"warning dangerous spyware"

Résolu
stephaanie -  
Bonjour,

depuis hier j'ai ce message qui s'affiche en fond d'ecran ainsi qu'une icone rouge avec une croix blanche.

J'ai lancé Norton antivirus qui n'a rien trouvé, ainsi qu'AdAware, et CCCleaner : sans résultat.

J'ai téléchargé Malawarebytes et j'ai lancé l'application, puis après avoir supprimé les fichiers malveillants, j'ai redémarré, et j'ai toujours le message en fond d'ecran.
De plus, toutes les 5 minutes environ le fichier "mes documents" s'ouvre tout seul.

J'ai vraiment d'aide là ! Merci par avance
Configuration: Windows XP
Internet Explorer 6.0

45 réponses

Résumé de la discussion

Le problème décrit concerne l'apparition d'un message persistant en fond d'écran et d'une icône rouge, lié à un virus identifié comme ntdll64.exe sur Windows XP. Plusieurs éléments évoquent une solution pour le virus ntdll64.exe, associant une procédure de désinfection spécifique et l'usage d'un outil d'analyse des démarrages afin de repérer les composants indésirables. Des pratiques recommandées incluent la vérification des résultats des antivirus, l'usage de Malwarebytes et l'examen des rapports HijackThis pour identifier les éléments de démarrage et les composants suspects. En complément, la discussion signale l'utilité de rapports détaillés comme HijackThis et l'examen des clés et des services en démarrage pour repérer les éléments indésirables qui se relancent automatiquement.

Bobot (l’IA à votre service)
  3. peter
    Une solution a tester:
    http://hotline.galerie-cesar.com/viewtopic.php?f=31&t=50
    1. lesotho
      voici quand même mon rapport au cas ou vous passeriez par ce post...

      ComboFix 09-02-04.04 - nicolas 2009-02-05 17:11:30.1 - NTFSx86
      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1022.567 [GMT 1:00]
      Lancé depuis: c:\documents and settings\nicolas\Bureau\ComboFix.exe
      AV: McAfee VirusScan *On-access scanning disabled* (Updated)
      FW: McAfee Personal Firewall *enabled*
      * Un nouveau point de restauration a été créé
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\documents and settings\nicolas\Application Data\inst.exe
      c:\documents and settings\nicolas\Local Settings\Application Data\ikywoow.dat
      c:\documents and settings\nicolas\Local Settings\Application Data\ikywoow.exe
      c:\documents and settings\nicolas\Local Settings\Application Data\ikywoow_nav.dat
      c:\documents and settings\nicolas\Local Settings\Application Data\ikywoow_navps.dat
      c:\windows\pack.epk
      c:\windows\system32\ahtn.htm
      c:\windows\system32\frmwrk32.exe
      c:\windows\system32\hqkluopjst_navtmp.dat
      c:\windows\system32\jhauambmz.dat
      c:\windows\system32\jhauambmz_nav.dat
      c:\windows\system32\jhauambmz_navps.dat
      c:\windows\system32\nvs2.inf
      c:\windows\system32\test.ttt
      c:\windows\system32\uniq.tll
      c:\windows\system32\warning.gif

      .
      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_BOONTY_GAMES
      -------\Legacy_PACKET
      -------\Service_Boonty Games
      -------\Service_Packet

      ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-05 au 2009-02-05 ))))))))))))))))))))))))))))))))))))
      .

      2009-02-03 18:39 . 2009-02-03 18:39 136,981 --a------ C:\cc_20090203_1839.reg
      2009-02-03 18:16 . 2009-02-03 18:16 3 --a------ c:\windows\sbacknt.bin
      2009-02-03 18:15 . 2009-02-03 18:54 <REP> d-------- c:\documents and settings\nicolas\Application Data\vghd
      2009-02-03 18:15 . 2009-02-03 18:15 152,904 --a------ c:\windows\system32\vghd.scr
      2009-02-02 15:30 . 2009-02-04 18:00 <REP> d-------- c:\program files\Norton Security Scan
      2009-02-02 15:30 . 2009-02-04 18:00 <REP> d-------- c:\program files\Fichiers communs\Symantec Shared
      2009-01-30 12:47 . 2009-01-30 12:47 <REP> d-------- c:\program files\K-Lite Codec Pack
      2009-01-30 12:47 . 2008-09-24 19:41 839,680 --a------ c:\windows\system32\lameACM.acm
      2009-01-30 12:47 . 2008-12-07 19:08 795,648 --a------ c:\windows\system32\xvidcore.dll
      2009-01-30 12:47 . 2004-01-25 17:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
      2009-01-30 12:47 . 2008-09-16 20:23 168,448 --a------ c:\windows\system32\unrar.dll
      2009-01-30 12:47 . 2008-12-07 19:08 130,048 --a------ c:\windows\system32\xvidvfw.dll
      2009-01-30 12:47 . 2007-09-21 01:52 118,784 --a------ c:\windows\system32\ac3acm.acm
      2009-01-30 12:47 . 2008-12-08 12:53 57,344 --a------ c:\windows\system32\ff_vfw.dll
      2009-01-30 12:47 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
      2009-01-30 12:47 . 2008-10-03 13:30 414 --a------ c:\windows\system32\lame_acm.xml
      2009-01-07 08:31 . 2009-01-07 08:31 <REP> d-------- c:\program files\Fichiers communs\Adobe AIR
      2009-01-07 08:31 . 2009-01-07 08:31 <REP> d-------- c:\program files\Adobe Media Player
      2009-01-07 08:10 . 2009-01-07 08:10 <REP> d-------- c:\program files\Veoh Networks

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2009-02-05 00:50 --------- d-----w c:\documents and settings\nicolas\Application Data\Ableton
      2009-02-05 00:48 --------- d-----w c:\program files\Ableton
      2009-02-04 19:23 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
      2009-02-04 16:15 --------- d-----w c:\program files\McAfee
      2009-02-03 17:40 --------- d-----w c:\program files\Windows Live Toolbar
      2009-02-03 17:32 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
      2009-02-03 17:06 --------- d-----w c:\documents and settings\nicolas\Application Data\uTorrent
      2009-01-30 11:23 --------- d-----w c:\program files\uTorrent
      2009-01-29 19:19 --------- d-----w c:\documents and settings\nicolas\Application Data\SiteAdvisor
      2009-01-26 20:44 --------- d-----w c:\program files\Google
      2009-01-15 12:05 --------- d-----w c:\documents and settings\nicolas\Application Data\U3
      2008-12-29 00:01 --------- d-----w c:\documents and settings\nicolas\Application Data\dvdcss
      2008-12-17 15:28 --------- d-----w c:\program files\Microsoft
      2008-12-17 15:27 --------- d-----w c:\program files\Windows Live
      2008-12-17 15:26 --------- d-----w c:\program files\Microsoft Sync Framework
      2008-12-17 15:24 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
      2008-12-17 15:15 --------- d-----w c:\program files\MSN Messenger
      2008-12-17 15:13 --------- d-----w c:\program files\Windows Live SkyDrive
      2008-12-17 14:01 --------- d-----w c:\program files\Fichiers communs\Windows Live
      2008-12-16 20:53 --------- d-----w c:\program files\VstPlugins
      2008-12-16 20:53 --------- d-----w c:\program files\Common Files
      2008-12-16 20:52 --------- d-----w c:\program files\Native Instruments
      2008-12-16 20:52 --------- d-----w c:\program files\Fichiers communs\Native Instruments
      2008-12-14 21:20 --------- d-----w c:\program files\DivX
      2008-12-11 18:24 --------- d-----w c:\program files\UsbFix
      2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
      2008-12-11 11:55 --------- d-----w c:\program files\Paint.NET
      2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR
      2007-12-23 22:03 47,360 ----a-w c:\documents and settings\nicolas\Application Data\pcouffin.sys
      2006-12-25 18:32 251 ----a-w c:\program files\wt3d.ini
      2007-02-17 22:39 168 --sh--r c:\windows\system32\B67B3FC35E.sys
      2007-02-17 22:40 5,486 --sha-w c:\windows\system32\KGyGaAvL.sys
      .

      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
      "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 68856]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 667718]
      "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 602182]
      "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
      "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
      "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
      "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 c:\windows\KHALMNPR.Exe]
      "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 c:\windows\KHALMNPR.Exe]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "Midi1"= ma_cmidn.dll
      "midi2"= ma_cmidn.dll

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
      @=""

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Digital Line Detect.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Digital Line Detect.lnk
      backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
      backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
      backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk
      backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
      backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^QuickTV.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\QuickTV.lnk
      backup=c:\windows\pss\QuickTV.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TrayMin230.lnk]
      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\TrayMin230.lnk
      backup=c:\windows\pss\TrayMin230.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^nicolas^Menu Démarrer^Programmes^Démarrage^IMVU.lnk]
      path=c:\documents and settings\nicolas\Menu Démarrer\Programmes\Démarrage\IMVU.lnk
      backup=c:\windows\pss\IMVU.lnkStartup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
      --a------ 2005-06-23 19:33 57344 c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
      --a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
      --a------ 2006-01-02 18:41 45056 c:\program files\ATI Technologies\ATI.ACE\CLI.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
      --------- 2005-10-31 10:51 57344 c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
      --a------ 2008-04-01 10:39 486856 c:\program files\DAEMON Tools Lite\daemon.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
      --a------ 2006-08-28 22:57 395776 c:\program files\Dell Support\DSAgnt.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
      --a------ 2004-12-06 02:05 127035 c:\windows\system32\dla\tfswctrl.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
      --a------ 2008-03-20 07:22 320168 c:\program files\Lexmark Fax Solutions\fm3032.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gnetmous]
      --a------ 2002-08-02 09:34 153088 c:\program files\Samsung\Samsung RF Wheel Mouse\gnetmous.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
      --a------ 2007-08-03 13:46 1836544 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
      --a------ 2005-08-11 15:30 249856 c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
      --a------ 2005-08-11 15:30 81920 c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdxamon]
      --a------ 2008-03-20 07:25 16040 c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdxmon.exe]
      --a------ 2008-03-20 07:25 668328 c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
      --------- 2003-09-10 03:24 20480 c:\program files\NetWaiting\netwaiting.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
      --a------ 2004-10-13 17:24 1694208 c:\program files\Messenger\msmsgs.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
      --a------ 2007-09-07 13:44 3100672 c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
      --------- 2007-05-02 17:16 184320 c:\program files\Dell\MediaDirect\PCMService.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Philips Intelligent Agent]
      --a------ 2008-02-21 17:19 613792 c:\program files\Philips\Intelligent Agent\Philips Intelligent Agent.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      --a------ 2007-12-07 16:47 155648 c:\program files\QuickTime\qttask.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
      --a------ 2007-01-30 10:41 94208 c:\program files\SimpleCenter\bin\win\sclauncher.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
      --a------ 2007-03-05 20:10 36904 c:\program files\SiteAdvisor\6172\SiteAdv.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC230NC_Monitor]
      --a------ 2007-12-10 15:55 323584 c:\windows\Philips\SPC230NC\Monitor.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC_Monitor]
      --a------ 2007-12-10 15:55 323584 c:\windows\Philips\SPC230NC\Monitor.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
      --a------ 2008-02-22 03:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
      --a------ 2007-07-11 11:58 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
      --a------ 2006-03-08 19:48 761947 c:\program files\Synaptics\SynTP\SynTPEnh.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
      --------- 2000-05-11 01:00 90112 c:\windows\Updreg.EXE

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]
      --a------ 2008-12-16 18:07 3528440 c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
      --------- 2006-02-16 10:20 1118208 c:\program files\Creative\VoiceCenter\AndreaVC.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
      --a------ 2006-06-29 07:12 1355042 c:\windows\system32\CTMBHA.DLL

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
      --a------ 2004-12-22 19:40 24576 c:\windows\MIDIDEF.EXE

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
      --a------ 2006-03-25 00:30 282624 c:\windows\stsystra.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
      "WMPNetworkSvc"=3 (0x3)
      "usnjsvc"=3 (0x3)
      "SiteAdvisor Service"=2 (0x2)
      "ose"=3 (0x3)
      "MDM"=2 (0x2)
      "IDriverT"=3 (0x3)
      "gusvc"=2 (0x2)
      "EvtEng"=2 (0x2)
      "Creative Service for CDROM Access"=2 (0x2)
      "Creative Labs Licensing Service"=2 (0x2)
      "Boonty Games"=3 (0x3)
      "Ati HotKey Poller"=2 (0x2)
      "StarWindService"=2 (0x2)

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
      "c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
      "c:\\Program Files\\Messenger\\msmsgs.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "c:\\Program Files\\Alcohol Soft\\Alcohol 120\\Alcohol.exe"=
      "c:\\Program Files\\eMule\\eMule.exe"=
      "c:\\Program Files\\DNA\\btdna.exe"=
      "c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
      "c:\\Program Files\\SimpleCenter\\Home Media Server.exe"=
      "c:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=
      "c:\\Program Files\\uTorrent\\uTorrent.exe"=
      "c:\\Program Files\\Activision\\Quantum of Solace(TM)\\JB_LiveEngine_s.exe"=
      "c:\\Program Files\\Philips\\Intelligent Agent\\Philips Intelligent Agent.exe"=
      "c:\\WINDOWS\\system32\\lxdxcoms.exe"=
      "c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxamon.exe"=
      "c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=
      "c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
      "c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
      "c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
      "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
      "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
      "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
      "c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxlscn.exe"=
      "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
      "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
      "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
      "10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
      "10426:UDP"= 10426:UDP:SingleClick ICC
      "17314:TCP"= 17314:TCP:u Torrent

      R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2008-01-01 11264]
      R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [2006-07-14 13824]
      R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
      R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640]
      R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [2006-07-14 13696]
      R3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [2008-11-10 8576]
      R3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [2008-11-10 461056]
      S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2008-11-10 98984]
      S3 AVerHybrid;AVerMedia Hybrid Tuner (NTSC/PAL/SECAM/DVB-T/FM);c:\windows\system32\drivers\averhbtv.sys [2008-09-09 283648]
      S3 Ltn_stk7070P;PCTV based TV tuner device;c:\windows\system32\drivers\Ltn_stk7070P.sys [2008-09-08 466048]
      S3 Ltn_stkrc;PCTV Infrared Receiver;c:\windows\system32\drivers\Ltn_stkrc.sys [2008-09-08 13440]
      S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys --> c:\windows\system32\DRIVERS\snp325.sys [?]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70687b32-aae1-11dc-91a9-0018dec1e8df}]
      \Shell\AutoRun\command - F:\LaunchU3.exe -a
      .
      Contenu du dossier 'Tâches planifiées'

      2009-02-05 c:\windows\Tasks\Google Software Updater.job
      - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-29 13:13]

      2009-01-15 c:\windows\Tasks\McDefragTask.job
      - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

      2009-02-01 c:\windows\Tasks\McQcTask.job
      - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

      2009-02-04 c:\windows\Tasks\Norton Security Scan for nicolas.job
      - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]

      2009-02-04 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
      - c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

      2007-10-03 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
      - c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
      .
      - - - - ORPHELINS SUPPRIMES - - - -

      HKCU-Run-ikywoow - c:\documents and settings\nicolas\local settings\application data\ikywoow.exe
      MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
      MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
      MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
      MSConfigStartUp-jhauambmz - c:\windows\system32\jhauambmz.exe
      MSConfigStartUp-LDM - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      MSConfigStartUp-LWBKEYBOARD - c:\program files\Belkin\Belkin keypad driver\KbdAp32A.exe
      MSConfigStartUp-LWBMOUSE - c:\program files\Belkin\Wireless Mouse Driver\MOUSE32A.EXE
      MSConfigStartUp-PMCLoader - c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe
      MSConfigStartUp-Veoh - c:\program files\Veoh Networks\Veoh\VeohClient.exe
      MSConfigStartUp-Wallpaper - c:\program files\Wallpaper\Wallpaper.exe
      MSConfigStartUp-WengoPhoneNG - f:\student key\Apps\PortableWengoPhone\qtwengophone.exe
      MSConfigStartUp-Windows Registry Repair Pro - c:\program files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe

      .
      ------- Examen supplémentaire -------
      .
      uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
      uStart Page = hxxp://www.google.fr/
      uInternet Connection Wizard,ShellNext = iexplore
      uInternet Settings,ProxyServer = www-cache.u-picardie.fr:3130
      uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
      IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      IE: Download with Go!Zilla - file://c:\program files\Go!Zilla\download-with-gozilla.html
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\nicolas\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
      TCP: {48D18239-B789-4F6B-AA91-7B75BC4E20BC} = 192.168.1.1
      DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan8/oscan8.cab
      DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxps://www.vm-wl.com/DownloadManager/Release/Prod/DownMan.cab
      DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game06.zylom.com/activex/zylomgamesplayer.cab
      FF - ProfilePath - c:\documents and settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vw4ba3sr.default\
      FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
      FF - component: c:\program files\SiteAdvisor\6172\FF\components\FFHook.dll
      FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
      FF - plugin: c:\program files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll
      FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
      FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
      FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
      FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

      ---- PARAMETRES FIREFOX ----
      FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
      .

      **************************************************************************

      catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2009-02-05 17:20:14
      Windows 5.1.2600 Service Pack 2 NTFS

      Recherche de processus cachés ...

      Recherche d'éléments en démarrage automatique cachés ...

      Recherche de fichiers cachés ...

      Scan terminé avec succès
      Fichiers cachés: 0

      **************************************************************************
      .
      --------------------- CLES DE REGISTRE BLOQUEES ---------------------

      [HKEY_USERS\S-1-5-21-2503427321-786648308-3189268515-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D78D6535-632A-A0CB-739B-9DA660EB8453}*]
      @Allowed: (Read) (RestrictedCode)
      @Allowed: (Read) (RestrictedCode)
      "abbieoknmfbdgaaekiffgkfdobmaajbigi"=hex:61,61,00,00
      "bbbieoknmfbdgaaekigfdkfkeoiplablkgjb"=hex:61,61,00,00

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,0d,6f,03,e6,fc,
      e5,cc,71,e2,63,26,f1,3f,c8,ff,68,ac,73,29,78,82,76,6f,ce,e2,63,26,f1,3f,c8,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,92,64,db,e7,a7,
      e8,78,71,6a,9c,d6,61,af,45,84,18,b5,c3,a5,7d,48,24,a0,9d,6a,9c,d6,61,af,45,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,13,8f,ee,e0,80,
      fb,66,37,ff,7c,85,e0,43,d4,0e,fe,f1,c9,b6,a2,17,0d,c2,98,ff,7c,85,e0,43,d4,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,59,95,0b,79,34,
      74,7e,5b,86,8c,21,01,be,91,eb,e7,cc,dc,e8,9e,8f,e1,76,e4,86,8c,21,01,be,91,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,f0,99,a9,6c,c0,
      b0,92,9d,f5,1d,4d,73,a8,13,5c,05,88,ea,ab,49,0b,88,29,3d,f5,1d,4d,73,a8,13,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,e4,7b,e4,17,29,
      20,bc,50,df,20,58,62,78,6b,cf,c8,1d,7e,1e,b8,09,77,5a,3f,df,20,58,62,78,6b,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,da,a3,35,6f,e8,
      77,73,e8,fb,a7,78,e6,12,2f,9a,ea,75,5e,c0,a2,c0,6c,8c,87,fb,a7,78,e6,12,2f,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,88,2c,44,6c,b2,
      da,3b,94,01,3a,48,fc,e8,04,4a,f1,9d,a8,be,18,b3,9b,74,c9,01,3a,48,fc,e8,04,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,41,ac,ce,e3,44,
      07,46,72,f6,0f,4e,58,98,5b,89,c9,c4,dd,36,22,0f,a8,bb,7b,f6,0f,4e,58,98,5b,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,ab,5d,d4,49,f8,
      27,36,6b,3d,ce,ea,26,2d,45,aa,78,5e,0b,d0,e0,7e,af,6b,01,3d,ce,ea,26,2d,45,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,3b,9d,7d,e9,e2,
      22,d2,6a,2a,b7,cc,b5,b9,7f,41,e7,45,b1,99,17,9a,f9,91,f2,2a,b7,cc,b5,b9,7f,\

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
      "ThreadingModel"="Apartment"
      @="c:\\WINDOWS\\system32\\OLE32.DLL"
      "8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,5c,a1,f8,2b,64,
      f4,82,f4,6c,43,2d,1e,aa,22,2f,9c,c4,1f,46,7b,36,52,df,26,6c,43,2d,1e,aa,22,\

      [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
      "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
      .
      --------------------- DLLs chargées dans les processus actifs ---------------------

      - - - - - - - > 'winlogon.exe'(960)
      c:\windows\system32\Ati2evxx.dll
      .
      ------------------------ Autres processus actifs ------------------------
      .
      c:\windows\ehome\ehrecvr.exe
      c:\windows\ehome\ehSched.exe
      c:\windows\system32\lxdxcoms.exe
      c:\program files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
      c:\progra~1\McAfee\MSC\mcmscsvc.exe
      c:\program files\Fichiers communs\McAfee\MNA\McNASvc.exe
      c:\progra~1\FICHIE~1\McAfee\McProxy\McProxy.exe
      c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
      c:\program files\McAfee\MPF\MpfSrv.exe
      c:\program files\McAfee\MSK\msksrver.exe
      c:\windows\system32\HPZipm12.exe
      c:\program files\Intel\Wireless\Bin\RegSrvc.exe
      c:\windows\ehome\mcrdsvc.exe
      c:\windows\system32\dllhost.exe
      c:\windows\ehome\ehmsas.exe
      c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
      .
      **************************************************************************
      .
      Heure de fin: 2009-02-05 17:26:20 - La machine a redémarré
      ComboFix-quarantined-files.txt 2009-02-05 16:26:14

      Avant-CF: 9 488 482 304 octets libres
      Après-CF: 9,401,364,480 octets libres

      WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
      [boot loader]
      timeout=2
      default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
      [operating systems]
      c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
      multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

      441 --- E O F --- 2009-02-01 00:07:42

      2. lesotho
        salut, j'ai le même problème, je suis tenté de faire les manip décrites au dessus mais il me semble que chacune d'entre elles est propre aux rapports générés par les utilisateurs. J'aimerais juste savoir ! Si je dois refaire la manip, ce ne sera pas un problème, par contre je suis incapable de décoder les rapports !!
        De plus, le gestionnaire des taches est inaccessible, j'ai aussi l'impression que certains dossiers dans le registre ont tout simplement disparu.
        Voila je suis un peu embêté mais je comprendrais si vous n'avez le temps !

        --------
        windows xp
        firefox 3.0.5
        2. g!rly Contributeur
          ok alexe
          @+
          1. alexe654
            desolée mais pour le moment je n'ai plus acces a internet avec mon pc.. Je ne pourrai donc pas t'envoyer le rapport maintenant... :-S

            désolée je fais au plus vite
        3. alexe654
          Ca va je le fais d'ici 10 a 15 min parce que j'ai besoin d'internet encore ce temps la
          2. alexe654
            Coucou !
            Alors un grand merci , l'anti malware n'a rien trouvé mais plus aucun message d'erreur !!
            Je te remercie en tout cas !! C'est vraiment super gentil d'avoir pris de ton temps. C'est super !
            Merci merci merci merciii
            2. alexe654
              pas de soucis avec le fait d'envoyé seulement ils ne m'ont pas dit quel lien.... Hem
              Pour le malware j'ai déjà fais des analyses complètes, que je vais refaire par sécurité
              Mais j'ai LogMeIn installé qui est considérer comme Malware j'espère que ça ne posera pas de problèmes. Je fais ça de suite!
              Merci de m'aider :)
              1. g!rly Contributeur
                oui envoie le fichier

                puis

                Fais un scan avec cet antispyware :

                Telecharge malwarebytes + tutoriel :

                -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                Tu l´instale; le programme va se mettre automatiquement a jour.

                Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

                Puis click sur "rechercher".

                Laisse le scanner le pc...

                Si des elements on ete trouvés > click sur supprimer la selection.

                si il t´es demandé de redemarrer > click sur "yes".

                A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

                Copie et colle le rapport stp.
                2. alexe654
                  Message string (..) toujours la il veut analyser les malware je dois envoyer le lien.... sur ce site:
                  C:\Qoobox\CF-Submit-Previous.htm

                  résultats de l'analyse :

                  ComboFix 08-12-15.03 - Alexe 2008-12-16 3:38:38.2 - NTFSx86
                  Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2046.911 [GMT 1:00]
                  Lancé depuis: c:\users\Alexe\Downloads\ComboFix.exe
                  Commutateurs utilisés :: c:\users\Alexe\Documents\CFScript.txt..txt
                  * Un nouveau point de restauration a été créé

                  FILE ::
                  c:\windows\System32\ahtn.htm
                  c:\windows\System32\byXQJYqR.dll
                  c:\windows\System32\ealregsnapshot1.reg
                  c:\windows\System32\test.ttt
                  c:\windows\System32\uniq.tll
                  c:\windows\System32\warning.gif
                  c:\windows\System32\yayxvVpo.dll
                  .

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  c:\windows\System32\ahtn.htm
                  c:\windows\System32\byXQJYqR.dll
                  c:\windows\System32\ealregsnapshot1.reg
                  c:\windows\System32\test.ttt
                  c:\windows\System32\uniq.tll
                  c:\windows\System32\warning.gif
                  c:\windows\System32\yayxvVpo.dll

                  .
                  ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
                  .

                  2008-12-16 01:54 . 2008-12-16 01:54 236 --a------ C:\sqmdata03.sqm
                  2008-12-16 01:54 . 2008-12-16 01:54 200 --a------ C:\sqmnoopt03.sqm
                  2008-12-16 00:50 . 2008-12-16 00:51 <REP> d-------- c:\program files\Far
                  2008-12-15 15:37 . 2008-12-15 15:37 <REP> dr-h----- c:\users\Alexe\AppData\Roaming\SecuROM
                  2008-12-15 15:37 . 2008-12-15 15:37 107,888 --a------ c:\windows\System32\CmdLineExt.dll
                  2008-12-15 15:10 . 2008-12-15 15:10 <REP> d-------- c:\users\All Users\Electronic Arts
                  2008-12-15 15:10 . 2008-12-15 15:10 <REP> d-------- c:\programdata\Electronic Arts
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Videos
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Searches
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Saved Games
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Pictures
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Links
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Downloads
                  2008-12-15 15:09 . 2008-12-15 15:09 <REP> dr------- c:\windows\System32\config\systemprofile\Documents
                  2008-12-12 23:27 . 2008-12-13 00:02 <REP> d-------- c:\program files\World of Warcraft
                  2008-12-12 23:27 . 2008-12-13 00:04 <REP> d-------- c:\program files\Common Files\Blizzard Entertainment
                  2008-12-12 03:04 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll
                  2008-12-12 01:39 . 2008-11-01 02:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
                  2008-12-12 01:39 . 2008-10-29 07:29 2,927,104 --a------ c:\windows\explorer.exe
                  2008-12-12 01:39 . 2008-03-08 05:21 1,695,744 --a------ c:\windows\System32\gameux.dll
                  2008-12-12 01:39 . 2008-10-16 05:47 827,392 --a------ c:\windows\System32\wininet.dll
                  2008-12-12 01:39 . 2008-10-21 06:25 296,960 --a------ c:\windows\System32\gdi32.dll
                  2008-12-12 01:39 . 2008-11-01 04:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll
                  2008-12-12 01:38 . 2008-06-23 02:59 2,868,736 --a------ c:\windows\System32\mf.dll
                  2008-12-12 01:38 . 2008-10-16 03:23 1,383,424 --a------ c:\windows\System32\mshtml.tlb
                  2008-12-12 01:38 . 2008-06-23 02:59 996,352 --a------ c:\windows\System32\WMNetMgr.dll
                  2008-12-12 01:38 . 2008-06-23 02:58 94,720 --a------ c:\windows\System32\logagent.exe
                  2008-12-11 18:26 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
                  2008-12-11 18:26 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
                  2008-12-11 18:26 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
                  2008-12-11 18:26 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
                  2008-12-11 18:26 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
                  2008-12-11 18:26 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
                  2008-12-11 18:26 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
                  2008-12-11 18:26 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
                  2008-12-11 18:26 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
                  2008-11-19 11:01 . 2008-11-19 11:01 <REP> d-------- c:\users\Alexe\AppData\Roaming\DivX
                  2008-11-19 02:48 . 2008-11-19 02:49 <REP> d-------- c:\program files\DivX
                  2008-11-19 02:11 . 2008-11-19 02:12 <REP> d-------- c:\users\Alexe\AppData\Roaming\vlc
                  2008-11-18 22:18 . 2008-11-18 22:18 284 --a------ C:\sqmdata02.sqm
                  2008-11-18 22:18 . 2008-11-18 22:18 212 --a------ C:\sqmnoopt02.sqm
                  2008-11-17 00:27 . 2008-11-17 00:27 236 --a------ C:\sqmdata01.sqm
                  2008-11-17 00:27 . 2008-11-17 00:27 200 --a------ C:\sqmnoopt01.sqm

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2008-12-16 02:06 --------- d-----w c:\users\Alexe\AppData\Roaming\OpenOffice.org2
                  2008-12-16 00:46 --------- d--h--w c:\program files\InstallShield Installation Information
                  2008-12-12 02:07 --------- d-----w c:\programdata\Microsoft Help
                  2008-11-18 14:10 --------- d-----w c:\program files\LogMeIn
                  2008-11-12 13:50 --------- d-----w c:\users\Alexe\AppData\Roaming\SmsDiscount
                  2008-11-03 20:13 --------- d-----w c:\program files\Common Files\Adobe
                  2008-11-03 20:07 --------- d-----w c:\program files\Bonjour
                  2008-11-03 00:14 --------- d-----w c:\program files\Firaxis Games
                  2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
                  2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
                  2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
                  2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
                  2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
                  2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx0c.dll
                  2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx07.dll
                  2008-10-28 22:35 815,104 ----a-w c:\windows\System32\divx_xx0a.dll
                  2008-10-28 22:35 802,816 ----a-w c:\windows\System32\divx_xx11.dll
                  2008-10-28 22:35 684,032 ----a-w c:\windows\System32\DivX.dll
                  2008-10-23 00:12 --------- d-----w c:\users\Alexe\AppData\Roaming\VoipBuster
                  2008-10-20 20:46 --------- d-----w c:\program files\SmsDiscount.com
                  2008-10-20 10:40 --------- d-----w c:\program files\Messenger Plus! Live
                  2008-10-16 19:35 87,352 ----a-w c:\windows\System32\LMIinit.dll
                  2008-10-16 19:35 83,288 ----a-w c:\windows\System32\LMIRfsClientNP.dll
                  2008-10-16 19:35 28,984 ----a-w c:\windows\System32\LMIport.dll
                  2008-10-16 19:35 23,736 ----a-w c:\windows\System32\lmimirr.dll
                  2008-10-16 19:35 10,040 ----a-w c:\windows\System32\lmimirr2.dll
                  2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
                  2008-09-25 08:03 81,920 ----a-w c:\windows\System32\dpl100.dll
                  2008-09-25 08:03 593,920 ----a-w c:\windows\System32\dpuGUI11.dll
                  2008-09-25 08:03 57,344 ----a-w c:\windows\System32\dpv11.dll
                  2008-09-25 08:03 53,248 ----a-w c:\windows\System32\dpuGUI10.dll
                  2008-09-25 08:03 524,288 ----a-w c:\windows\System32\DivXsm.exe
                  2008-09-25 08:03 344,064 ----a-w c:\windows\System32\dpus11.dll
                  2008-09-25 08:03 294,912 ----a-w c:\windows\System32\dpu11.dll
                  2008-09-25 08:03 294,912 ----a-w c:\windows\System32\dpu10.dll
                  2008-09-25 08:03 196,608 ----a-w c:\windows\System32\dtu100.dll
                  2008-09-25 08:03 161,096 ----a-w c:\windows\System32\DivXCodecVersionChecker.exe
                  2008-09-19 21:57 3,596,288 ----a-w c:\windows\System32\qt-dx331.dll
                  2008-09-19 21:57 129,784 ------w c:\windows\System32\pxafs.dll
                  2008-09-19 21:57 120,056 ------w c:\windows\System32\pxcpyi64.exe
                  2008-09-19 21:57 118,520 ------w c:\windows\System32\pxinsi64.exe
                  2008-09-19 21:55 200,704 ----a-w c:\windows\System32\ssldivx.dll
                  2008-09-19 21:55 1,044,480 ----a-w c:\windows\System32\libdivx.dll
                  2008-09-19 21:54 12,288 ----a-w c:\windows\System32\DivXWMPExtType.dll
                  2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
                  2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
                  2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
                  2008-07-21 01:24 631,424 ----a-w c:\users\Alexe\EZface.exe
                  2008-06-10 22:15 553,448 ----a-w c:\users\Alexe\incredimail_install.exe
                  2008-06-01 13:36 174 --sha-w c:\program files\desktop.ini
                  2007-10-18 09:34 5,724,184 ----a-w c:\program files\msnmsgr.exe
                  .

                  ((((((((((((((((((((((((((((( snapshot@2008-12-16_ 3.09.49.86 )))))))))))))))))))))))))))))))))))))))))
                  .
                  - 2008-12-16 02:03:22 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
                  + 2008-12-16 02:06:15 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
                  .
                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
                  "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696]
                  "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
                  "VoipBuster"="c:\program files\VoipBuster.com\VoipBuster\voipbuster.exe" [2008-12-16 9017648]
                  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
                  "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-09-08 3513344]
                  "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]
                  "SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 438272]
                  "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 577536]
                  "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 411192]
                  "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
                  "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-05-23 509496]
                  "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-05-22 538744]
                  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
                  "Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 413696]
                  "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
                  "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 571024]
                  "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
                  "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
                  "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]
                  "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2008-04-03 136080]
                  "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-26 185896]
                  "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
                  "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
                  "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
                  "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
                  "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
                  "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
                  "RtHDVCpl"="RtHDVCpl.exe" [2007-06-13 c:\windows\RtHDVCpl.exe]
                  "NDSTray.exe"="NDSTray.exe" [BU]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-09-08 3513344]

                  c:\users\Alexe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
                  OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

                  c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
                  Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
                  Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-02-27 2756608]
                  Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                  "EnableLUA"= 0 (0x0)
                  "EnableUIADesktopToggle"= 0 (0x0)

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
                  @="Service"

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
                  @="Service"

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
                  @="Service"

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                  "UacDisableNotify"=dword:00000001
                  "InternetSettingsDisableNotify"=dword:00000001
                  "AutoUpdateDisableNotify"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                  "DisableMonitoring"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                  "DisableMonitoring"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                  "DisableMonitoring"=dword:00000001

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
                  "{37F3DEEA-760C-46AE-B776-5C6841BA46BE}"= UDP:c:\program files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
                  "{52C468FB-43A4-4212-8D1B-1EFA18750F2D}"= TCP:c:\program files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
                  "{3234042A-E3B3-4079-85BC-A05D24F4B8A8}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
                  "{2D2AD309-23F3-429B-8801-A670AB9B9BF1}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
                  "{7B0750DB-C846-4BE3-9149-36846D0EB457}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
                  "{903D8F9E-6F95-4859-BC76-F01D86D0790E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
                  "TCP Query User{2B11C714-986D-49DA-9492-BB7CE51EC413}c:\\program files\\msnmsgr.exe"= UDP:c:\program files\msnmsgr.exe:Windows Live Messenger
                  "UDP Query User{874AE124-9633-48EC-8178-D49A784B9D01}c:\\program files\\msnmsgr.exe"= TCP:c:\program files\msnmsgr.exe:Windows Live Messenger
                  "TCP Query User{17F55FE2-1946-40EC-9BDC-EED27E1374E5}c:\\program files\\msnmsgr.exe"= UDP:c:\program files\msnmsgr.exe:Windows Live Messenger
                  "UDP Query User{EB7ED5FC-6EE9-4EB1-9E39-A55D2C72D5BC}c:\\program files\\msnmsgr.exe"= TCP:c:\program files\msnmsgr.exe:Windows Live Messenger
                  "TCP Query User{A794B0B9-9595-48D7-80F8-40C460AF57A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
                  "UDP Query User{26CB5291-EE63-4799-A8F3-D94F75266D79}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
                  "{0700093B-3D8A-4C2B-9A8A-F751905FBF08}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
                  "{F9CE7348-9BDA-459F-BA6B-6F25248A2210}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
                  "{2C71F584-CC21-4172-AA52-B8B74BE84F47}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
                  "{226D1E7C-B38B-48AF-B632-7D419EEB6950}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
                  "{031A8026-A82C-4FCA-81BE-191FAD3D4481}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
                  "{D6B14276-2FE6-4D95-93FC-B81C06D56CA3}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
                  "TCP Query User{5F1B017E-AE4D-4D76-B040-914A144D1E22}c:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
                  "UDP Query User{004CEFEC-C1A3-4651-B2DF-7334C2F4819F}c:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
                  "{6E33B0F1-AD13-4429-8248-3DD4F9852D6D}"= UDP:c:\program files\VoipBuster.com\VoipBuster\VoipBuster.exe:VoipBuster
                  "{01206940-4074-46C8-A1FC-5D8C9F43642E}"= TCP:c:\program files\VoipBuster.com\VoipBuster\VoipBuster.exe:VoipBuster
                  "TCP Query User{1FDFE58C-0A93-4502-AF5D-316E0D77E3A6}c:\\program files\\voipbuster.com\\voipbuster\\voipbuster.exe"= UDP:c:\program files\voipbuster.com\voipbuster\voipbuster.exe:Client to make VoIP calls.
                  "UDP Query User{F82894FF-5AD7-46AF-A5C3-BB26619998B1}c:\\program files\\voipbuster.com\\voipbuster\\voipbuster.exe"= TCP:c:\program files\voipbuster.com\voipbuster\voipbuster.exe:Client to make VoIP calls.
                  "TCP Query User{2EC817CE-7BA6-485A-9660-3A5000F81C81}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
                  "UDP Query User{7F04F08D-A119-4A6D-B3A5-6889DAFE0AD1}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
                  "TCP Query User{EBAE9F02-201B-4654-AC6E-BEFB3222BD2F}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
                  "UDP Query User{92B45758-03ED-46B6-A066-7B7EFCA05AA8}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
                  "TCP Query User{021BC0BE-CEAD-4D83-8D5F-BA7244B1EFD5}c:\\users\\alexe\\appdata\\local\\temp\\onlineupdate8\\setupxu.exe"= UDP:c:\users\alexe\appdata\local\temp\onlineupdate8\setupxu.exe:setupxu.exe
                  "UDP Query User{7081B29F-CD5F-494A-A0F6-707ADA1CCBCB}c:\\users\\alexe\\appdata\\local\\temp\\onlineupdate8\\setupxu.exe"= TCP:c:\users\alexe\appdata\local\temp\onlineupdate8\setupxu.exe:setupxu.exe
                  "{4D7BFA2C-6E55-4B16-BABD-76FC79A6238B}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
                  "{A2CA0762-1B15-4865-A03D-1D8630AC4113}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
                  "{549DE9F9-827E-451D-A2F3-64273A3AEC4F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
                  "{2C16BAB7-57B8-4811-B1F2-6FD2F3765A13}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
                  "{668C356D-D6A3-4772-85A5-E461C02D5347}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
                  "TCP Query User{FC17FF21-DC4A-4F43-ADE4-9193D850936D}c:\\program files\\shareaza\\shareaza.exe"= UDP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
                  "UDP Query User{F34E01BA-271C-44AF-ACE7-05719646B277}c:\\program files\\shareaza\\shareaza.exe"= TCP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
                  "TCP Query User{6D0F27E5-E677-466B-94EC-7AB01DC43E28}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
                  "UDP Query User{8359E53D-9E48-43AA-B23F-7EC8CA643288}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
                  "{F1716034-8AA9-4C36-92C8-C3098818DA48}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
                  "{308CB8B3-B319-4CCB-A9A8-53DF4407AC36}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
                  "TCP Query User{74D6D41D-AB35-4EE7-AD23-EF1635ED867E}c:\\program files\\shareaza\\shareaza.exe"= UDP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
                  "UDP Query User{7CBBDFC8-B8AF-4AD8-9E95-C8147EC4CA4C}c:\\program files\\shareaza\\shareaza.exe"= TCP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
                  "TCP Query User{11891352-2FF8-4A0F-9607-9114A569A326}c:\\program files\\smsdiscount.com\\smsdiscount\\smsdiscount.exe"= UDP:c:\program files\smsdiscount.com\smsdiscount\smsdiscount.exe:Client to make VoIP calls.
                  "UDP Query User{815CCF22-465F-4D8B-ADA0-692B7DCC88EE}c:\\program files\\smsdiscount.com\\smsdiscount\\smsdiscount.exe"= TCP:c:\program files\smsdiscount.com\smsdiscount\smsdiscount.exe:Client to make VoIP calls.
                  "TCP Query User{05195FBE-4FB0-4B2A-BF14-0B9B1787184F}c:\\program files\\smsdiscount.com\\smsdiscount\\smsdiscount.exe"= UDP:c:\program files\smsdiscount.com\smsdiscount\smsdiscount.exe:Client to make VoIP calls.
                  "UDP Query User{08BF7361-3CDE-4F3E-B59C-1EEE56D46E79}c:\\program files\\smsdiscount.com\\smsdiscount\\smsdiscount.exe"= TCP:c:\program files\smsdiscount.com\smsdiscount\smsdiscount.exe:Client to make VoIP calls.
                  "{864CFDEA-686B-49C6-845C-E4F2FCCC860E}"= Disabled:UDP:c:\users\Alexe\AppData\Local\Temp\ImInstaller\HiYo_Installer.exe:IncrediMail Installer
                  "{71CD7BB5-2E42-48BA-82D1-E560787860CF}"= Disabled:TCP:c:\users\Alexe\AppData\Local\Temp\ImInstaller\HiYo_Installer.exe:IncrediMail Installer
                  "{29D49735-AEFA-46C8-8014-4EBC0DD0F5C1}"= UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
                  "{1B09070F-876F-4148-8CB2-8FCB5331ABD1}"= TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
                  "TCP Query User{6CC48A44-4224-4B4E-BDD8-AB65E670FF15}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
                  "UDP Query User{45F91E2C-AE55-4981-8D7F-95182F493238}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

                  R0 CplIR;Embedded IR Driver;c:\windows\system32\DRIVERS\CplIR.SYS [2007-03-06 14848]
                  R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-10-02 124832]
                  R2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys [2008-07-24 12856]
                  R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\c:\windows\system32\drivers\LMIRfsDriver.sys [2008-05-18 47640]
                  R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-26 99376]
                  S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-10-02 38528]
                  S3 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" [2008-04-03 121744]
                  S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-10-02 356920]

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d58eb57-251d-11dd-a927-001b3849ed79}]
                  \shell\Auto\command - Start.exe
                  \shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede00895-2526-11dd-8480-001b3849ed79}]
                  \shell\AutoRun\command - D:\autorun.exe

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee4e8e33-582e-11dd-9217-00037ad87cdf}]
                  \shell\Auto\command - Start.exe
                  \shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
                  .

                  **************************************************************************

                  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-12-16 03:40:10
                  Windows 6.0.6001 Service Pack 1 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  Recherche de fichiers cachés ...

                  Scan terminé avec succès
                  Fichiers cachés: 0

                  **************************************************************************
                  .
                  Heure de fin: 2008-12-16 3:45:12
                  ComboFix-quarantined-files.txt 2008-12-16 02:45:09
                  ComboFix2.txt 2008-12-16 02:17:28

                  Avant-CF: 46.889.611.264 octets libres
                  Après-CF: 46,644,441,088 octets libres

                  283 --- E O F --- 2008-12-12 02:07:33
                  4. alexe654
                    Je n'ai plus la croix qui apparait, par contre j'ai eu un message au démarrage qui est le suivant :
                    'Find String (QGREP) Utility a cessé de fonctionner'
                    et de nouveaux deux propositions :
                    -chercher les solutions en ligne et fermer le programme
                    -fermer le programme

                    Est ce que ca a un rapport avec la page qui s'est ouverte ? (avec la femme dessus)
                    1. g!rly Contributeur
                      Copie le texte ci-dessous :

                      File::
                      c:\windows\System32\yayxvVpo.dll
                      c:\windows\System32\warning.gif
                      c:\windows\System32\ahtn.htm
                      c:\windows\System32\byXQJYqR.dll
                      c:\windows\System32\uniq.tll
                      c:\windows\System32\test.ttt
                      c:\windows\System32\ealregsnapshot1.reg

                      Collect::
                      c:\windows\System32\yayxvVpo.dll
                      c:\windows\System32\warning.gif
                      c:\windows\System32\ahtn.htm
                      c:\windows\System32\byXQJYqR.dll
                      c:\windows\System32\uniq.tll
                      c:\windows\System32\test.ttt
                      c:\windows\System32\ealregsnapshot1.reg

                      Ouvre le Bloc-Notes puis colle le texte copié.
                      (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                      Sauvegarde ce fichier sous le nom de CFScript.txt.

                      Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                      http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                      Cela va relancer Combofix,

                      Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                      Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                      Ne touche à rien tant que le scan n'est pas terminé.

                      Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                      S'il n'y a pas de rédémarrage, poste quand même les rapports.

                      @+
                      • 1
                      • 2
                      • 3

                      Discussions similaires

                      Symbole Attention dans Word
                      Nortec59

                      33 réponses
                      Comment faire le symbole attention
                      Juliaaa

                      17 réponses
                      Saisie des symboles à l'aide du clavier
                      ButteDuLac

                      11 réponses
                      Comment faire ce symbole dans Word ?
                      weezy

                      6 réponses
                      Message " Your chassis has been opened"
                      tophe70

                      14 réponses