008-06-23 16:28:20 267,776 ----a-w c:\windows.0\system32\dllcache\iertutil.dll
+ 2008-08-26 08:11:48 267,776 -c--a-w c:\windows.0\system32\dllcache\iertutil.dll
- 2008-06-23 09:20:26 13,824 ----a-w c:\windows.0\system32\dllcache\ieudinit.exe
+ 2008-08-25 08:38:00 13,824 -c--a-w c:\windows.0\system32\dllcache\ieudinit.exe
- 2008-06-23 09:21:49 625,664 ----a-w c:\windows.0\system32\dllcache\iexplore.exe
+ 2008-08-23 05:56:15 635,848 -c--a-w c:\windows.0\system32\dllcache\iexplore.exe
- 2008-06-23 16:28:20 27,648 ----a-w c:\windows.0\system32\dllcache\jsproxy.dll
+ 2008-08-26 08:11:49 27,648 -c--a-w c:\windows.0\system32\dllcache\jsproxy.dll
- 2008-06-23 16:28:20 459,264 ----a-w c:\windows.0\system32\dllcache\msfeeds.dll
+ 2008-08-26 08:11:49 459,264 -c--a-w c:\windows.0\system32\dllcache\msfeeds.dll
- 2008-06-23 16:28:20 52,224 ----a-w c:\windows.0\system32\dllcache\msfeedsbs.dll
+ 2008-08-26 08:11:49 52,224 -c--a-w c:\windows.0\system32\dllcache\msfeedsbs.dll
- 2008-06-24 09:28:24 3,592,192 ----a-w c:\windows.0\system32\dllcache\mshtml.dll
+ 2008-08-27 09:11:52 3,593,216 -c--a-w c:\windows.0\system32\dllcache\mshtml.dll
- 2008-06-23 16:28:22 477,696 ----a-w c:\windows.0\system32\dllcache\mshtmled.dll
+ 2008-08-26 08:11:52 477,696 -c--a-w c:\windows.0\system32\dllcache\mshtmled.dll
- 2008-06-23 16:28:22 193,024 ----a-w c:\windows.0\system32\dllcache\msrating.dll
+ 2008-08-26 08:11:52 193,024 -c--a-w c:\windows.0\system32\dllcache\msrating.dll
- 2008-06-23 16:28:22 671,232 ----a-w c:\windows.0\system32\dllcache\mstime.dll
+ 2008-08-26 08:11:52 671,232 -c--a-w c:\windows.0\system32\dllcache\mstime.dll
- 2008-06-23 16:28:22 102,912 ----a-w c:\windows.0\system32\dllcache\occache.dll
+ 2008-08-26 08:11:52 102,912 -c--a-w c:\windows.0\system32\dllcache\occache.dll
- 2008-06-23 16:28:22 44,544 ----a-w c:\windows.0\system32\dllcache\pngfilt.dll
+ 2008-08-26 08:11:52 44,544 -c--a-w c:\windows.0\system32\dllcache\pngfilt.dll
- 2008-06-23 16:28:22 105,984 ----a-w c:\windows.0\system32\dllcache\url.dll
+ 2008-08-26 08:11:52 105,984 -c--a-w c:\windows.0\system32\dllcache\url.dll
- 2008-06-23 16:28:23 1,159,680 ----a-w c:\windows.0\system32\dllcache\urlmon.dll
+ 2008-08-26 08:11:53 1,159,680 -c--a-w c:\windows.0\system32\dllcache\urlmon.dll
- 2007-08-13 17:54:10 765,952 ----a-w c:\windows.0\system32\dllcache\vgx.dll
+ 2008-05-27 17:25:06 765,952 -c--a-w c:\windows.0\system32\dllcache\vgx.dll
- 2008-06-23 16:28:23 233,472 ----a-w c:\windows.0\system32\dllcache\webcheck.dll
+ 2008-08-26 08:11:53 233,472 -c--a-w c:\windows.0\system32\dllcache\webcheck.dll
- 2008-06-23 16:28:23 826,368 ----a-w c:\windows.0\system32\dllcache\wininet.dll
+ 2008-08-26 08:11:54 826,368 -c--a-w c:\windows.0\system32\dllcache\wininet.dll
- 2008-06-23 16:28:17 347,136 ----a-w c:\windows.0\system32\dxtmsft.dll
+ 2008-08-26 08:11:45 347,136 ----a-w c:\windows.0\system32\dxtmsft.dll
- 2008-06-23 16:28:17 214,528 ----a-w c:\windows.0\system32\dxtrans.dll
+ 2008-08-26 08:11:45 214,528 ----a-w c:\windows.0\system32\dxtrans.dll
- 2008-06-23 16:28:17 133,120 ----a-w c:\windows.0\system32\extmgr.dll
+ 2008-08-26 08:11:45 133,120 ----a-w c:\windows.0\system32\extmgr.dll
- 2008-06-23 16:28:17 63,488 ----a-w c:\windows.0\system32\icardie.dll
+ 2008-08-26 08:11:45 63,488 ----a-w c:\windows.0\system32\icardie.dll
- 2008-06-23 09:21:30 70,656 ----a-w c:\windows.0\system32\ie4uinit.exe
+ 2008-08-25 08:39:40 70,656 ----a-w c:\windows.0\system32\ie4uinit.exe
- 2008-06-23 16:28:18 153,088 ----a-w c:\windows.0\system32\ieakeng.dll
+ 2008-08-26 08:11:45 153,088 ----a-w c:\windows.0\system32\ieakeng.dll
- 2008-06-23 16:28:18 230,400 ----a-w c:\windows.0\system32\ieaksie.dll
+ 2008-08-26 08:11:45 230,400 ----a-w c:\windows.0\system32\ieaksie.dll
- 2008-06-21 05:23:54 161,792 ----a-w c:\windows.0\system32\ieakui.dll
+ 2008-08-23 05:54:51 161,792 ----a-w c:\windows.0\system32\ieakui.dll
- 2008-06-23 16:28:18 383,488 ----a-w c:\windows.0\system32\ieapfltr.dll
+ 2008-08-26 08:11:46 383,488 ----a-w c:\windows.0\system32\ieapfltr.dll
- 2008-06-23 16:28:18 384,512 ----a-w c:\windows.0\system32\iedkcs32.dll
+ 2008-08-26 08:11:46 384,512 ----a-w c:\windows.0\system32\iedkcs32.dll
- 2008-06-23 16:28:19 6,066,176 ----a-w c:\windows.0\system32\ieframe.dll
+ 2008-10-03 17:12:27 6,066,176 ----a-w c:\windows.0\system32\ieframe.dll
- 2008-06-23 16:28:19 44,544 ----a-w c:\windows.0\system32\iernonce.dll
+ 2008-08-26 08:11:48 44,544 ----a-w c:\windows.0\system32\iernonce.dll
- 2008-06-23 16:28:20 267,776 ----a-w c:\windows.0\system32\iertutil.dll
+ 2008-08-26 08:11:48 267,776 ----a-w c:\windows.0\system32\iertutil.dll
- 2008-06-23 09:20:26 13,824 ----a-w c:\windows.0\system32\ieudinit.exe
+ 2008-08-25 08:38:00 13,824 ----a-w c:\windows.0\system32\ieudinit.exe
- 2008-06-23 16:28:20 27,648 ----a-w c:\windows.0\system32\jsproxy.dll
+ 2008-08-26 08:11:49 27,648 ----a-w c:\windows.0\system32\jsproxy.dll
- 2008-06-23 16:28:20 459,264 ----a-w c:\windows.0\system32\msfeeds.dll
+ 2008-08-26 08:11:49 459,264 ----a-w c:\windows.0\system32\msfeeds.dll
- 2008-06-23 16:28:20 52,224 ----a-w c:\windows.0\system32\msfeedsbs.dll
+ 2008-08-26 08:11:49 52,224 ----a-w c:\windows.0\system32\msfeedsbs.dll
- 2008-06-24 09:28:24 3,592,192 ----a-w c:\windows.0\system32\mshtml.dll
+ 2008-08-27 09:11:52 3,593,216 ----a-w c:\windows.0\system32\mshtml.dll
- 2008-06-23 16:28:22 477,696 ----a-w c:\windows.0\system32\mshtmled.dll
+ 2008-08-26 08:11:52 477,696 ----a-w c:\windows.0\system32\mshtmled.dll
- 2008-06-23 16:28:22 193,024 ----a-w c:\windows.0\system32\msrating.dll
+ 2008-08-26 08:11:52 193,024 ----a-w c:\windows.0\system32\msrating.dll
- 2008-06-23 16:28:22 671,232 ----a-w c:\windows.0\system32\mstime.dll
+ 2008-08-26 08:11:52 671,232 ----a-w c:\windows.0\system32\mstime.dll
- 2008-06-23 16:28:22 102,912 ----a-w c:\windows.0\system32\occache.dll
+ 2008-08-26 08:11:52 102,912 ----a-w c:\windows.0\system32\occache.dll
- 2008-06-23 16:28:22 44,544 ----a-w c:\windows.0\system32\pngfilt.dll
+ 2008-08-26 08:11:52 44,544 ----a-w c:\windows.0\system32\pngfilt.dll
- 2008-07-08 13:03:54 18,296 ------w c:\windows.0\system32\spmsg.dll
+ 2007-11-30 12:39:29 18,296 ------w c:\windows.0\system32\spmsg.dll
- 2008-06-23 16:28:22 105,984 ----a-w c:\windows.0\system32\url.dll
+ 2008-08-26 08:11:52 105,984 ----a-w c:\windows.0\system32\url.dll
- 2008-06-23 16:28:23 1,159,680 ----a-w c:\windows.0\system32\urlmon.dll
+ 2008-08-26 08:11:53 1,159,680 ----a-w c:\windows.0\system32\urlmon.dll
- 2008-06-23 16:28:23 233,472 ----a-w c:\windows.0\system32\webcheck.dll
+ 2008-08-26 08:11:53 233,472 ----a-w c:\windows.0\system32\webcheck.dll
+ 2008-11-25 16:29:05 16,384 ----atw c:\windows.0\Temp\Perflib_Perfdata_6a4.dat
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows.0\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-08-26 c:\windows.0\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
"DisableCAD"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\maureen84\\condition zero\\hl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\aMSN\\bin\\wish.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;c:\windows.0\system32\drivers\aswSP.sys [2008-11-24 110160]
R2 aswFsBlk;aswFsBlk;c:\windows.0\system32\DRIVERS\aswFsBlk.sys [2008-11-24 20560]
R2 fssfltr;FssFltr;c:\windows.0\system32\DRIVERS\fssfltr.sys [2008-11-22 56344]
S0 FVDSCSI;FVDSCSI;c:\windows.0\system32\DRIVERS\fvdscsi.sys []
S3 banshee;banshee;c:\windows.0\system32\DRIVERS\banshee.sys [2008-11-20 36128]
S3 fsssvc;Windows Live Contrôle parental;"c:\program files\Windows Live\Family Safety\fsssvc.exe" [2008-09-04 512536]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows.0\system32\drivers\mbamswissarmy.sys [2008-11-25 38496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c05bc55f-a338-11dd-9606-806d6172696f}]
\Shell\AutoRun\command - G:\setup.exe
.
Contenu du dossier 'Tâches planifiées'

2008-11-25 c:\windows.0\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-25 17:29:31
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows.0\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-11-25 17:33:18 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-25 16:33:14
ComboFix2.txt 2008-11-25 12:23:31

Avant-CF: 2 284 105 728 octets libres
Après-CF: 2,280,157,184 octets libres

458 --- E O F --- 2008-11-25 16:20:37

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:35:39, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\explorer.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 1\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS.0\system32\cisvc.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Voici le premier rapport

c:\windows.0\system32\banshee.dll

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.24.3 2008.11.25 -
AntiVir 7.9.0.35 2008.11.25 -
Authentium 5.1.0.4 2008.11.25 -
Avast 4.8.1281.0 2008.11.24 -
AVG 8.0.0.199 2008.11.25 -
BitDefender 7.2 2008.11.25 -
CAT-QuickHeal 10.00 2008.11.25 -
ClamAV 0.94.1 2008.11.25 -
DrWeb 4.44.0.09170 2008.11.25 -
eSafe 7.0.17.0 2008.11.25 -
eTrust-Vet 31.6.6227 2008.11.25 -
Ewido 4.0 2008.11.25 -
F-Prot 4.4.4.56 2008.11.24 -
F-Secure 8.0.14332.0 2008.11.25 -
Fortinet 3.117.0.0 2008.11.25 -
GData 19 2008.11.25 -
Ikarus T3.1.1.45.0 2008.11.25 -
K7AntiVirus 7.10.532 2008.11.24 -
Kaspersky 7.0.0.125 2008.11.25 -
McAfee 5444 2008.11.24 -
McAfee+Artemis 5444 2008.11.24 -
Microsoft 1.4104 2008.11.25 -
NOD32 3638 2008.11.25 -
Norman 5.80.02 2008.11.25 -
Panda 9.0.0.4 2008.11.25 -
PCTools 4.4.2.0 2008.11.25 -
Prevx1 V2 2008.11.25 -
Rising 21.05.12.00 2008.11.25 -
SecureWeb-Gateway 6.7.6 2008.11.25 -
Sophos 4.35.0 2008.11.25 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.25 -
TheHacker 6.3.1.1.162 2008.11.25 -
TrendMicro 8.700.0.1004 2008.11.25 -
VBA32 3.12.8.9 2008.11.24 -
ViRobot 2008.11.25.1485 2008.11.25 -
VirusBuster 4.5.11.0 2008.11.24 -
Information additionnelle
File size: 342336 bytes
MD5...: d72114d283c731ed4ad633cd4afc0f8d
SHA1..: 68cb2a223d5414d18ca1da58f8f055bfd7ac1e09
SHA256: 84c2daab33e8d100cad81a647730191567a3781c678d8d9f5b6ffbbcec740211
SHA512: 058ab7e8f3485e4ae1a41eb11089478f032025e87d71169d1d7cb8b5f5fbc141
a0cf54e64afff44517e7a99258d5f017082d70b661b2b4fee6381d5e05039615
ssdeep: 6144:SnvTO/6wmRC+TqH32UNbQBwrl9OV1+fkxlwBtSZfdpEH7MvrOvyCgCqPg3O
Am:a7OY5qy0vOV1+ciTJz3d
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xbff279a0L
timedatestamp.....: 0x3b853373 (Thu Aug 23 16:46:43 2001)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x2c0 0x4b12f 0x4b140 6.11 a7c2687c0fa1b6f1a57d27bd006111aa
.rdata 0x4b400 0x652 0x660 4.58 28b22ddefd4969bef1585d3f9ff1b063
.data 0x4ba60 0x4ec8 0x4ee0 1.44 32eb3e70f105c7d2c2db55abe71f9f80
INIT 0x50940 0x33c 0x340 5.27 2ad87275f3349a0fb411b4dc14aa612e
.rsrc 0x50c80 0x840 0x840 3.44 915eac8d87344c2cdcc6ded274e04997
.reloc 0x514c0 0x247e 0x2480 6.28 573ed73be94152a7b4200d8cccef5bff

( 1 imports )
> WIN32K.SYS: XLATEOBJ_piVector, EngBitBlt, CLIPOBJ_bEnum, CLIPOBJ_cEnumStart, BRUSHOBJ_pvGetRbrush, EngCopyBits, BRUSHOBJ_pvAllocRbrush, EngAllocMem, EngFreeMem, EngModifySurface, EngCreateDeviceSurface, EngDeleteSurface, EngDeviceIoControl, EngCreateSemaphore, EngDeleteSemaphore, PATHOBJ_vGetBounds, PATHOBJ_bEnum, PATHOBJ_vEnumStart, VidMemFree, HeapVidMemAllocAligned, EngCreateDeviceBitmap, EngUnlockSurface, EngLockSurface, EngAssociateSurface, EngCreateBitmap, PATHOBJ_bEnumClipLines, PATHOBJ_vEnumStartClipLines, EngCreatePalette, EngDeletePalette, PALOBJ_cGetColors, EngStretchBlt, STROBJ_bEnum

@the prole deuxieme
C:\windows.0\system32\drivers\banshee.sys

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.24.3 2008.11.25 -
AntiVir 7.9.0.35 2008.11.25 -
Authentium 5.1.0.4 2008.11.25 -
Avast 4.8.1281.0 2008.11.24 -
AVG 8.0.0.199 2008.11.25 -
BitDefender 7.2 2008.11.25 -
CAT-QuickHeal 10.00 2008.11.25 -
ClamAV 0.94.1 2008.11.25 -
DrWeb 4.44.0.09170 2008.11.25 -
eSafe 7.0.17.0 2008.11.25 -
eTrust-Vet 31.6.6227 2008.11.25 -
Ewido 4.0 2008.11.25 -
F-Prot 4.4.4.56 2008.11.24 -
F-Secure 8.0.14332.0 2008.11.25 -
Fortinet 3.117.0.0 2008.11.25 -
GData 19 2008.11.25 -
Ikarus T3.1.1.45.0 2008.11.25 -
K7AntiVirus 7.10.532 2008.11.24 -
Kaspersky 7.0.0.125 2008.11.25 -
McAfee 5444 2008.11.24 -
McAfee+Artemis 5444 2008.11.24 -
Microsoft 1.4104 2008.11.25 -
NOD32 3638 2008.11.25 -
Norman 5.80.02 2008.11.25 -
Panda 9.0.0.4 2008.11.25 -
PCTools 4.4.2.0 2008.11.25 -
Prevx1 V2 2008.11.25 -
Rising 21.05.12.00 2008.11.25 -
SecureWeb-Gateway 6.7.6 2008.11.25 -
Sophos 4.35.0 2008.11.25 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.25 -
TheHacker 6.3.1.1.162 2008.11.25 -
TrendMicro 8.700.0.1004 2008.11.25 -
VBA32 3.12.8.9 2008.11.24 -
ViRobot 2008.11.25.1485 2008.11.25 -
VirusBuster 4.5.11.0 2008.11.24 -
Information additionnelle
File size: 36128 bytes
MD5...: bb3c14496af05ece613b4e2df290281b
SHA1..: ddb333da2355e9938d33f4b5b476898d822bef4f
SHA256: 80091c31d040911b8a60fe4d583cfebb0ca63d5575d270af46dc16eb7041c4fe
SHA512: 7fbf218442e9df4887b498de2210148a86609d0a5bca2266a0d0040bf9631c80
ae5bb5bd940a0995b0e984a4989b70815ce67d96e6ef7f3a1322361e5b48516e
ssdeep: 384:THuLQUKo488IxWHMViYrL1JYt57FU/fff4OHIoSQYgv6yqFQYgv6yqB1hBXy
X:DAjv4OWsxrLjEFUnff4OooCRi
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x12e14
timedatestamp.....: 0x3abb2bf8 (Fri Mar 23 10:56:56 2001)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x320 0x15da 0x15e0 6.36 40486b876e520059aa378bbcf61e2d7f
.rdata 0x1900 0xdb 0xe0 4.15 eff817f26ac2ab7f2c29477467af1a43
.data 0x19e0 0x14 0x20 0.40 be5d76b7ad7b123b26e823941a8b4d6c
PAGE 0x1a00 0x1887 0x18a0 6.14 3bd0b5651e69e1c31e5ae74c19b8f386
PAGE 0x32a0 0x4b54 0x4b60 2.99 9b284475542f261c108cf5b70c9cbbc4
INIT 0x7e00 0x28e 0x2a0 4.54 90e7cbdf8dff8e40c38de5523e057246
.rsrc 0x80a0 0x7e8 0x800 3.44 3c5be6604a9105f2b817f39ef4f0a1af
.reloc 0x88a0 0x46c 0x480 5.29 4dd3c9c26d4a5bde0aaa7c273300da2b

( 1 imports )
> VIDEOPRT.SYS: VideoPortReadPortUchar, VideoPortDDCMonitorHelper, VideoPortSetRegistryParameters, VideoPortFreeDeviceBase, VideoPortScanRom, VideoPortGetDeviceBase, VideoPortSetBusData, VideoPortGetBusData, VideoPortWritePortUshort, VideoPortWritePortUchar, VideoPortReadPortUlong, VideoPortWritePortUlong, VideoPortMapMemory, VideoPortUnmapMemory, VideoPortInt10, VideoPortZeroMemory, VideoPortInitialize, VideoPortMoveMemory, VideoPortGetRegistryParameters, VideoPortGetAccessRanges

@the prole troisieme c:\program files\Absolutist.com ( c'est un jeu de billiard)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.24.3 2008.11.25 -
AntiVir 7.9.0.35 2008.11.25 -
Authentium 5.1.0.4 2008.11.25 -
Avast 4.8.1281.0 2008.11.24 -
AVG 8.0.0.199 2008.11.25 -
BitDefender 7.2 2008.11.25 -
CAT-QuickHeal 10.00 2008.11.25 -
ClamAV 0.94.1 2008.11.25 -
DrWeb 4.44.0.09170 2008.11.25 -
eSafe 7.0.17.0 2008.11.25 -
eTrust-Vet 31.6.6227 2008.11.25 -
Ewido 4.0 2008.11.25 -
F-Prot 4.4.4.56 2008.11.24 -
F-Secure 8.0.14332.0 2008.11.25 -
Fortinet 3.117.0.0 2008.11.25 -
GData 19 2008.11.25 -
Ikarus T3.1.1.45.0 2008.11.25 -
K7AntiVirus 7.10.532 2008.11.24 -
Kaspersky 7.0.0.125 2008.11.25 -
McAfee 5444 2008.11.24 -
McAfee+Artemis 5444 2008.11.24 -
Microsoft 1.4104 2008.11.25 -
NOD32 3638 2008.11.25 -
Norman 5.80.02 2008.11.25 -
Panda 9.0.0.4 2008.11.25 -
PCTools 4.4.2.0 2008.11.25 -
Prevx1 V2 2008.11.25 -
Rising 21.05.12.00 2008.11.25 -
SecureWeb-Gateway 6.7.6 2008.11.25 -
Sophos 4.35.0 2008.11.25 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.25 -
TheHacker 6.3.1.1.162 2008.11.25 -
TrendMicro 8.700.0.1004 2008.11.25 -
VBA32 3.12.8.9 2008.11.24 -
ViRobot 2008.11.25.1485 2008.11.25 -
VirusBuster 4.5.11.0 2008.11.24 -
Information additionnelle
File size: 12862 bytes
MD5...: 18fe2fa9a6b980e7ce7d50e7751b1124
SHA1..: 2c72aa6b686ce37d34901614b94942750db070fd
SHA256: f7f1540116f95f2a057cea7d97088ce514c51c3272d2b60174d3da0f80df88f2
SHA512: 0b7e7798efcaf36e01da7fdb0e01eea9a90dc481ee7615f4f363ebb5a67f00c3
95295c95bbc19b4a4d9452d6a5ea497792607b02d1eca68fbebb3a89f1139de4
ssdeep: 192:QgFLyBccyTsdOr3ntIXAT9mG8o57CfkG3ggTqTJisZH:BbcSjnyQT9mA57Cf
B3/6JP
PEiD..: -
TrID..: File type identification
Windows Icon (57.2%)
MPEG Video (42.7%)

ok je te f ais sa

@the proje suis étonné du nombre de virus

le rapport

ComboFix 08-11-24.03 - seb 2008-11-25 13:13:58.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.397 [GMT 1:00]
Lancé depuis: c:\documents and settings\seb.PC\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Anais\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\windows.0\system32\clypltta.ini
c:\windows.0\system32\drivers\npf.sys
c:\windows.0\system32\ibywovrs.ini
c:\windows.0\system32\nVuELUvw.ini
c:\windows.0\system32\nVuELUvw.ini2
c:\windows.0\system32\packet.dll
c:\windows.0\system32\rhmaevdt.ini
c:\windows.0\system32\SYFiPqru.ini
c:\windows.0\system32\SYFiPqru.ini2
c:\windows.0\system32\vttuqspc.ini
c:\windows.0\system32\wpcap.dll
c:\windows.0\system32\yodqckhu.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NPF

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-25 au 2008-11-25 ))))))))))))))))))))))))))))))))))))
.

2008-11-25 10:22 . 2008-11-25 10:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-25 10:22 . 2008-11-25 10:22 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Malwarebytes
2008-11-25 10:22 . 2008-11-25 10:22 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-11-25 10:22 . 2008-10-22 16:10 38,496 --a------ c:\windows.0\system32\drivers\mbamswissarmy.sys
2008-11-25 10:22 . 2008-10-22 16:10 15,504 --a------ c:\windows.0\system32\drivers\mbam.sys
2008-11-25 09:26 . 2008-11-25 13:00 <REP> d-------- C:\ToolBar SD
2008-11-25 09:17 . 2008-11-25 09:17 <REP> d-------- c:\program files\Trend Micro
2008-11-25 08:34 . 2008-11-25 08:34 <REP> d-------- c:\program files\Microsoft Silverlight
2008-11-24 19:56 . 2008-11-24 19:56 <REP> d-------- c:\program files\Alwil Software
2008-11-24 19:56 . 2003-03-18 21:20 1,060,864 --a------ c:\windows.0\system32\MFC71.dll
2008-11-24 19:56 . 2003-03-18 20:14 499,712 --a------ c:\windows.0\system32\MSVCP71.dll
2008-11-24 19:05 . 2008-11-24 19:05 4,096 --a------ c:\windows.0\d3dx.dat
2008-11-24 18:07 . 2008-11-24 19:22 <REP> d-------- c:\program files\PC Wizard 2008
2008-11-24 18:07 . 2007-09-15 15:11 27,136 --a------ c:\windows.0\system32\PCWizard.cpl
2008-11-22 21:36 . 2008-11-22 21:36 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Bluetooth
2008-11-22 21:33 . 2008-11-22 21:35 32 --a------ c:\windows.0\[u]0/u
2008-11-22 21:33 . 2008-11-22 21:33 0 --a------ c:\windows.0\system32\[u]0/u
2008-11-22 16:51 . 2008-09-04 22:03 56,344 --a------ c:\windows.0\system32\drivers\fssfltr.sys
2008-11-22 16:46 . 2008-11-25 10:50 <REP> d-------- c:\documents and settings\seb.PC\amsn
2008-11-22 16:45 . 2008-11-22 16:46 <REP> d-------- c:\program files\aMSN
2008-11-22 00:20 . 2008-11-22 16:49 <REP> d-------- c:\program files\Windows Live Toolbar
2008-11-22 00:20 . 2008-11-22 00:20 <REP> d-------- c:\program files\Windows Live Favorites
2008-11-22 00:20 . 2008-11-22 00:20 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-11-22 00:05 . 2008-11-22 00:05 <REP> d-------- c:\program files\Windows Installer Clean Up
2008-11-22 00:00 . 2008-11-22 00:05 <REP> d-------- c:\program files\MSECACHE
2008-11-21 23:58 . 2008-10-16 14:08 27,672 --a------ c:\windows.0\system32\wuapi.dll.mui
2008-11-21 23:54 . 2008-11-21 23:54 30,946 --a------ c:\windows.0\system32\drivers\Partizan.sys
2008-11-21 23:54 . 2008-11-21 23:54 28,672 --a------ c:\windows.0\system32\Partizan.exe
2008-11-21 23:42 . 2008-11-21 23:42 <REP> d-------- c:\windows.0\RestoreSafeDeleted
2008-11-21 23:40 . 2008-11-21 23:40 (2) -rahs-ot- c:\windows.0\winstart.bat
2008-11-21 23:39 . 2008-11-21 23:40 <REP> d-------- c:\program files\UnHackMe
2008-11-21 23:39 . 2005-04-03 15:02 8,944 --a------ c:\windows.0\system32\drivers\UnHackMeDrv.sys
2008-11-21 22:26 . 2008-11-21 22:26 <REP> d-------- c:\program files\AxBx
2008-11-20 00:36 . 2008-11-24 18:57 1,632 --a------ c:\windows.0\system32\d3d8caps.dat
2008-11-20 00:20 . 2001-08-23 17:46 342,336 --a--c--- c:\windows.0\system32\dllcache\banshee.dll
2008-11-20 00:20 . 2001-08-23 17:46 342,336 --a------ c:\windows.0\system32\banshee.dll
2008-11-20 00:20 . 2001-08-17 20:48 36,128 --a------ c:\windows.0\system32\drivers\banshee.sys
2008-11-20 00:20 . 2001-08-17 20:48 36,128 --a--c--- c:\windows.0\system32\dllcache\banshee.sys
2008-11-19 23:26 . 2008-11-19 23:26 <REP> d-------- c:\program files\Absolutist_Games
2008-11-19 23:26 . 2008-11-19 23:26 <REP> d-------- c:\program files\Absolutist.com
2008-11-19 03:55 . 2008-11-19 03:55 <REP> d-------- c:\documents and settings\Administrateur.SEB\Application Data\EstSoft
2008-11-19 03:55 . 2008-11-19 03:55 <REP> d-------- c:\documents and settings\Administrateur.SEB\Application Data\DAEMON Tools
2008-11-19 01:41 . 2008-11-19 01:43 <REP> d--h----- c:\documents and settings\Administrateur.SEB\Voisinage réseau
2008-11-19 01:41 . 2008-10-26 09:48 <REP> d--h----- c:\documents and settings\Administrateur.SEB\Voisinage d'impression
2008-11-19 01:41 . 2008-10-26 08:54 <REP> d--h----- c:\documents and settings\Administrateur.SEB\Modèles
2008-11-19 01:41 . 2008-11-19 01:42 <REP> dr------- c:\documents and settings\Administrateur.SEB\Mes documents
2008-11-19 01:41 . 2008-10-26 09:48 <REP> dr------- c:\documents and settings\Administrateur.SEB\Menu Démarrer
2008-11-19 01:41 . 2008-11-19 01:42 <REP> dr------- c:\documents and settings\Administrateur.SEB\Favoris
2008-11-19 01:41 . 2008-11-19 03:55 <REP> d-------- c:\documents and settings\Administrateur.SEB\Bureau
2008-11-19 01:41 . 2008-11-19 01:41 <REP> d-------- c:\documents and settings\Administrateur.SEB
2008-11-18 20:58 . 2008-11-18 20:58 268 --ah----- C:\sqmdata11.sqm
2008-11-18 20:58 . 2008-11-18 20:58 244 --ah----- C:\sqmnoopt11.sqm
2008-11-18 20:36 . 2008-11-18 20:36 268 --ah----- C:\sqmdata10.sqm
2008-11-18 20:36 . 2008-11-18 20:36 244 --ah----- C:\sqmnoopt10.sqm
2008-11-18 17:27 . 2005-11-24 19:51 245,248 --a------ c:\windows.0\system32\rt73.sys
2008-11-18 17:27 . 2008-11-18 17:27 20,747 --a------ c:\windows.0\system32\drivers\AegisP.sys
2008-11-18 17:27 . 2005-12-06 04:24 7,846 --a------ c:\windows.0\system32\rt73.cat
2008-11-16 22:13 . 2008-11-16 22:17 <REP> d-------- c:\program files\Sims2Pack Clean Installer
2008-11-14 15:05 . 2008-11-14 15:05 <REP> d-------- c:\program files\PC Inspector File Recovery
2008-11-14 15:05 . 2002-02-18 18:40 6,200 --a------ c:\windows.0\system32\INT13EXT.VXD
2008-11-14 14:19 . 2002-01-01 01:20 <REP> d-a------ c:\documents and settings\All Users.WINDOWS.0\Application Data\TEMP
2008-11-14 12:39 . 2008-11-14 12:39 <REP> dr-h----- c:\documents and settings\seb.PC\Application Data\SecuROM
2008-11-14 10:00 . 2004-08-18 09:34 442,368 -ra------ c:\windows.0\system32\vp6vfw.dll
2008-11-13 03:16 . 2008-11-14 12:39 754 --a------ c:\windows.0\WORDPAD.INI
2008-11-13 01:47 . 2008-11-13 01:47 <REP> d-------- c:\program files\ValuSoft
2008-11-12 21:05 . 2008-11-12 21:05 <REP> d---s---- c:\windows.0\system32\%SystemDrive%
2008-11-12 21:05 . 2008-11-12 21:05 22 --a------ c:\windows.0\Wininit.ini
2008-11-12 21:02 . 2008-11-12 21:02 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Canneverbe_Limited
2008-11-12 21:01 . 2008-11-12 21:01 <REP> d-------- c:\program files\CDBurnerXP
2008-11-12 20:56 . 2008-11-12 21:07 <REP> d-------- c:\program files\NCH Swift Sound
2008-11-12 20:56 . 2008-11-12 21:06 <REP> d-------- c:\program files\NCH Software
2008-11-12 20:56 . 2008-11-12 21:06 <REP> d-------- c:\documents and settings\seb.PC\Application Data\NCH Swift Sound
2008-11-12 20:56 . 2008-11-12 20:57 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\NCH Swift Sound
2008-11-12 20:56 . 2008-11-12 20:56 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\NCH Software
2008-11-12 20:56 . 2008-11-12 20:56 27,136 --a------ c:\windows.0\system32\drivers\nchssvad.sys
2008-11-12 20:45 . 2008-11-12 23:58 620 --a------ c:\windows.0\eReg.dat
2008-11-12 20:39 . 2008-11-12 20:40 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-11-12 20:35 . 2008-11-12 20:35 <REP> d-------- c:\documents and settings\seb.PC\Application Data\DAEMON Tools
2008-11-12 20:21 . 2008-11-12 20:21 <REP> d-------- c:\documents and settings\seb.PC\Application Data\FarStone
2008-11-12 20:19 . 2008-11-12 20:19 65,536 --a------ c:\windows.0\system32\VDPersns.dat
2008-11-12 20:18 . 2004-09-22 11:46 37,409 --a------ c:\windows.0\system32\drivers\fsRamDsk.sys
2008-11-12 20:15 . 2004-09-22 11:46 77,824 --------- c:\windows.0\system32\RDrv2KInterface.dll
2008-11-12 20:15 . 2004-01-13 04:51 53,248 --------- c:\windows.0\system32\RDrvNTInterface.dll
2008-11-12 20:15 . 2004-03-12 07:44 36,864 --------- c:\windows.0\system32\unVHDDrvExe.exe
2008-11-12 20:15 . 2004-03-12 07:44 36,864 --------- c:\windows.0\system32\inVHDDrvExe.exe
2008-11-12 20:15 . 2004-07-17 08:33 32,768 --------- c:\windows.0\system32\RDrv9xInterface.dll
2008-11-12 20:15 . 2004-06-29 09:03 28,672 --------- c:\windows.0\system32\RDrvInterface.dll
2008-11-12 17:35 . 2008-11-12 20:36 717,296 --a------ c:\windows.0\system32\drivers\sptd.sys
2008-11-12 15:54 . 2008-11-12 15:54 <REP> d-------- c:\windows.0\Pastry Passion
2008-11-12 15:54 . 2008-11-12 15:54 <REP> d-------- c:\program files\Pastry Passion
2008-11-12 15:54 . 2008-11-12 15:54 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Zylom
2008-11-12 15:24 . 2008-11-19 00:10 <REP> d-------- c:\documents and settings\seb.PC\Application Data\Azureus
2008-11-12 15:24 . 2008-11-12 15:24 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\Azureus
2008-11-12 15:22 . 2008-11-12 15:23 <REP> d-------- c:\program files\Vuze
2008-11-12 15:22 . 2008-11-12 15:22 <REP> d-------- c:\program files\Fichiers communs\i4j_jres
2008-11-12 14:21 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows.0\system32\dllcache\msxml3.dll
2008-11-12 14:21 . 2008-10-24 12:21 455,296 -----c--- c:\windows.0\system32\dllcache\mrxsmb.sys
2008-11-12 02:28 . 2008-11-12 02:28 <REP> d-------- c:\program files\Fichiers communs\DirectX
2008-11-12 02:27 . 2008-11-18 11:19 <REP> d-------- c:\program files\EA GAMES
2008-11-12 02:06 . 2008-11-12 17:49 <REP> d-------- c:\program files\denouvel
2008-11-12 02:06 . 2008-11-12 02:06 796,672 --a------ c:\windows.0\GPInstall.exe
2008-11-12 02:06 . 2000-09-29 18:00 8,784 --a------ c:\windows.0\F_France.gpl
2008-11-12 01:07 . 2008-11-12 01:07 <REP> d-------- c:\program files\MSBuild
2008-11-12 01:01 . 2008-11-12 01:09 <REP> d-------- c:\windows.0\system32\XPSViewer
2008-11-12 01:00 . 2006-06-29 13:07 14,048 --------- c:\windows.0\system32\spmsg2.dll
2008-11-11 01:28 . 2008-11-11 01:28 <REP> d-------- C:\GamersFirst
2008-11-09 07:17 . 2008-11-09 07:53 105,984 --a------ c:\windows.0\system32\c_dll.dll
2008-11-08 03:13 . 2008-11-08 03:13 <REP> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\NOS
2008-11-07 18:42 . 2008-11-07 18:43 <REP> d-------- c:\documents and settings\seb.PC\Application Data\dvdcss
2008-11-07 00:45 . 2008-11-12 21:04 <REP> d-------- c:\program files\My BootDisk
2008-11-04 10:53 . 2008-06-14 18:33 272,768 -----c--- c:\windows.0\system32\dllcache\bthport.sys
2008-11-04 10:53 . 2008-08-14 11:04 138,496 -----c--- c:\windows.0\system32\dllcache\afd.sys
2008-11-04 10:53 . 2008-06-24 17:44 74,240 -----c--- c:\windows.0\system32\dllcache\mscms.dll
2008-11-04 10:52 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows.0\system32\dllcache\ntoskrnl.exe
2008-11-04 10:52 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows.0\system32\dllcache\ntkrnlmp.exe
2008-11-04 10:52 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows.0\system32\dllcache\ntkrnlpa.exe
2008-11-04 10:52 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows.0\system32\dllcache\ntkrpamp.exe
2008-11-04 10:52 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows.0\system32\dllcache\win32k.sys
2008-11-04 10:52 . 2008-05-07 06:11 1,294,336 -----c--- c:\windows.0\system32\dllcache\quartz.dll
2008-11-04 10:52 . 2008-04-11 20:05 691,712 -----c--- c:\windows.0\system32\dllcache\inetcomm.dll
2008-11-04 10:52 . 2008-10-15 17:35 337,408 -----c--- c:\windows.0\system32\dllcache\netapi32.dll
2008-11-04 10:52 . 2008-09-08 11:41 333,824 -----c--- c:\windows.0\system32\dllcache\srv.sys
2008-11-04 10:52 . 2008-07-07 21:28 253,952 -----c--- c:\windows.0\system32\dllcache\es.dll
2008-11-04 10:52 . 2008-05-08 15:02 203,136 -----c--- c:\windows.0\system32\dllcache\rmcast.sys
2008-11-04 10:44 . 2008-11-04 10:44 <REP> d-------- c:\windows.0\system32\fr

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 07:06 --------- d-----w c:\program files\Opera
2008-11-23 12:18 98,304 ----a-w c:\windows.0\DUMP00f5.tmp
2008-11-22 15:51 --------- d-----w c:\program files\Windows Live
2008-11-22 15:38 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\WLInstaller
2008-11-22 04:25 --------- d-----w c:\program files\MSN Messenger
2008-11-21 16:27 --------- d-----w c:\documents and settings\seb.PC\Application Data\MSN6
2008-11-18 16:30 --------- d-----w c:\documents and settings\Anais\Application Data\Spyware Terminator
2008-11-18 16:27 --------- d-----w c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor
2008-11-15 19:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-14 14:51 --------- d-----w c:\program files\Navilog1
2008-11-12 20:04 --------- d-----w c:\program files\MagicISO
2008-11-08 02:15 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-10-27 19:35 --------- d-----w c:\program files\ma-config.com
2008-10-27 18:45 --------- d-----w c:\program files\Kill Process
2008-10-26 08:32 --------- d-----w c:\program files\Intel
2008-10-26 08:27 --------- d-----w c:\program files\Microsoft
2008-10-26 08:27 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\ma-config.com
2008-10-26 08:06 --------- d-----w c:\program files\JEUX
2008-10-26 07:59 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-25 17:31 --------- d-----w c:\program files\LimeWire
2008-10-25 12:49 --------- d-----w c:\program files\Elaborate Bytes
2008-10-24 20:21 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-10-24 19:01 --------- d-----w c:\program files\3D Driving-School
2008-10-24 11:21 455,296 ----a-w c:\windows.0\system32\drivers\mrxsmb.sys
2008-10-24 09:39 --------- d-----w c:\program files\Fichiers communs\Panda Software
2008-10-24 09:24 --------- d-----w c:\program files\Valve
2008-10-24 07:55 --------- d-----w c:\program files\Paint.NET
2008-10-24 07:55 --------- d-----w c:\program files\eMule
2008-10-24 07:52 --------- d-----w c:\program files\Dofus
2008-10-24 07:43 --------- d-----w c:\program files\FileZilla FTP Client
2008-10-23 20:11 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-10-23 19:22 --------- d-----w c:\documents and settings\Anais\Application Data\Zylom Games
2008-10-23 19:05 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller
2008-10-23 19:05 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-10-23 19:05 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-10-23 19:05 --------- d-----w c:\program files\Fichiers communs\Java
2008-10-23 19:04 --------- d-----w c:\program files\Fichiers communs\Thraex Software(2)
2008-10-23 19:04 --------- d-----w c:\program files\F-Secure
2008-10-21 00:58 --------- d-----w c:\program files\G DATA
2008-10-16 13:13 202,776 ----a-w c:\windows.0\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows.0\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows.0\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows.0\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows.0\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows.0\system32\wuauclt.exe
2008-10-16 13:09 43,544 -c--a-w c:\windows.0\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows.0\system32\wups.dll
2008-10-16 13:06 208,744 ----a-w c:\windows.0\system32\muweb.dll
2008-09-15 15:26 1,846,528 ----a-w c:\windows.0\system32\win32k.sys
2008-09-10 01:15 1,307,648 ------w c:\windows.0\system32\msxml6.dll
2008-09-08 23:03 51,712 ----a-w c:\windows.0\system32\sirenacm.dll
2008-09-05 15:04 288,768 ----a-w c:\windows.0\WLXPGSS.SCR
2008-09-04 17:16 1,106,944 ----a-w c:\windows.0\system32\msxml3.dll
2006-10-25 12:17 258 ----a-w c:\documents and settings\seb\dat.bin
2006-06-20 18:22 9,070,256 ----a-r c:\program files\coccipack.ccp
.

------- Sigcheck -------

2008-08-20 06:10 670208 50d19e569c83a9c1ae7efaef6a93bc50 c:\windows.0\$hf_mig$\KB956390\SP3GDR\wininet.dll
2008-08-20 06:07 670720 96d50aca60da22adbd253f2825c98d1a c:\windows.0\$hf_mig$\KB956390\SP3QFE\wininet.dll
2008-08-20 06:33 671744 aef39ac3bcbafe971155d0073191b5a6 c:\windows.0\ie7\wininet.dll
2008-04-14 03:33 670208 4a6e04ea20f48d750d9bfed8600d516b c:\windows.0\ServicePackFiles\i386\wininet.dll
2008-08-26 09:11 826368 e30cacd98479b36a3dbfa3267bf62dd0 c:\windows.0\SoftwareDistribution\Download\1f0ff9cd77277bbfa312e709c95b4b39\sp2gdr\wininet.dll
2008-08-26 10:10 827904 4b0e70d44297877a313045bd059770e1 c:\windows.0\SoftwareDistribution\Download\1f0ff9cd77277bbfa312e709c95b4b39\sp2qfe\wininet.dll
2008-08-20 06:33 671744 aef39ac3bcbafe971155d0073191b5a6 c:\windows.0\SoftwareDistribution\Download\2355f18161c4d9205abb66936b92cf18\sp2qfe\wininet.dll
2008-08-20 06:10 670208 50d19e569c83a9c1ae7efaef6a93bc50 c:\windows.0\SoftwareDistribution\Download\2355f18161c4d9205abb66936b92cf18\sp3gdr\wininet.dll
2008-08-20 06:07 670720 96d50aca60da22adbd253f2825c98d1a c:\windows.0\SoftwareDistribution\Download\2355f18161c4d9205abb66936b92cf18\sp3qfe\wininet.dll
2008-06-23 17:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c c:\windows.0\SoftwareDistribution\Download\848074f054596c97d2468deeb41d6ba1\SP2GDR\wininet.dll
2008-06-23 16:40 827904 52589bae67dd9859724287372668690b c:\windows.0\SoftwareDistribution\Download\848074f054596c97d2468deeb41d6ba1\SP2QFE\wininet.dll
2008-08-26 09:11 826368 e30cacd98479b36a3dbfa3267bf62dd0 c:\windows.0\SoftwareDistribution\Download\a37a907ce729d9b027006f974e62dcad\SP2GDR\wininet.dll
2008-08-26 10:10 827904 4b0e70d44297877a313045bd059770e1 c:\windows.0\SoftwareDistribution\Download\a37a907ce729d9b027006f974e62dcad\SP2QFE\wininet.dll
2006-05-10 08:24 662528 343fabbf09312842816e92947aacf73a c:\windows.0\SoftwareDistribution\Download\be077a0a5c65554c0fa221a5c8a0529b\backup\wininet.dll
2008-06-23 17:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c c:\windows.0\system32\wininet.dll
2008-06-23 17:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c c:\windows.0\system32\dllcache\wininet.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows.0\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-06-23 c:\windows.0\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
"DisableCAD"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=aowybr.dll eanhye.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\maureen84\\condition zero\\hl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\aMSN\\bin\\wish.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;c:\windows.0\system32\drivers\aswSP.sys [2008-11-24 110160]
R2 aswFsBlk;aswFsBlk;c:\windows.0\system32\DRIVERS\aswFsBlk.sys [2008-11-24 20560]
R2 fssfltr;FssFltr;c:\windows.0\system32\DRIVERS\fssfltr.sys [2008-11-22 56344]
S0 FVDSCSI;FVDSCSI;c:\windows.0\system32\DRIVERS\fvdscsi.sys []
S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe []
S3 banshee;banshee;c:\windows.0\system32\DRIVERS\banshee.sys [2008-11-20 36128]
S3 fsssvc;Windows Live Contrôle parental;"c:\program files\Windows Live\Family Safety\fsssvc.exe" [2008-09-04 512536]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe []
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows.0\system32\drivers\mbamswissarmy.sys [2008-11-25 38496]
S3 Partizan;Partizan;c:\windows.0\system32\drivers\Partizan.sys [2008-11-21 30946]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c05bc55f-a338-11dd-9606-806d6172696f}]
\Shell\AutoRun\command - G:\setup.exe

*Newly Created Service* - HELPSVC
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
Toolbar-{631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
Notify-tuvTnOGx - (no file)

.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\seb.PC\Application Data\Mozilla\Firefox\Profiles\t9iyti3r.default\
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
FF -: plugin - c:\program files\Mozilla Firefox 3.1 Beta 1\plugins\npnul32.dll
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-25 13:19:30
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows.0\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-11-25 13:23:29 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-25 12:23:26

Avant-CF: 1 943 826 432 octets libres
Après-CF: 2,774,216,704 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptOut
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel"=optin /fastdetect

325 --- E O F --- 2008-11-12 14:41:19

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:26:26, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\explorer.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 1\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: aowybr.dll eanhye.dll
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS.0\system32\cisvc.exe (file missing)
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

ok je recommence, je ne suis pas un pro des log, mais je me doutais qui avait un malaise

@the proje profite en meme temps pour le passer sur mon pc

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1422
Windows 5.1.2600 Service Pack 3

25/11/2008 12:53:56
mbam-log-2008-11-25 (12-53-56).txt

Type de recherche: Examen rapide
Eléments examinés: 86490
Temps écoulé: 13 minute(s), 31 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

il ne trouve plus rien bizard

deuxieme log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59:25, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\SYSTEM32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS.0\System32\ups.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\explorer.exe
C:\WINDOWS.0\system32\cmd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS.0\system32\cmd.exe
C:\WINDOWS.0\system32\cmd.exe
C:\WINDOWS.0\SYSTEM32\findstr.exe
C:\WINDOWS.0\SYSTEM32\find.exe
C:\WINDOWS.0\SYSTEM32\find.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: aowybr.dll eanhye.dll
O20 - Winlogon Notify: tuvTnOGx - C:\WINDOWS.0\
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

voila mes deux log comme tu m'as demander,
merci encore de me consacrer autant de temps

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1422
Windows 5.1.2600 Service Pack 3

25/11/2008 10:44:27
mbam-log-2008-11-25 (10-44-22).txt

Type de recherche: Examen rapide
Eléments examinés: 86803
Temps écoulé: 19 minute(s), 45 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\Live_TV (Adware.Agent) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS.0\system32\enoolyoi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS.0\system32\ioyloone.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS.0\system32\aowybr.dll.ren (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\hsgyumpd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\htuikdii.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\ocglioed.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\orvzcm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\uhkcqdoy.dll.ren (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\uouwec.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\wdlpilft.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\EANHYE.del (Trojan.Vundo) -> No action taken.
C:\WINDOWS.0\system32\syssetub.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS.0\system32\drivers\etc\services (Heuristics.Reserved.Word.Exploit) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:40, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\SYSTEM32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS.0\System32\ups.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\Program Files\Kiwee Toolbar\2.8.167\kwtbaim.exe
C:\Program Files\aMSN\bin\wish.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 1\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: aowybr.dll eanhye.dll
O20 - Winlogon Notify: tuvTnOGx - C:\WINDOWS.0\
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

bon tout d'abord , j'ai une license windows, mais ce n'es pas moi qui est installer se xp (Pas Mon pc )
se que je ne comprend pas c'est que tu me dit qu'elle n'es pas valide hors je sais faire toutes las maj

Soites merci pour toi aide en tout cas tu me sauve le vie,

le premier rapport

-----------\\ ToolBar S&D 1.2.5 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 2.40GHz )
BIOS : BIOS Date: 03/22/04 14:00:18 Ver: 08.00.09
USER : seb ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1290 [VPS 081124-0] 4.8.1290 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:1 Go)
E:\ (Local Disk) - NTFS - Total:18 Go (Free:17 Go)
G:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

"C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
Option : [2] ( 25/11/2008| 9:26 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskBarDis\bar
Supprime! - C:\Program Files\AskBarDis\unins000.dat
Supprime! - C:\Program Files\AskBarDis\unins000.exe
Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
Supprime! - C:\Program Files\AskBarDis
Supprime! - C:\Program Files\DAEMON Tools Toolbar

-----------\\ Recherche de Fichiers / Dossiers ...

et HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:33:57, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\SYSTEM32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS.0\System32\ups.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\Program Files\aMSN\bin\wish.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 1\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {09C72999-5C10-41A3-A524-24661D942003} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - (no file)
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: aowybr.dll eanhye.dll
O20 - Winlogon Notify: tuvTnOGx - C:\WINDOWS.0\
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe