Salut,


Edit > n'espère pas d'aide ici http://www.commentcamarche.net/forum/affich 12393218 probleme avec tell me more espagnol

faut pas pousser mémé dans les ortis non plus ! ... Tes cd piratés sur la Mule , tu les scratchs ... point bar ....


Pour Tdss , on va s'en occuper ... commence par faire ceci :


Télécharge ZHPDiag de Nicolas Coolman sur ton bureau :

-> http://www.premiumorange.com/zeb-help-process/download/ZHPDiag.zip
-> http://telechargement.zebulon.fr/zhpdiag.html


!! déconnecte toi et ferme toutes tes applications en cours !!

* Clique droit sur le .zip que tu viens de télécharger et choisis " extraire tout " sur ton bureau ...

* Double-clique sur "ZHPDiag.exe" pour lancer l'outil :


> Clique sur le bouton " Tous " ( important ).

> puis clique sur le bouton de "la loupe" pour lancer le scan .


Laisses travailler l'outil ...


> Une fois terminé , le rapport s'affiche : clique sur bouton "appareil photo" pour sauvegarder le rapport obtenu ...

Enregistres bien ZHPDiag.txt de façon à le retrouver facilement ( sur le bureau par exemple ).

Puis ferme le programme ...


Enfin , fais un copier/coller du contenu du rapport sauvegardé dans ta prochaine réponse pour analyse ( si le rapport est trop long pour le forum , poste le en 2 fois ) .

"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Bien ...


très infecté ! ... il me faut d'autre données avant de poursuivre ...


fais ceci :


1- Désactiver le redémarrage automatique :

A) Aller dans le menu "Démarrer"/"Panneau de configuration", puis "Performances et maintenance" et enfin "Système" .
Ou bien en faisant un clic-droit sur "Poste de travail" ( sur "ordinateur" pour Vista ) et en sélectionnant "Propriétés" .

B) Cliquez sur l'onglet "Avancé" ( pour Vista , cliquer dans "tâche" sur "paramètre systeme avancés" )
C) Ensuite , dans le 3eme paragraphe "Démarrage et récupération" , cliquer sur "paramètre" .
D) Dans le paragraphe "Défaillance du système" : décocher "Redémarrer automatiquement" .

puis cliquer sur "Ok" , "appliquer" et encore "Ok" pour valider la modif .

Conseil : laisse ces paramètres par la suite ...


==============================

2- Télécharge "gmer" sur le bureau :
http://cjoint.com/data/fmjZOGS1bw.htm

* Double-clique sur l'.exe pour lancer l'outil . Si ton antivirus réagit, ne t'inquiète pas et ignore l'alerte.
* Clique sur l'onglet "rootkit", puis clique sur scan.

Ne touche à rien et laisse travailler

* A la fin du scan, clique sur le bouton copy.
* Dans démarrer>programmes>accessoires : ouvre le bloc-note et clique sur CTRL+V afin de copier le rapport dans ce même bloc-note.
* poste le rapport stp ...

"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Bien ...


on va utiliser un dernier outil de diagnostique ( si il fonctionne ^^ ) , puis on attaque le nettoyage :



1- Télécharge et installe le logiciel HijackThis :

ici http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall­.exe
ou ici http://www.clubic.com/lancer-le-telechargement-51452-0-hijac­kthis.html

-->Clique sur le setup pour lancer l'installe : laisse toi guider et ne modifie pas les paramètres d'installation .
A la fin de l'installe , le prg se lance automatiquement : ferme le en cliquant sur la croix rouge .
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

( ne lance pas ce prg pour l'instant et fais la suite ... )



2- Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer .

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...


-> laisse faire le scan et ne touche pas au PC ...


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ...
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum ...
( Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ... )

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )




"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Rapport log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by KIMI at 2009-05-10 20:01:55
Microsoft Windows XP Professionnel Service Pack 2
System drive D: has 1 GB (11%) free of 10 GB
Total RAM: 1270 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:01:57, on 10/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Logitech\Gaming Software\LWEMon.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\wscript.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\_$Df\FrzState2k.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Internet Download Manager\IEMonitor.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\WINDOWS\system32\Wscript.exe
D:\WINDOWS\system32\Wscript.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\Wscript.exe
D:\Documents and Settings\KIMI\Bureau\RSIT.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe
D:\Program Files\Trend Micro\HijackThis\KIMI.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 82.98.231.89 browser-security.microsoft.com
O1 - Hosts: 82.98.231.89 best-click-scanner.info
O1 - Hosts: 82.98.231.89 antivirus-xp-pro-2009.com
O1 - Hosts: 82.98.231.89 microsoft.infosecuritycenter.com
O1 - Hosts: 82.98.231.89 microsoft.softwaresecurityhelp.com
O1 - Hosts: 82.98.231.89 onlinenotifyq.net
O1 - Hosts: 82.98.231.89 antivirusxp-pro-2009.com
O1 - Hosts: 82.98.231.89 microsoft.browser-security-center.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {31CDFCB9-37D6-4C1D-A31D-AA2DD56F637B} - (no file)
O2 - BHO: (no name) - {31D1305D-195C-4836-AB15-CE560FA8C578} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] D:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CTFMON] D:\WINDOWS\system32\wscript.exe /E:vbs D:\WINDOWS\system32\winjpg.jpg
O4 - HKLM\..\Run: [regdiit] D:\WINDOWS\system32\winxp.exe
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &NeoTrace It! - D:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1C12C-295B-4ED4-93C7-92DEFB761E72}: NameServer = 208.67.222.222 193.55.10.102
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: cbXNHyaA - cbXNHyaA.dll (file missing)
O20 - Winlogon Notify: DfLogon - D:\WINDOWS\SYSTEM32\LogonDll.dll
O20 - Winlogon Notify: fccbXonN - fccbXonN.dll (file missing)
O20 - Winlogon Notify: hgGwTlLb - hgGwTlLb.dll (file missing)
O20 - Winlogon Notify: khfCtuvu - khfCtuvu.dll (file missing)
O20 - Winlogon Notify: pmnnkLFX - pmnnkLFX.dll (file missing)
O20 - Winlogon Notify: rqRHyxvw - rqRHyxvw.dll (file missing)
O20 - Winlogon Notify: tuvUNedD - tuvUNedD.dll (file missing)
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DF5Serv - Faronics Corporation - D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
End of file - 6486 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2008-01-08 95664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
HelperObject Class - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll [2004-10-01 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-27 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31CDFCB9-37D6-4C1D-A31D-AA2DD56F637B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D1305D-195C-4836-AB15-CE560FA8C578}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll [2004-10-01 131072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
"Start WingMan Profiler"=D:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 88584]
"TkBellExe"=D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-27 185872]
"CTFMON"=D:\WINDOWS\system32\wscript.exe [2004-08-04 114688]
"regdiit"=D:\WINDOWS\system32\winxp.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04267207]
D:\WINDOWS\system32\pjviiqml.dll,b []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
D:\WINDOWS\system32\hkcmd.exe [2005-08-24 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
D:\WINDOWS\system32\igfxpers.exe [2005-08-24 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
D:\WINDOWS\system32\igfxtray.exe [2005-08-24 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LFAgent]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
D:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
D:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
D:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
D:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
D:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2006-11-26 97357]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SnagIt 7.lnk]
D:\PROGRA~1\TECHSM~1\SNAGIT~1\SnagIt32.exe [2004-10-01 2637824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXNHyaA]
cbXNHyaA.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon]
D:\WINDOWS\system32\LogonDll.dll [2007-10-25 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccbXonN]
fccbXonN.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hgGwTlLb]
hgGwTlLb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
D:\WINDOWS\system32\igfxdev.dll [2005-08-24 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfCtuvu]
khfCtuvu.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
D:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnnkLFX]
pmnnkLFX.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqRHyxvw]
rqRHyxvw.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvUNedD]
tuvUNedD.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{31CDFCB9-37D6-4C1D-A31D-AA2DD56F637B}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
D:\WINDOWS\system32\qoMdASME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\Documents and Settings\KIMI\Local Settings\Temp\IXP000.TMP\pes2009.exe"="D:\Documents and Settings\KIMI\Local Settings\Temp\IXP000.TMP\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05c0fbf0-07ea-11de-b0d7-806d6172696f}]
shell\AutoRun\command - D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05c0fbf3-07ea-11de-b0d7-806d6172696f}]
shell\AutoRun\command - D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a531dd2-3d79-11de-9620-003005c6503c}]
shell\AutoRun\command - F:\Setup.exe Ver40

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a531dd3-3d79-11de-9620-003005c6503c}]
shell\AutoRun\command - I:\AUTOTMM.EXE Ver40

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a531dd4-3d79-11de-9620-003005c6503c}]
shell\AutoRun\command - G:\AUTOTMM.EXE Ver40

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a531dd5-3d79-11de-9620-003005c6503c}]
shell\AutoRun\command - H:\AUTOTMM.EXE Ver40

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bca0f511-3a4e-11de-961c-003005c6503c}]
shell\AutoRun\command - D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL log.exe
shell\Ouvrir\command - F:\log.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcb432df-1890-11de-95f9-003005c6503c}]
shell\AutoRun\command - D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg


======List of files/folders created in the last 2 months======

2009-05-10 20:01:55 ----D---- D:\rsit
2009-05-10 19:58:24 ----D---- D:\Program Files\Trend Micro
2009-05-10 16:41:31 ----D---- D:\Program Files\DAEMON Tools Lite
2009-05-10 16:39:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DAEMON Tools
2009-05-10 12:13:26 ----A---- D:\WINDOWS\UnSetup.exe
2009-05-10 12:13:26 ----A---- D:\WINDOWS\FraUinst.exe
2009-05-10 12:13:07 ----D---- D:\WINDOWS\Lhsp
2009-05-10 09:09:08 ----D---- D:\Program Files\Bifrost
2009-05-05 20:18:27 ----D---- D:\Documents and Settings\KIMI\Application Data\Help
2009-05-03 16:16:05 ----D---- D:\Program Files\uTorrent
2009-05-03 16:16:03 ----D---- D:\Documents and Settings\KIMI\Application Data\uTorrent
2009-05-03 10:17:01 ----D---- D:\Documents and Settings\KIMI\Application Data\dvdcss
2009-05-02 12:45:59 ----D---- D:\Program Files\VDOWNLOADER
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs\xing shared
2009-04-27 19:05:08 ----D---- D:\Program Files\Real
2009-04-26 18:07:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Wireshark
2009-04-26 18:04:15 ----D---- D:\Program Files\WinPcap
2009-04-26 18:03:26 ----D---- D:\Program Files\Wireshark
2009-04-26 17:56:30 ----D---- D:\Program Files\NeoTrace Express
2009-04-22 16:56:30 ----D---- D:\Program Files\PhotoFiltre
2009-04-14 10:44:23 ----D---- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-14 04:15:58 ----SH---- D:\WINDOWS\system32\sgxdviyq.ini
2009-04-13 16:25:52 ----D---- D:\Program Files\UnH Solutions
2009-04-13 16:14:10 ----SH---- D:\WINDOWS\system32\bthwjeme.ini
2009-04-12 19:36:19 ----SH---- D:\WINDOWS\system32\gijkoxgd.ini
2009-04-12 09:09:36 ----SH---- D:\WINDOWS\system32\mjpddnow.ini
2009-04-11 19:34:44 ----SH---- D:\WINDOWS\system32\hqpynqfn.ini
2009-04-11 16:40:11 ----D---- D:\Program Files\KP Software
2009-04-11 16:25:17 ----D---- D:\Program Files\TechSmith
2009-04-11 15:52:50 ----D---- D:\Program Files\CCleaner
2009-04-11 07:35:12 ----SH---- D:\WINDOWS\system32\aevagwtk.ini
2009-04-10 19:38:18 ----SH---- D:\WINDOWS\system32\usleuyeq.ini
2009-04-10 07:35:17 ----SH---- D:\WINDOWS\system32\dpyprvdu.ini
2009-04-09 19:33:58 ----SH---- D:\WINDOWS\system32\yskeccll.ini
2009-04-09 07:34:03 ----SH---- D:\WINDOWS\system32\bhdsdrsu.ini
2009-04-08 19:30:58 ----SH---- D:\WINDOWS\system32\bgtokhjn.ini
2009-04-08 07:34:03 ----SH---- D:\WINDOWS\system32\bcyihljq.ini
2009-04-07 11:15:16 ----A---- D:\WINDOWS\system32\oydcki.dll
2009-04-07 11:15:00 ----A---- D:\WINDOWS\system32\ljhqpoop.dll
2009-04-07 11:12:09 ----SH---- D:\WINDOWS\system32\hpvuerdc.ini
2009-04-06 20:02:38 ----SH---- D:\WINDOWS\system32\nhpbakvy.ini
2009-04-06 16:19:40 ----D---- D:\Documents and Settings\KIMI\Application Data\skypePM
2009-04-06 16:19:01 ----D---- D:\Documents and Settings\KIMI\Application Data\Skype
2009-04-06 16:18:21 ----D---- D:\Program Files\Skype
2009-04-06 16:18:20 ----D---- D:\Program Files\Fichiers communs\Skype
2009-04-06 16:17:47 ----D---- D:\Documents and Settings\All Users\Application Data\Skype
2009-04-06 08:03:24 ----SH---- D:\WINDOWS\system32\anqntdrb.ini
2009-04-05 20:02:43 ----SH---- D:\WINDOWS\system32\jyoubmst.ini
2009-04-05 08:02:51 ----SH---- D:\WINDOWS\system32\ojetkhso.ini
2009-04-04 20:02:43 ----SH---- D:\WINDOWS\system32\rislonph.ini
2009-04-04 08:06:01 ----SH---- D:\WINDOWS\system32\qxudfbss.ini
2009-04-03 20:02:53 ----SH---- D:\WINDOWS\system32\xbbakdxl.ini
2009-04-03 08:06:07 ----SH---- D:\WINDOWS\system32\wcpyxfru.ini
2009-04-02 08:33:57 ----SH---- D:\WINDOWS\system32\ewotpgxk.ini
2009-04-01 20:31:50 ----SH---- D:\WINDOWS\system32\ejbskpry.ini
2009-04-01 08:31:58 ----SH---- D:\WINDOWS\system32\iavtohhf.ini
2009-03-31 13:00:40 ----SH---- D:\WINDOWS\system32\fwswmpla.ini
2009-03-31 01:00:29 ----SH---- D:\WINDOWS\system32\mcmupqax.ini
2009-03-30 13:00:40 ----SH---- D:\WINDOWS\system32\ynmdslxp.ini
2009-03-29 16:26:37 ----SH---- D:\WINDOWS\system32\xceyihmw.ini
2009-03-29 04:26:34 ----SH---- D:\WINDOWS\system32\uabrtokf.ini
2009-03-28 19:25:41 ----D---- D:\Documents and Settings\KIMI\Application Data\Real
2009-03-28 16:26:41 ----SH---- D:\WINDOWS\system32\auraqlgn.ini
2009-03-28 04:26:35 ----SH---- D:\WINDOWS\system32\umaekiqv.ini
2009-03-27 16:26:39 ----SH---- D:\WINDOWS\system32\pkfnfnev.ini
2009-03-27 03:17:33 ----SH---- D:\WINDOWS\system32\grjmaqfq.ini
2009-03-26 15:17:39 ----SH---- D:\WINDOWS\system32\vqjsbovx.ini
2009-03-25 18:07:51 ----SH---- D:\WINDOWS\system32\ntfjsoks.ini
2009-03-24 13:00:20 ----SH---- D:\WINDOWS\system32\tjftubkk.ini
2009-03-23 20:42:42 ----SH---- D:\WINDOWS\system32\ypsfpmci.ini
2009-03-23 08:39:36 ----SH---- D:\WINDOWS\system32\wwsixjmh.ini
2009-03-22 20:42:36 ----A---- D:\WINDOWS\system32\xheabuxb.dll
2009-03-22 20:42:36 ----A---- D:\WINDOWS\system32\jhmchm.dll
2009-03-22 20:39:42 ----SH---- D:\WINDOWS\system32\lwpuojuu.ini
2009-03-22 08:42:45 ----A---- D:\WINDOWS\system32\xtjpbu.dll
2009-03-22 08:42:37 ----A---- D:\WINDOWS\system32\ygqllvur.dll
2009-03-22 08:39:36 ----SH---- D:\WINDOWS\system32\ghdsoycb.ini
2009-03-21 20:42:41 ----SH---- D:\WINDOWS\system32\oinlmylo.ini
2009-03-21 08:39:42 ----SH---- D:\WINDOWS\system32\yuyuxxpc.ini
2009-03-20 14:34:31 ----SH---- D:\WINDOWS\system32\oxtfxtoe.ini
2009-03-19 13:00:13 ----SH---- D:\WINDOWS\system32\mqehhdbj.ini
2009-03-19 00:27:50 ----SH---- D:\WINDOWS\system32\aqberdfp.ini
2009-03-17 12:25:43 ----SH---- D:\WINDOWS\system32\dlillmrb.ini
2009-03-16 21:45:57 ----SH---- D:\WINDOWS\system32\fhbrmaya.ini
2009-03-16 09:48:59 ----SH---- D:\WINDOWS\system32\adednbas.ini
2009-03-15 13:18:22 ----SH---- D:\WINDOWS\system32\bvhvjlse.ini
2009-03-15 00:14:33 ----SH---- D:\WINDOWS\system32\yudemyro.ini
2009-03-14 12:17:43 ----SH---- D:\WINDOWS\system32\awnadtrf.ini
2009-03-14 00:15:08 ----SH---- D:\WINDOWS\system32\nydavynm.ini
2009-03-13 12:14:38 ----SH---- D:\WINDOWS\system32\kdcohgnx.ini
2009-03-13 00:14:32 ----SH---- D:\WINDOWS\system32\jecboyte.ini
2009-03-12 12:14:47 ----SH---- D:\WINDOWS\system32\sagrpgwc.ini
2009-03-12 00:14:31 ----SH---- D:\WINDOWS\system32\tunnxqaj.ini
2009-03-11 12:17:44 ----SH---- D:\WINDOWS\system32\ddgjnchy.ini

======List of files/folders modified in the last 2 months======

2009-05-10 19:59:42 ----D---- D:\WINDOWS\system32
2009-05-10 19:58:24 ----RD---- D:\Program Files
2009-05-10 19:53:57 ----D---- D:\Program Files\Mozilla Firefox
2009-05-10 19:39:48 ----D---- D:\WINDOWS\Temp
2009-05-10 19:20:24 ----D---- D:\WINDOWS\Prefetch
2009-05-10 17:42:09 ----D---- D:\WINDOWS
2009-05-10 17:40:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DMCache
2009-05-10 17:39:01 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-05-10 16:41:02 ----D---- D:\WINDOWS\system32\CatRoot2
2009-05-10 16:39:06 ----D---- D:\WINDOWS\system32\drivers
2009-05-10 09:09:46 ----SHD---- D:\System Volume Information
2009-05-06 21:02:00 ----SD---- D:\Documents and Settings\KIMI\Application Data\Microsoft
2009-05-01 23:26:14 ----SHD---- D:\WINDOWS\Installer
2009-05-01 22:33:05 ----D---- D:\Program Files\Faronics
2009-04-29 09:12:52 ----D---- D:\WINDOWS\Help
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs
2009-04-27 19:05:52 ----D---- D:\Program Files\Fichiers communs\Real
2009-04-27 19:05:46 ----A---- D:\WINDOWS\system32\rmoc3260.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5032.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5016.dll
2009-04-27 19:05:24 ----A---- D:\WINDOWS\system32\pncrt.dll
2009-04-27 19:00:27 ----SD---- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-23 19:45:38 ----D---- D:\WINDOWS\system32\ReinstallBackups
2009-04-23 19:45:36 ----HD---- D:\WINDOWS\inf
2009-04-23 19:45:29 ----RSHDC---- D:\WINDOWS\system32\dllcache
2009-04-23 19:43:32 ----D---- D:\Program Files\Fichiers communs\Logitech
2009-04-23 19:43:28 ----D---- D:\WINDOWS\WinSxS
2009-04-23 19:43:27 ----D---- D:\Program Files\Logitech
2009-04-14 12:15:42 ----A---- D:\WINDOWS\win.ini
2009-04-14 12:15:42 ----A---- D:\WINDOWS\system.ini
2009-04-14 12:15:41 ----D---- D:\WINDOWS\pss
2009-04-14 12:12:44 ----ASH---- D:\WINDOWS\system32\EMSAdMoq.ini
2009-04-14 12:12:16 ----ASH---- D:\WINDOWS\system32\EMSAdMoq.ini2
2009-04-14 04:14:08 ----A---- D:\WINDOWS\system32\0f05b679-.txt
2009-04-11 15:53:58 ----D---- D:\WINDOWS\Debug
2009-03-15 20:53:12 ----D---- D:\Program Files\Internet Download Manager
2009-03-13 20:04:05 ----D---- D:\WINDOWS\system32\Restore

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 KLIF;Kaspersky Lab Driver; D:\WINDOWS\system32\DRIVERS\klif.sys [2009-04-14 226832]
R2 LF30FS;LF30FS; \??\D:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; D:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; D:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Pilote de classe HID Microsoft; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; D:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-08-24 1052732]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; D:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; D:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 mouhid;Pilote HID de souris; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-09-07 12288]
R3 usbccgp;Pilote parent générique USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; D:\WINDOWS\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmFilter;Logitech Gaming HID Filter Driver; D:\WINDOWS\system32\drivers\WmFilter.sys [2008-01-24 28168]
R3 WmHidLo;Logitech Gaming USB Filter Driver; D:\WINDOWS\system32\drivers\WmHidLo.sys [2008-01-24 29192]
R3 WmVirHid;Logitech Virtual Hid Device Driver; D:\WINDOWS\system32\drivers\WmVirHid.sys [2008-01-24 14728]
R3 WmXlCore;Logitech Translation Layer Driver; D:\WINDOWS\system32\drivers\WmXlCore.sys [2008-01-24 48904]
S3 alesp9yg;alesp9yg; D:\WINDOWS\system32\drivers\alesp9yg.sys []
S3 aujasnkj;aujasnkj; \??\D:\DOCUME~1\KIMI\LOCALS~1\Temp\aujasnkj.sys []
S3 CCDECODE;Décodeur sous-titre fermé; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 LVUSBSta;Logitech USB Monitor Filter; D:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Pilote du Moniteur réseau; D:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 NPF;NetGroup Packet Filter Driver; D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 QCMerced;Logitech QuickCam Communicate; D:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 SLIP;Détrameur décalage BDA; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;Pilote USB audio (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBSTOR;Pilote de stockage de masse USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;Codec Teletext standard; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Pilote de filtre de restauration système; D:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-04 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Kaspersky Internet Security; D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
R2 DF5Serv;DF5Serv; D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe [2007-10-25 430080]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; D:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); D:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]

-----------------EOF-----------------

Rapport info:

info.txt logfile of random's system information tool 1.06 2009-05-10 20:01:59

======Uninstall list======

-->D:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 D:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 Plugin-->D:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->D:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Archiveur WinRAR-->D:\Program Files\WinRAR\uninstall.exe
CCleaner (remove only)-->"D:\Program Files\CCleaner\uninst.exe"
Correctif Windows XP - KB883667-->D:\WINDOWS\$NtUninstallKB883667$\spuninst\spuninst.exe
F1 WCP 2009-->C:\Ferrari 2008 Screensaver.zip\rFactor\F1 WCP 2009\uninstall.exe
Foxit Reader-->D:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
High Definition Audio - KB888111-->"D:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"D:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel(R) Graphics Media Accelerator Driver-->RUNDLL32.EXE D:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2776 PCI\VEN_8086&DEV_2772
Internet Download Manager-->D:\Program Files\Internet Download Manager\Uninstall.exe
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
KP-Anti Mosquitoes-->D:\PROGRA~1\KPSOFT~1\UNWISE.EXE D:\PROGRA~1\KPSOFT~1\INSTALL.LOG
Lock Folder XP 3.6-->"D:\Program Files\Everstrike Software\Lock Folder XP 3.6\Uninstall.exe" "D:\Program Files\Fichiers communs\Everstrike Software\Lock Folder XP 3.6\install.log"
Logiciel QuickCam de Logitech-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c
Logitech Gaming Software 5.02-->MsiExec.exe /X{64B20B36-AEE7-4DD4-897C-C5DA5C218F60}
Messenger Plus! Live-->"D:\Program Files\Messenger Plus! Live\Uninstall.exe"
Mozilla Firefox (3.0.4)-->D:\Program Files\Mozilla Firefox\uninstall\helper.exe
NeoTrace Express 3.25-->D:\PROGRA~1\NEOTRA~1\UNWISE.EXE D:\PROGRA~1\NEOTRA~1\INSTALL.LOG
PhotoFiltre-->"D:\Program Files\PhotoFiltre\Uninst.exe"
Programme de gestion Camera de Logitech®-->"D:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
RealPlayer-->D:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SnagIt 7-->D:\Program Files\TechSmith\SnagIt 7\SIUNINST.EXE
Storm Codec-->D:\Program Files\Ringz Studio\Storm Codec\uninst7.01.19.exe
SWF Opener-->"D:\Program Files\UnH Solutions\SWF Opener\unins000.exe"
TeLL me More-->C:\TeLLmeMore\UnInstal.exe C:\TeLLmeMore\
VDownloader 0.82-->"D:\Program Files\VDOWNLOADER\unins000.exe"
VideoLAN VLC media player 0.8.6b-->D:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
WinPcap 4.0.2-->D:\Program Files\WinPcap\uninstall.exe
Wireshark 1.0.7-->"D:\Program Files\Wireshark\uninstall.exe"

======Hosts File======

127.0.0.1 localhost
82.98.231.89 browser-security.microsoft.com
82.98.231.89 best-click-scanner.info
82.98.231.89 antivirus-xp-pro-2009.com
82.98.231.89 microsoft.infosecuritycenter.com
82.98.231.89 microsoft.softwaresecurityhelp.com
82.98.231.89 onlinenotifyq.net
82.98.231.89 antivirusxp-pro-2009.com
82.98.231.89 microsoft.browser-security-center.com

======Security center information======

AV: Kaspersky Internet Security
FW: Kaspersky Internet Security

======System event log======

Computer Name: RAIKKONEN
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 405
Source Name: Service Control Manager
Time Written: 20090309151356.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: RAIKKONEN
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Gestionnaire de connexions d'accès distant.

Record Number: 404
Source Name: Service Control Manager
Time Written: 20090309151356.000000+060
Event Type: Informations
User: RAIKKONEN\KIMI

Computer Name: RAIKKONEN
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

Record Number: 403
Source Name: Service Control Manager
Time Written: 20090309151354.000000+060
Event Type: Informations
User:

Computer Name: RAIKKONEN
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 402
Source Name: Service Control Manager
Time Written: 20090309151354.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: RAIKKONEN
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 401
Source Name: Service Control Manager
Time Written: 20090309151353.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: RAIKKONEN
Event Code: 301
Message: msnmsgr (1740) \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\fsr.log.

Record Number: 1466
Source Name: ESENT
Time Written: 20090411185137.000000+060
Event Type: Informations
User:

Computer Name: RAIKKONEN
Event Code: 301
Message: msnmsgr (1740) \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\fsr0022B.log.

Record Number: 1465
Source Name: ESENT
Time Written: 20090411185137.000000+060
Event Type: Informations
User:

Computer Name: RAIKKONEN
Event Code: 301
Message: msnmsgr (1740) \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\fsr0022A.log.

Record Number: 1464
Source Name: ESENT
Time Written: 20090411185137.000000+060
Event Type: Informations
User:

Computer Name: RAIKKONEN
Event Code: 301
Message: msnmsgr (1740) \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\fsr00229.log.

Record Number: 1463
Source Name: ESENT
Time Written: 20090411185136.000000+060
Event Type: Informations
User:

Computer Name: RAIKKONEN
Event Code: 301
Message: msnmsgr (1740) \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\D:\Documents and Settings\KIMI\Local Settings\Application Data\Microsoft\Messenger\amir_811@hotmail.com\SharingMetadata\Working\database_E088_A1A2_88A1_7824\fsr00228.log.

Record Number: 1462
Source Name: ESENT
Time Written: 20090411185136.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0409
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Bien ...


on attaque avec ceci :


Télécharge UsbFix ( de C_XX, Chimay8 & Chiquitine29 ) sur ton bureau :

> http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

! Déconnecte toi d'internet et ferme toutes applications en cours !

--> Double-clique sur l' .exe pour lancer l'installation de l'outil ( ne touche pas aux paramètres d'installe ) .


Impératif :
Branche toutes tes unités externes à ton PC (clé USB, DD externe, flash disk, lecteur MP3,carte SD, etc...) succeptibles d'avoir été infectés ( mais sans les ouvrir ! ) .


# Double clique sur le raccourci UsbFix présent sur ton bureau pour lancer l'outil.

# Choisis l' option 1 ( Recherche )

# Laisse travailler l'outil et ne touche à rien pendant le scan .

# Une fois terminé, poste le rapport UsbFix.txt qui apparaitra.

Le rapport est en outre sauvegardé à la racine du disque maitre ( C:\UsbFix.txt ).

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )


Note :
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.


Site de l'auteur > http://pagesperso-orange.fr/NosTools/usbfix.html

"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Rapport usbfix:

############################## [ UsbFix V3.017 # Cleaning ]

# User : KIMI (Administrateurs) # RAIKKONEN
# Update on 06/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 20:53:00 | 10/05/2009

# Intel(R) Pentium(R) 4 CPU 2.80GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled
# AV : Kaspersky Internet Security 8.0.0.506 [ Enabled | Updated ]
# FW : Kaspersky Internet Security[ Enabled ]8.0.0.506

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 27,26 Go (6,51 Go free) [AMIR] # NTFS
# D:\ # Disque fixe local # 10 Go (1,11 Go free) # NTFS
# E:\ # Disque CD-ROM # 4,37 Go (0 Mo free) [hasen] # CDFS
# F:\ # Disque CD-ROM
# G:\ # Disque CD-ROM
# H:\ # Disque CD-ROM
# I:\ # Disque CD-ROM

############################## [ Processus actifs ]

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\_$Df\FrzState2k.exe
D:\WINDOWS\System32\alg.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Deleted ! D:\WINDOWS\system32\winjpg.jpg
Deleted ! C:\winfile.jpg
Deleted ! C:\autorun.inf
Deleted ! C:\zPharaoh.exe
Deleted ! D:\winfile.jpg
Deleted ! D:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

# HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "AntiVirusOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "FirewallDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "UpdatesDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\Software\Microsoft\....\MountPoints2\{bca0f511-3a4e-11de-961c-003005c6503c}\Shell\AutoRun\command
Deleted ! HKCU\Software\Microsoft\....\MountPoints2\{fcb432df-1890-11de-95f9-003005c6503c}\Shell\AutoRun\command

################## [ Listing des fichiers présent ]

[11/02/2009 11:52|--a------|0] - C:\AUTOEXEC.BAT
[14/04/2009 12:15|---hs----|212] - C:\boot.ini
[07/09/2002 01:00|-rahs----|4952] - C:\Bootfont.bin
[11/02/2009 11:52|--a------|0] - C:\CONFIG.SYS
[05/03/2009 12:25|--a------|0] - C:\dfinstall.log
[11/02/2009 11:52|-rahs----|0] - C:\IO.SYS
[11/02/2009 11:52|-rahs----|0] - C:\MSDOS.SYS
[03/03/2009 16:08|--a------|23] - C:\Nouveau Document texte.txt
[04/08/2004 03:38|-rahs----|47564] - C:\NTDETECT.COM
[04/08/2004 03:59|-rahs----|251712] - C:\ntldr
[18/01/2004 11:26|--a------|48] - C:\Serial Tell Me more Espagnol.txt
[03/03/2009 12:44|--ah-----|268] - C:\sqmdata00.sqm
[03/03/2009 12:44|--ah-----|244] - C:\sqmnoopt00.sqm
[18/11/2001 14:32|--a------|442191872] - C:\Tell-me-More CD1 (Espagnol Installation).iso
[21/01/2004 05:33|--a------|574310400] - C:\Tell-me-More CD2 (Espagnol d‚butant).ISO
[21/01/2004 18:19|--a------|619599872] - C:\Tell-me-More CD3 (Espagnol.intermediaire).iso
[21/01/2004 13:41|--a------|677718016] - C:\Tell-me-More CD4 (Espagnol confirm‚).ISO
[16/04/2009 22:58|--ahs----|37888] - C:\Thumbs.db
[03/03/2009 12:28|--a------|1005] - D:\FSC-DeskUpdate.txt
[?|?|?] - D:\pagefile.sys
[05/03/2009 12:25|---------|16299862] - D:\Persi0.sys
[03/03/2009 12:32|--ah-----|268] - D:\sqmdata00.sqm
[17/03/2009 18:34|--ah-----|232] - D:\sqmdata01.sqm
[03/03/2009 12:32|--ah-----|244] - D:\sqmnoopt00.sqm
[17/03/2009 18:34|--ah-----|244] - D:\sqmnoopt01.sqm
[10/05/2009 20:55|--a------|4792] - D:\UsbFix.txt
[22/10/2006 11:42|-r-------|206901488] - E:\Scrubs S5E01.avi
[22/10/2006 12:22|-r-------|206738862] - E:\Scrubs S5E02.avi
[22/10/2006 12:50|-r-------|141338624] - E:\Scrubs S5E03.avi
[23/10/2006 11:29|-r-------|174837760] - E:\Scrubs S5E04.avi
[23/10/2006 12:03|-r-------|176154624] - E:\Scrubs S5E05.avi
[23/10/2006 12:37|-r-------|177434624] - E:\Scrubs S5E06.avi
[09/02/2007 20:30|-r-------|190461952] - E:\Scrubs S5E07.avi
[23/10/2006 20:33|-r-------|203771904] - E:\Scrubs S5E08.avi
[23/10/2006 21:35|-r-------|209838080] - E:\Scrubs S5E09.avi
[23/10/2006 22:08|-r-------|209399808] - E:\Scrubs S5E10.avi
[23/10/2006 22:41|-r-------|209857488] - E:\Scrubs S5E11.avi
[23/10/2006 23:55|-r-------|209098242] - E:\Scrubs S5E12.avi
[25/10/2006 11:48|-r-------|209971764] - E:\Scrubs S5E13.avi
[25/10/2006 12:21|-r-------|210265062] - E:\Scrubs S5E14.avi
[03/11/2006 21:45|-r-------|211030016] - E:\Scrubs S5E15.avi
[03/11/2006 22:17|-r-------|211150848] - E:\Scrubs S5E16.avi
[03/11/2006 22:50|-r-------|211185664] - E:\Scrubs S5E17.avi
[03/11/2006 23:34|-r-------|211161088] - E:\Scrubs S5E18.avi
[16/02/2007 22:46|-r-------|179806208] - E:\Scrubs S5E19.avi
[16/02/2007 22:09|-r-------|179908608] - E:\Scrubs S5E20.avi
[16/02/2007 21:38|-r-------|179888128] - E:\Scrubs S5E21.avi
[16/02/2007 21:12|-r-------|179847168] - E:\Scrubs S5E22.avi
[27/11/2006 10:41|-r-------|188649564] - E:\Scrubs S5E23.avi
[01/12/2006 04:55|-r-------|205420898] - E:\Scrubs S5E24.avi

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.017 ! ]

Rapport log :
Logfile of random's system information tool 1.06 (written by random/random)
Run by KIMI at 2009-05-10 20:58:45
Microsoft Windows XP Professionnel Service Pack 2
System drive D: has 1 GB (11%) free of 10 GB
Total RAM: 1270 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:58:47, on 10/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\_$Df\FrzState2k.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\KIMI\Bureau\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\KIMI.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 82.98.231.89 browser-security.microsoft.com
O1 - Hosts: 82.98.231.89 best-click-scanner.info
O1 - Hosts: 82.98.231.89 antivirus-xp-pro-2009.com
O1 - Hosts: 82.98.231.89 microsoft.infosecuritycenter.com
O1 - Hosts: 82.98.231.89 microsoft.softwaresecurityhelp.com
O1 - Hosts: 82.98.231.89 onlinenotifyq.net
O1 - Hosts: 82.98.231.89 antivirusxp-pro-2009.com
O1 - Hosts: 82.98.231.89 microsoft.browser-security-center.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {31CDFCB9-37D6-4C1D-A31D-AA2DD56F637B} - (no file)
O2 - BHO: (no name) - {31D1305D-195C-4836-AB15-CE560FA8C578} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] D:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &NeoTrace It! - D:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1C12C-295B-4ED4-93C7-92DEFB761E72}: NameServer = 208.67.222.222 193.55.10.102
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: cbXNHyaA - cbXNHyaA.dll (file missing)
O20 - Winlogon Notify: DfLogon - D:\WINDOWS\SYSTEM32\LogonDll.dll
O20 - Winlogon Notify: fccbXonN - fccbXonN.dll (file missing)
O20 - Winlogon Notify: hgGwTlLb - hgGwTlLb.dll (file missing)
O20 - Winlogon Notify: khfCtuvu - khfCtuvu.dll (file missing)
O20 - Winlogon Notify: pmnnkLFX - pmnnkLFX.dll (file missing)
O20 - Winlogon Notify: rqRHyxvw - rqRHyxvw.dll (file missing)
O20 - Winlogon Notify: tuvUNedD - tuvUNedD.dll (file missing)
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DF5Serv - Faronics Corporation - D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
End of file - 5578 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2008-01-08 95664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
HelperObject Class - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll [2004-10-01 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-27 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31CDFCB9-37D6-4C1D-A31D-AA2DD56F637B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D1305D-195C-4836-AB15-CE560FA8C578}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll [2004-10-01 131072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
"Start WingMan Profiler"=D:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 88584]
"TkBellExe"=D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-27 185872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04267207]
D:\WINDOWS\system32\pjviiqml.dll,b []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
D:\WINDOWS\system32\hkcmd.exe [2005-08-24 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
D:\WINDOWS\system32\igfxpers.exe [2005-08-24 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
D:\WINDOWS\system32\igfxtray.exe [2005-08-24 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LFAgent]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
D:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
D:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
D:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
D:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
D:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2006-11-26 97357]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SnagIt 7.lnk]
D:\PROGRA~1\TECHSM~1\SNAGIT~1\SnagIt32.exe [2004-10-01 2637824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXNHyaA]
cbXNHyaA.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon]
D:\WINDOWS\system32\LogonDll.dll [2007-10-25 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccbXonN]
fccbXonN.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hgGwTlLb]
hgGwTlLb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
D:\WINDOWS\system32\igfxdev.dll [2005-08-24 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfCtuvu]
khfCtuvu.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
D:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnnkLFX]
pmnnkLFX.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqRHyxvw]
rqRHyxvw.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvUNedD]
tuvUNedD.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{31CDFCB9-37D6-4C1D-A31D-AA2DD56F637B}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
D:\WINDOWS\system32\qoMdASME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=36
"NoFind"=
"NoFolderOptions"=
"NoRun"=
"NoDrives"=0
"NoViewContextMenu"=0
"NoWinKeys"=0
"NoDriveAutoRun"=FFFFFFFF

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoLogOff"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\Documents and Settings\KIMI\Local Settings\Temp\IXP000.TMP\pes2009.exe"="D:\Documents and Settings\KIMI\Local Settings\Temp\IXP000.TMP\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 2 months======

2009-05-10 20:55:13 ----RASHD---- D:\autorun.inf
2009-05-10 20:52:31 ----A---- D:\UsbFix.txt
2009-05-10 20:17:14 ----D---- D:\UsbFix
2009-05-10 20:01:55 ----D---- D:\rsit
2009-05-10 19:58:24 ----D---- D:\Program Files\Trend Micro
2009-05-10 16:41:31 ----D---- D:\Program Files\DAEMON Tools Lite
2009-05-10 16:39:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DAEMON Tools
2009-05-10 12:13:26 ----A---- D:\WINDOWS\UnSetup.exe
2009-05-10 12:13:26 ----A---- D:\WINDOWS\FraUinst.exe
2009-05-10 12:13:07 ----D---- D:\WINDOWS\Lhsp
2009-05-10 09:09:08 ----D---- D:\Program Files\Bifrost
2009-05-05 20:18:27 ----D---- D:\Documents and Settings\KIMI\Application Data\Help
2009-05-03 16:16:05 ----D---- D:\Program Files\uTorrent
2009-05-03 16:16:03 ----D---- D:\Documents and Settings\KIMI\Application Data\uTorrent
2009-05-03 10:17:01 ----D---- D:\Documents and Settings\KIMI\Application Data\dvdcss
2009-05-02 12:45:59 ----D---- D:\Program Files\VDOWNLOADER
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs\xing shared
2009-04-27 19:05:08 ----D---- D:\Program Files\Real
2009-04-26 18:07:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Wireshark
2009-04-26 18:04:15 ----D---- D:\Program Files\WinPcap
2009-04-26 18:03:26 ----D---- D:\Program Files\Wireshark
2009-04-26 17:56:30 ----D---- D:\Program Files\NeoTrace Express
2009-04-22 16:56:30 ----D---- D:\Program Files\PhotoFiltre
2009-04-14 10:44:23 ----D---- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-14 04:15:58 ----SH---- D:\WINDOWS\system32\sgxdviyq.ini
2009-04-13 16:25:52 ----D---- D:\Program Files\UnH Solutions
2009-04-13 16:14:10 ----SH---- D:\WINDOWS\system32\bthwjeme.ini
2009-04-12 19:36:19 ----SH---- D:\WINDOWS\system32\gijkoxgd.ini
2009-04-12 09:09:36 ----SH---- D:\WINDOWS\system32\mjpddnow.ini
2009-04-11 19:34:44 ----SH---- D:\WINDOWS\system32\hqpynqfn.ini
2009-04-11 16:40:11 ----D---- D:\Program Files\KP Software
2009-04-11 16:25:17 ----D---- D:\Program Files\TechSmith
2009-04-11 15:52:50 ----D---- D:\Program Files\CCleaner
2009-04-11 07:35:12 ----SH---- D:\WINDOWS\system32\aevagwtk.ini
2009-04-10 19:38:18 ----SH---- D:\WINDOWS\system32\usleuyeq.ini
2009-04-10 07:35:17 ----SH---- D:\WINDOWS\system32\dpyprvdu.ini
2009-04-09 19:33:58 ----SH---- D:\WINDOWS\system32\yskeccll.ini
2009-04-09 07:34:03 ----SH---- D:\WINDOWS\system32\bhdsdrsu.ini
2009-04-08 19:30:58 ----SH---- D:\WINDOWS\system32\bgtokhjn.ini
2009-04-08 07:34:03 ----SH---- D:\WINDOWS\system32\bcyihljq.ini
2009-04-07 11:15:16 ----A---- D:\WINDOWS\system32\oydcki.dll
2009-04-07 11:15:00 ----A---- D:\WINDOWS\system32\ljhqpoop.dll
2009-04-07 11:12:09 ----SH---- D:\WINDOWS\system32\hpvuerdc.ini
2009-04-06 20:02:38 ----SH---- D:\WINDOWS\system32\nhpbakvy.ini
2009-04-06 16:19:40 ----D---- D:\Documents and Settings\KIMI\Application Data\skypePM
2009-04-06 16:19:01 ----D---- D:\Documents and Settings\KIMI\Application Data\Skype
2009-04-06 16:18:21 ----D---- D:\Program Files\Skype
2009-04-06 16:18:20 ----D---- D:\Program Files\Fichiers communs\Skype
2009-04-06 16:17:47 ----D---- D:\Documents and Settings\All Users\Application Data\Skype
2009-04-06 08:03:24 ----SH---- D:\WINDOWS\system32\anqntdrb.ini
2009-04-05 20:02:43 ----SH---- D:\WINDOWS\system32\jyoubmst.ini
2009-04-05 08:02:51 ----SH---- D:\WINDOWS\system32\ojetkhso.ini
2009-04-04 20:02:43 ----SH---- D:\WINDOWS\system32\rislonph.ini
2009-04-04 08:06:01 ----SH---- D:\WINDOWS\system32\qxudfbss.ini
2009-04-03 20:02:53 ----SH---- D:\WINDOWS\system32\xbbakdxl.ini
2009-04-03 08:06:07 ----SH---- D:\WINDOWS\system32\wcpyxfru.ini
2009-04-02 08:33:57 ----SH---- D:\WINDOWS\system32\ewotpgxk.ini
2009-04-01 20:31:50 ----SH---- D:\WINDOWS\system32\ejbskpry.ini
2009-04-01 08:31:58 ----SH---- D:\WINDOWS\system32\iavtohhf.ini
2009-03-31 13:00:40 ----SH---- D:\WINDOWS\system32\fwswmpla.ini
2009-03-31 01:00:29 ----SH---- D:\WINDOWS\system32\mcmupqax.ini
2009-03-30 13:00:40 ----SH---- D:\WINDOWS\system32\ynmdslxp.ini
2009-03-29 16:26:37 ----SH---- D:\WINDOWS\system32\xceyihmw.ini
2009-03-29 04:26:34 ----SH---- D:\WINDOWS\system32\uabrtokf.ini
2009-03-28 19:25:41 ----D---- D:\Documents and Settings\KIMI\Application Data\Real
2009-03-28 16:26:41 ----SH---- D:\WINDOWS\system32\auraqlgn.ini
2009-03-28 04:26:35 ----SH---- D:\WINDOWS\system32\umaekiqv.ini
2009-03-27 16:26:39 ----SH---- D:\WINDOWS\system32\pkfnfnev.ini
2009-03-27 03:17:33 ----SH---- D:\WINDOWS\system32\grjmaqfq.ini
2009-03-26 15:17:39 ----SH---- D:\WINDOWS\system32\vqjsbovx.ini
2009-03-25 18:07:51 ----SH---- D:\WINDOWS\system32\ntfjsoks.ini
2009-03-24 13:00:20 ----SH---- D:\WINDOWS\system32\tjftubkk.ini
2009-03-23 20:42:42 ----SH---- D:\WINDOWS\system32\ypsfpmci.ini
2009-03-23 08:39:36 ----SH---- D:\WINDOWS\system32\wwsixjmh.ini
2009-03-22 20:42:36 ----A---- D:\WINDOWS\system32\xheabuxb.dll
2009-03-22 20:42:36 ----A---- D:\WINDOWS\system32\jhmchm.dll
2009-03-22 20:39:42 ----SH---- D:\WINDOWS\system32\lwpuojuu.ini
2009-03-22 08:42:45 ----A---- D:\WINDOWS\system32\xtjpbu.dll
2009-03-22 08:42:37 ----A---- D:\WINDOWS\system32\ygqllvur.dll
2009-03-22 08:39:36 ----SH---- D:\WINDOWS\system32\ghdsoycb.ini
2009-03-21 20:42:41 ----SH---- D:\WINDOWS\system32\oinlmylo.ini
2009-03-21 08:39:42 ----SH---- D:\WINDOWS\system32\yuyuxxpc.ini
2009-03-20 14:34:31 ----SH---- D:\WINDOWS\system32\oxtfxtoe.ini
2009-03-19 13:00:13 ----SH---- D:\WINDOWS\system32\mqehhdbj.ini
2009-03-19 00:27:50 ----SH---- D:\WINDOWS\system32\aqberdfp.ini
2009-03-17 12:25:43 ----SH---- D:\WINDOWS\system32\dlillmrb.ini
2009-03-16 21:45:57 ----SH---- D:\WINDOWS\system32\fhbrmaya.ini
2009-03-16 09:48:59 ----SH---- D:\WINDOWS\system32\adednbas.ini
2009-03-15 13:18:22 ----SH---- D:\WINDOWS\system32\bvhvjlse.ini
2009-03-15 00:14:33 ----SH---- D:\WINDOWS\system32\yudemyro.ini
2009-03-14 12:17:43 ----SH---- D:\WINDOWS\system32\awnadtrf.ini
2009-03-14 00:15:08 ----SH---- D:\WINDOWS\system32\nydavynm.ini
2009-03-13 12:14:38 ----SH---- D:\WINDOWS\system32\kdcohgnx.ini
2009-03-13 00:14:32 ----SH---- D:\WINDOWS\system32\jecboyte.ini
2009-03-12 12:14:47 ----SH---- D:\WINDOWS\system32\sagrpgwc.ini
2009-03-12 00:14:31 ----SH---- D:\WINDOWS\system32\tunnxqaj.ini
2009-03-11 12:17:44 ----SH---- D:\WINDOWS\system32\ddgjnchy.ini

======List of files/folders modified in the last 2 months======

2009-05-10 20:57:53 ----D---- D:\Program Files\Mozilla Firefox
2009-05-10 20:55:13 ----D---- D:\WINDOWS\Prefetch
2009-05-10 20:53:12 ----D---- D:\WINDOWS\system32
2009-05-10 20:52:58 ----D---- D:\WINDOWS\Temp
2009-05-10 20:51:29 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-05-10 19:58:24 ----RD---- D:\Program Files
2009-05-10 17:42:09 ----D---- D:\WINDOWS
2009-05-10 17:40:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DMCache
2009-05-10 16:41:02 ----D---- D:\WINDOWS\system32\CatRoot2
2009-05-10 16:39:06 ----D---- D:\WINDOWS\system32\drivers
2009-05-10 09:09:46 ----SHD---- D:\System Volume Information
2009-05-06 21:02:00 ----SD---- D:\Documents and Settings\KIMI\Application Data\Microsoft
2009-05-01 23:26:14 ----SHD---- D:\WINDOWS\Installer
2009-05-01 22:33:05 ----D---- D:\Program Files\Faronics
2009-04-29 09:12:52 ----D---- D:\WINDOWS\Help
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs
2009-04-27 19:05:52 ----D---- D:\Program Files\Fichiers communs\Real
2009-04-27 19:05:46 ----A---- D:\WINDOWS\system32\rmoc3260.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5032.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5016.dll
2009-04-27 19:05:24 ----A---- D:\WINDOWS\system32\pncrt.dll
2009-04-27 19:00:27 ----SD---- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-23 19:45:38 ----D---- D:\WINDOWS\system32\ReinstallBackups
2009-04-23 19:45:36 ----HD---- D:\WINDOWS\inf
2009-04-23 19:45:29 ----RSHDC---- D:\WINDOWS\system32\dllcache
2009-04-23 19:43:32 ----D---- D:\Program Files\Fichiers communs\Logitech
2009-04-23 19:43:28 ----D---- D:\WINDOWS\WinSxS
2009-04-23 19:43:27 ----D---- D:\Program Files\Logitech
2009-04-14 12:15:42 ----A---- D:\WINDOWS\win.ini
2009-04-14 12:15:42 ----A---- D:\WINDOWS\system.ini
2009-04-14 12:15:41 ----D---- D:\WINDOWS\pss
2009-04-14 12:12:44 ----ASH---- D:\WINDOWS\system32\EMSAdMoq.ini
2009-04-14 12:12:16 ----ASH---- D:\WINDOWS\system32\EMSAdMoq.ini2
2009-04-14 04:14:08 ----A---- D:\WINDOWS\system32\0f05b679-.txt
2009-04-11 15:53:58 ----D---- D:\WINDOWS\Debug
2009-03-15 20:53:12 ----D---- D:\Program Files\Internet Download Manager
2009-03-13 20:04:05 ----D---- D:\WINDOWS\system32\Restore

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 KLIF;Kaspersky Lab Driver; D:\WINDOWS\system32\DRIVERS\klif.sys [2009-04-14 226832]
R2 LF30FS;LF30FS; \??\D:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; D:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; D:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Pilote de classe HID Microsoft; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; D:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-08-24 1052732]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; D:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; D:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 mouhid;Pilote HID de souris; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-09-07 12288]
R3 usbccgp;Pilote parent générique USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; D:\WINDOWS\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmFilter;Logitech Gaming HID Filter Driver; D:\WINDOWS\system32\drivers\WmFilter.sys [2008-01-24 28168]
R3 WmHidLo;Logitech Gaming USB Filter Driver; D:\WINDOWS\system32\drivers\WmHidLo.sys [2008-01-24 29192]
R3 WmXlCore;Logitech Translation Layer Driver; D:\WINDOWS\system32\drivers\WmXlCore.sys [2008-01-24 48904]
S3 anma870d;anma870d; D:\WINDOWS\system32\drivers\anma870d.sys []
S3 CCDECODE;Décodeur sous-titre fermé; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 LVUSBSta;Logitech USB Monitor Filter; D:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Pilote du Moniteur réseau; D:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 NPF;NetGroup Packet Filter Driver; D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 QCMerced;Logitech QuickCam Communicate; D:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 SLIP;Détrameur décalage BDA; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;Pilote USB audio (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBSTOR;Pilote de stockage de masse USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WmVirHid;Logitech Virtual Hid Device Driver; D:\WINDOWS\system32\drivers\WmVirHid.sys [2008-01-24 14728]
S3 WSTCODEC;Codec Teletext standard; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Pilote de filtre de restauration système; D:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-04 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Kaspersky Internet Security; D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
R2 DF5Serv;DF5Serv; D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe [2007-10-25 430080]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); D:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; D:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

-----------------EOF-----------------

Est ce que c'est terminé ?

Rapport malawar:
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2105
Windows 5.1.2600 Service Pack 2

10/05/2009 22:06:51
mbam-log-2009-05-10 (22-06-51).txt

Type de recherche: Examen rapide
Eléments examinés: 67773
Temps écoulé: 2 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 11
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\­Ext\Stats\{31cdfcb9-37d6-4c1d-a31d-aa2dd56f637b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31cdfcb9-37d6-4c1d-a31d-aa2dd56f637b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{31cdfcb9-37d6-4c1d-a31d-aa2dd56f637b} (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
D:\Program Files\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
D:\Program Files\Bifrost\logg.dat (Backdoor.Bifrose) -> Quarantined and deleted successfully.
D:\Documents and Settings\KIMI\Application Data\QNVW601P.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Rapport rsit:
Logfile of random's system information tool 1.06 (written by random/random)
Run by KIMI at 2009-05-10 22:11:20
Microsoft Windows XP Professionnel Service Pack 2
System drive D: has 1 GB (12%) free of 10 GB
Total RAM: 1270 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:11:23, on 10/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Logitech\Gaming Software\LWEMon.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\_$Df\FrzState2k.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Internet Download Manager\IEMonitor.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\KIMI\Bureau\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\KIMI.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 82.98.231.89 browser-security.microsoft.com
O1 - Hosts: 82.98.231.89 best-click-scanner.info
O1 - Hosts: 82.98.231.89 antivirus-xp-pro-2009.com
O1 - Hosts: 82.98.231.89 microsoft.infosecuritycenter.com
O1 - Hosts: 82.98.231.89 microsoft.softwaresecurityhelp.com
O1 - Hosts: 82.98.231.89 onlinenotifyq.net
O1 - Hosts: 82.98.231.89 antivirusxp-pro-2009.com
O1 - Hosts: 82.98.231.89 microsoft.browser-security-center.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {31D1305D-195C-4836-AB15-CE560FA8C578} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] D:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &NeoTrace It! - D:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1C12C-295B-4ED4-93C7-92DEFB761E72}: NameServer = 208.67.222.222 193.55.10.102
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: cbXNHyaA - cbXNHyaA.dll (file missing)
O20 - Winlogon Notify: DfLogon - D:\WINDOWS\SYSTEM32\LogonDll.dll
O20 - Winlogon Notify: fccbXonN - fccbXonN.dll (file missing)
O20 - Winlogon Notify: hgGwTlLb - hgGwTlLb.dll (file missing)
O20 - Winlogon Notify: khfCtuvu - khfCtuvu.dll (file missing)
O20 - Winlogon Notify: pmnnkLFX - pmnnkLFX.dll (file missing)
O20 - Winlogon Notify: rqRHyxvw - rqRHyxvw.dll (file missing)
O20 - Winlogon Notify: tuvUNedD - tuvUNedD.dll (file missing)
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DF5Serv - Faronics Corporation - D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
End of file - 5898 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2008-01-08 95664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
HelperObject Class - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll [2004-10-01 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-27 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D1305D-195C-4836-AB15-CE560FA8C578}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll [2004-10-01 131072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
"Start WingMan Profiler"=D:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 88584]
"TkBellExe"=D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-27 185872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04267207]
D:\WINDOWS\system32\pjviiqml.dll,b []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
D:\WINDOWS\system32\hkcmd.exe [2005-08-24 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
D:\WINDOWS\system32\igfxpers.exe [2005-08-24 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
D:\WINDOWS\system32\igfxtray.exe [2005-08-24 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LFAgent]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
D:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
D:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
D:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
D:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
D:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2006-11-26 97357]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SnagIt 7.lnk]
D:\PROGRA~1\TECHSM~1\SNAGIT~1\SnagIt32.exe [2004-10-01 2637824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXNHyaA]
cbXNHyaA.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon]
D:\WINDOWS\system32\LogonDll.dll [2007-10-25 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccbXonN]
fccbXonN.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hgGwTlLb]
hgGwTlLb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
D:\WINDOWS\system32\igfxdev.dll [2005-08-24 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfCtuvu]
khfCtuvu.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
D:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnnkLFX]
pmnnkLFX.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqRHyxvw]
rqRHyxvw.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvUNedD]
tuvUNedD.dll []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
D:\WINDOWS\system32\qoMdASME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=36
"NoFind"=
"NoFolderOptions"=
"NoRun"=
"NoDrives"=0
"NoViewContextMenu"=0
"NoWinKeys"=0
"NoDriveAutoRun"=FFFFFFFF

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoLogOff"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\Documents and Settings\KIMI\Local Settings\Temp\IXP000.TMP\pes2009.exe"="D:\Documents and Settings\KIMI\Local Settings\Temp\IXP000.TMP\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 2 months======

2009-05-10 22:00:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Malwarebytes
2009-05-10 22:00:39 ----D---- D:\Program Files\Malwarebytes' Anti-Malware
2009-05-10 22:00:39 ----D---- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-05-10 20:55:13 ----RASHD---- D:\autorun.inf
2009-05-10 20:52:31 ----A---- D:\UsbFix.txt
2009-05-10 20:17:14 ----D---- D:\UsbFix
2009-05-10 20:01:55 ----D---- D:\rsit
2009-05-10 19:58:24 ----D---- D:\Program Files\Trend Micro
2009-05-10 16:41:31 ----D---- D:\Program Files\DAEMON Tools Lite
2009-05-10 16:39:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DAEMON Tools
2009-05-10 12:13:26 ----A---- D:\WINDOWS\UnSetup.exe
2009-05-10 12:13:26 ----A---- D:\WINDOWS\FraUinst.exe
2009-05-10 12:13:07 ----D---- D:\WINDOWS\Lhsp
2009-05-05 20:18:27 ----D---- D:\Documents and Settings\KIMI\Application Data\Help
2009-05-03 16:16:05 ----D---- D:\Program Files\uTorrent
2009-05-03 16:16:03 ----D---- D:\Documents and Settings\KIMI\Application Data\uTorrent
2009-05-03 10:17:01 ----D---- D:\Documents and Settings\KIMI\Application Data\dvdcss
2009-05-02 12:45:59 ----D---- D:\Program Files\VDOWNLOADER
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs\xing shared
2009-04-27 19:05:08 ----D---- D:\Program Files\Real
2009-04-26 18:07:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Wireshark
2009-04-26 18:04:15 ----D---- D:\Program Files\WinPcap
2009-04-26 18:03:26 ----D---- D:\Program Files\Wireshark
2009-04-26 17:56:30 ----D---- D:\Program Files\NeoTrace Express
2009-04-22 16:56:30 ----D---- D:\Program Files\PhotoFiltre
2009-04-14 10:44:23 ----D---- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-14 04:15:58 ----SH---- D:\WINDOWS\system32\sgxdviyq.ini
2009-04-13 16:25:52 ----D---- D:\Program Files\UnH Solutions
2009-04-13 16:14:10 ----SH---- D:\WINDOWS\system32\bthwjeme.ini
2009-04-12 19:36:19 ----SH---- D:\WINDOWS\system32\gijkoxgd.ini
2009-04-12 09:09:36 ----SH---- D:\WINDOWS\system32\mjpddnow.ini
2009-04-11 19:34:44 ----SH---- D:\WINDOWS\system32\hqpynqfn.ini
2009-04-11 16:40:11 ----D---- D:\Program Files\KP Software
2009-04-11 16:25:17 ----D---- D:\Program Files\TechSmith
2009-04-11 15:52:50 ----D---- D:\Program Files\CCleaner
2009-04-11 07:35:12 ----SH---- D:\WINDOWS\system32\aevagwtk.ini
2009-04-10 19:38:18 ----SH---- D:\WINDOWS\system32\usleuyeq.ini
2009-04-10 07:35:17 ----SH---- D:\WINDOWS\system32\dpyprvdu.ini
2009-04-09 19:33:58 ----SH---- D:\WINDOWS\system32\yskeccll.ini
2009-04-09 07:34:03 ----SH---- D:\WINDOWS\system32\bhdsdrsu.ini
2009-04-08 19:30:58 ----SH---- D:\WINDOWS\system32\bgtokhjn.ini
2009-04-08 07:34:03 ----SH---- D:\WINDOWS\system32\bcyihljq.ini
2009-04-07 11:15:16 ----A---- D:\WINDOWS\system32\oydcki.dll
2009-04-07 11:15:00 ----A---- D:\WINDOWS\system32\ljhqpoop.dll
2009-04-07 11:12:09 ----SH---- D:\WINDOWS\system32\hpvuerdc.ini
2009-04-06 20:02:38 ----SH---- D:\WINDOWS\system32\nhpbakvy.ini
2009-04-06 16:19:40 ----D---- D:\Documents and Settings\KIMI\Application Data\skypePM
2009-04-06 16:19:01 ----D---- D:\Documents and Settings\KIMI\Application Data\Skype
2009-04-06 16:18:21 ----D---- D:\Program Files\Skype
2009-04-06 16:18:20 ----D---- D:\Program Files\Fichiers communs\Skype
2009-04-06 16:17:47 ----D---- D:\Documents and Settings\All Users\Application Data\Skype
2009-04-06 08:03:24 ----SH---- D:\WINDOWS\system32\anqntdrb.ini
2009-04-05 20:02:43 ----SH---- D:\WINDOWS\system32\jyoubmst.ini
2009-04-05 08:02:51 ----SH---- D:\WINDOWS\system32\ojetkhso.ini
2009-04-04 20:02:43 ----SH---- D:\WINDOWS\system32\rislonph.ini
2009-04-04 08:06:01 ----SH---- D:\WINDOWS\system32\qxudfbss.ini
2009-04-03 20:02:53 ----SH---- D:\WINDOWS\system32\xbbakdxl.ini
2009-04-03 08:06:07 ----SH---- D:\WINDOWS\system32\wcpyxfru.ini
2009-04-02 08:33:57 ----SH---- D:\WINDOWS\system32\ewotpgxk.ini
2009-04-01 20:31:50 ----SH---- D:\WINDOWS\system32\ejbskpry.ini
2009-04-01 08:31:58 ----SH---- D:\WINDOWS\system32\iavtohhf.ini
2009-03-31 13:00:40 ----SH---- D:\WINDOWS\system32\fwswmpla.ini
2009-03-31 01:00:29 ----SH---- D:\WINDOWS\system32\mcmupqax.ini
2009-03-30 13:00:40 ----SH---- D:\WINDOWS\system32\ynmdslxp.ini
2009-03-29 16:26:37 ----SH---- D:\WINDOWS\system32\xceyihmw.ini
2009-03-29 04:26:34 ----SH---- D:\WINDOWS\system32\uabrtokf.ini
2009-03-28 19:25:41 ----D---- D:\Documents and Settings\KIMI\Application Data\Real
2009-03-28 16:26:41 ----SH---- D:\WINDOWS\system32\auraqlgn.ini
2009-03-28 04:26:35 ----SH---- D:\WINDOWS\system32\umaekiqv.ini
2009-03-27 16:26:39 ----SH---- D:\WINDOWS\system32\pkfnfnev.ini
2009-03-27 03:17:33 ----SH---- D:\WINDOWS\system32\grjmaqfq.ini
2009-03-26 15:17:39 ----SH---- D:\WINDOWS\system32\vqjsbovx.ini
2009-03-25 18:07:51 ----SH---- D:\WINDOWS\system32\ntfjsoks.ini
2009-03-24 13:00:20 ----SH---- D:\WINDOWS\system32\tjftubkk.ini
2009-03-23 20:42:42 ----SH---- D:\WINDOWS\system32\ypsfpmci.ini
2009-03-23 08:39:36 ----SH---- D:\WINDOWS\system32\wwsixjmh.ini
2009-03-22 20:42:36 ----A---- D:\WINDOWS\system32\xheabuxb.dll
2009-03-22 20:42:36 ----A---- D:\WINDOWS\system32\jhmchm.dll
2009-03-22 20:39:42 ----SH---- D:\WINDOWS\system32\lwpuojuu.ini
2009-03-22 08:42:45 ----A---- D:\WINDOWS\system32\xtjpbu.dll
2009-03-22 08:42:37 ----A---- D:\WINDOWS\system32\ygqllvur.dll
2009-03-22 08:39:36 ----SH---- D:\WINDOWS\system32\ghdsoycb.ini
2009-03-21 20:42:41 ----SH---- D:\WINDOWS\system32\oinlmylo.ini
2009-03-21 08:39:42 ----SH---- D:\WINDOWS\system32\yuyuxxpc.ini
2009-03-20 14:34:31 ----SH---- D:\WINDOWS\system32\oxtfxtoe.ini
2009-03-19 13:00:13 ----SH---- D:\WINDOWS\system32\mqehhdbj.ini
2009-03-19 00:27:50 ----SH---- D:\WINDOWS\system32\aqberdfp.ini
2009-03-17 12:25:43 ----SH---- D:\WINDOWS\system32\dlillmrb.ini
2009-03-16 21:45:57 ----SH---- D:\WINDOWS\system32\fhbrmaya.ini
2009-03-16 09:48:59 ----SH---- D:\WINDOWS\system32\adednbas.ini
2009-03-15 13:18:22 ----SH---- D:\WINDOWS\system32\bvhvjlse.ini
2009-03-15 00:14:33 ----SH---- D:\WINDOWS\system32\yudemyro.ini
2009-03-14 12:17:43 ----SH---- D:\WINDOWS\system32\awnadtrf.ini
2009-03-14 00:15:08 ----SH---- D:\WINDOWS\system32\nydavynm.ini
2009-03-13 12:14:38 ----SH---- D:\WINDOWS\system32\kdcohgnx.ini
2009-03-13 00:14:32 ----SH---- D:\WINDOWS\system32\jecboyte.ini
2009-03-12 12:14:47 ----SH---- D:\WINDOWS\system32\sagrpgwc.ini
2009-03-12 00:14:31 ----SH---- D:\WINDOWS\system32\tunnxqaj.ini
2009-03-11 12:17:44 ----SH---- D:\WINDOWS\system32\ddgjnchy.ini

======List of files/folders modified in the last 2 months======

2009-05-10 22:11:10 ----D---- D:\WINDOWS\Temp
2009-05-10 22:10:01 ----D---- D:\Program Files\Mozilla Firefox
2009-05-10 22:09:43 ----SHD---- D:\System Volume Information
2009-05-10 22:09:43 ----D---- D:\WINDOWS\system32\Restore
2009-05-10 22:09:30 ----D---- D:\WINDOWS
2009-05-10 22:09:15 ----D---- D:\Documents and Settings\KIMI\Application Data\DMCache
2009-05-10 22:08:56 ----D---- D:\WINDOWS\system32\drivers
2009-05-10 22:08:56 ----D---- D:\WINDOWS\system32
2009-05-10 22:08:16 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-05-10 22:06:51 ----RD---- D:\Program Files
2009-05-10 22:00:45 ----D---- D:\WINDOWS\Prefetch
2009-05-10 16:41:02 ----D---- D:\WINDOWS\system32\CatRoot2
2009-05-06 21:02:00 ----SD---- D:\Documents and Settings\KIMI\Application Data\Microsoft
2009-05-01 23:26:14 ----SHD---- D:\WINDOWS\Installer
2009-05-01 22:33:05 ----D---- D:\Program Files\Faronics
2009-04-29 09:12:52 ----D---- D:\WINDOWS\Help
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs
2009-04-27 19:05:52 ----D---- D:\Program Files\Fichiers communs\Real
2009-04-27 19:05:46 ----A---- D:\WINDOWS\system32\rmoc3260.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5032.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5016.dll
2009-04-27 19:05:24 ----A---- D:\WINDOWS\system32\pncrt.dll
2009-04-27 19:00:27 ----SD---- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-23 19:45:38 ----D---- D:\WINDOWS\system32\ReinstallBackups
2009-04-23 19:45:36 ----HD---- D:\WINDOWS\inf
2009-04-23 19:45:29 ----RSHDC---- D:\WINDOWS\system32\dllcache
2009-04-23 19:43:32 ----D---- D:\Program Files\Fichiers communs\Logitech
2009-04-23 19:43:28 ----D---- D:\WINDOWS\WinSxS
2009-04-23 19:43:27 ----D---- D:\Program Files\Logitech
2009-04-14 12:15:42 ----A---- D:\WINDOWS\win.ini
2009-04-14 12:15:42 ----A---- D:\WINDOWS\system.ini
2009-04-14 12:15:41 ----D---- D:\WINDOWS\pss
2009-04-14 12:12:44 ----ASH---- D:\WINDOWS\system32\EMSAdMoq.ini
2009-04-14 12:12:16 ----ASH---- D:\WINDOWS\system32\EMSAdMoq.ini2
2009-04-14 04:14:08 ----A---- D:\WINDOWS\system32\0f05b679-.txt
2009-04-11 15:53:58 ----D---- D:\WINDOWS\Debug
2009-03-15 20:53:12 ----D---- D:\Program Files\Internet Download Manager

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 KLIF;Kaspersky Lab Driver; D:\WINDOWS\system32\DRIVERS\klif.sys [2009-04-14 226832]
R2 LF30FS;LF30FS; \??\D:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; D:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; D:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Pilote de classe HID Microsoft; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; D:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-08-24 1052732]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; D:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; D:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 mouhid;Pilote HID de souris; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-09-07 12288]
R3 usbccgp;Pilote parent générique USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; D:\WINDOWS\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmFilter;Logitech Gaming HID Filter Driver; D:\WINDOWS\system32\drivers\WmFilter.sys [2008-01-24 28168]
R3 WmHidLo;Logitech Gaming USB Filter Driver; D:\WINDOWS\system32\drivers\WmHidLo.sys [2008-01-24 29192]
R3 WmVirHid;Logitech Virtual Hid Device Driver; D:\WINDOWS\system32\drivers\WmVirHid.sys [2008-01-24 14728]
R3 WmXlCore;Logitech Translation Layer Driver; D:\WINDOWS\system32\drivers\WmXlCore.sys [2008-01-24 48904]
S3 afoptjdv;afoptjdv; D:\WINDOWS\system32\drivers\afoptjdv.sys []
S3 CCDECODE;Décodeur sous-titre fermé; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 LVUSBSta;Logitech USB Monitor Filter; D:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Pilote du Moniteur réseau; D:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 NPF;NetGroup Packet Filter Driver; D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 QCMerced;Logitech QuickCam Communicate; D:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 SLIP;Détrameur décalage BDA; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;Pilote USB audio (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBSTOR;Pilote de stockage de masse USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;Codec Teletext standard; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Kaspersky Internet Security; D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
R2 DF5Serv;DF5Serv; D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe [2007-10-25 430080]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); D:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; D:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

-----------------EOF-----------------

Bien ...


dans l'ordre :


1- Télécharge cet outil de SiRi sur ton bureau :

http://siri.urz.free.fr/Softs/RHosts.exe
ou http://siri.urz.free.fr/RHosts.php


Double-cliquer dessus pour le lancer .

-> cliquer sur " Restore original Hosts " et attendre un court instant ...

( ps : c'est normal que rien ne se passe ... )


====================

2- Supprime tout ce qui se trouve dans la quarantaine de Malwarebytes .

====================

3- refais un coup de CCleaner ( registre compris ) .

====================

4- Télécharge ComboFix (par sUBs) sur ton Bureau (et pas ailleurs !):

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


--------------------------------- [ ! ATTENTION ! ] ------------------------------------------
!! Déconnecte toi,ferme tes applications en cours ( ainsi que ton navigateur ) et DESACTIVE TOUTES TES DEFENSES (anti-virus, guarde anti spy-ware, pare-feu) le temps de la manipe :
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Note : pour XP, bien installer la Console de Récupération de Windows comme il est indiqué dans le tuto ci-dessus ...
--------------------------------------------------------------------------------------------


Ensuite :
double-clique sur l'icône "combofix.exe" pour lancer l'outil .

Appuie sur la touche Y (Yes) pour démarrer le scan .

Notes importantes :
-> n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi .
-> Il se peut que le PC redémarre de lui même ( pour finaliser le nettoyage ) , laisse le faire .
-> Si l'outil t'anonce ceci : "combofix a détecté la présence de rootkit et a besoin de faire redémarer votre machine", tu acceptes ...
-> si un message d'erreur windows apparait à un momment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

Le rapport sera crée ici : C:\Combofix.txt

Réactive bien tes défenses .


Poste le rapport Combofix accompagné d'un nouveau rapport RSIT pour analyse ...




"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Rapport rsit:
Logfile of random's system information tool 1.06 (written by random/random)
Run by KIMI at 2009-05-10 22:52:16
Microsoft Windows XP Professionnel Service Pack 2
System drive D: has 954 MB (9%) free of 10 GB
Total RAM: 1270 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:52:18, on 10/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Logitech\Gaming Software\LWEMon.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\_$Df\FrzState2k.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\KIMI\Bureau\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\KIMI.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] D:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &NeoTrace It! - D:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1C12C-295B-4ED4-93C7-92DEFB761E72}: NameServer = 208.67.222.222 193.55.10.102
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DF5Serv - Faronics Corporation - D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
End of file - 4594 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2008-01-08 95664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
HelperObject Class - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll [2004-10-01 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-27 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll [2004-10-01 131072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
"Start WingMan Profiler"=D:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 88584]
"TkBellExe"=D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-27 185872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04267207]
D:\WINDOWS\system32\pjviiqml.dll,b []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
D:\WINDOWS\system32\hkcmd.exe [2005-08-24 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
D:\WINDOWS\system32\igfxpers.exe [2005-08-24 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
D:\WINDOWS\system32\igfxtray.exe [2005-08-24 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
D:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
D:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
D:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
D:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
D:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2006-11-26 97357]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SnagIt 7.lnk]
D:\PROGRA~1\TECHSM~1\SNAGIT~1\SnagIt32.exe [2004-10-01 2637824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
D:\WINDOWS\system32\igfxdev.dll [2005-08-24 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
D:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoWinKeys"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoLogOff"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 2 months======

2009-05-10 22:49:45 ----D---- D:\WINDOWS\temp
2009-05-10 22:49:43 ----A---- D:\ComboFix.txt
2009-05-10 22:42:19 ----A---- D:\WINDOWS\zip.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\vFind.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\SWXCACLS.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\SWSC.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\SWREG.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\sed.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\NIRCMD.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\grep.exe
2009-05-10 22:42:14 ----D---- D:\WINDOWS\ERDNT
2009-05-10 22:42:11 ----D---- D:\Qoobox
2009-05-10 22:00:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Malwarebytes
2009-05-10 22:00:39 ----D---- D:\Program Files\Malwarebytes' Anti-Malware
2009-05-10 22:00:39 ----D---- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-05-10 20:55:13 ----RASHD---- D:\autorun.inf
2009-05-10 20:52:31 ----A---- D:\UsbFix.txt
2009-05-10 20:17:14 ----D---- D:\UsbFix
2009-05-10 20:01:55 ----D---- D:\rsit
2009-05-10 19:58:24 ----D---- D:\Program Files\Trend Micro
2009-05-10 16:41:31 ----D---- D:\Program Files\DAEMON Tools Lite
2009-05-10 16:39:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DAEMON Tools
2009-05-10 12:13:26 ----A---- D:\WINDOWS\UnSetup.exe
2009-05-10 12:13:26 ----A---- D:\WINDOWS\FraUinst.exe
2009-05-10 12:13:07 ----D---- D:\WINDOWS\Lhsp
2009-05-05 20:18:27 ----D---- D:\Documents and Settings\KIMI\Application Data\Help
2009-05-03 16:16:05 ----D---- D:\Program Files\uTorrent
2009-05-03 16:16:03 ----D---- D:\Documents and Settings\KIMI\Application Data\uTorrent
2009-05-03 10:17:01 ----D---- D:\Documents and Settings\KIMI\Application Data\dvdcss
2009-05-02 12:45:59 ----D---- D:\Program Files\VDOWNLOADER
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs\xing shared
2009-04-27 19:05:08 ----D---- D:\Program Files\Real
2009-04-26 18:07:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Wireshark
2009-04-26 18:04:15 ----D---- D:\Program Files\WinPcap
2009-04-26 18:03:26 ----D---- D:\Program Files\Wireshark
2009-04-26 17:56:30 ----D---- D:\Program Files\NeoTrace Express
2009-04-22 16:56:30 ----D---- D:\Program Files\PhotoFiltre
2009-04-14 10:44:23 ----D---- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-13 16:25:52 ----D---- D:\Program Files\UnH Solutions
2009-04-11 16:40:11 ----D---- D:\Program Files\KP Software
2009-04-11 16:25:17 ----D---- D:\Program Files\TechSmith
2009-04-11 15:52:50 ----D---- D:\Program Files\CCleaner
2009-04-06 16:19:40 ----D---- D:\Documents and Settings\KIMI\Application Data\skypePM
2009-04-06 16:19:01 ----D---- D:\Documents and Settings\KIMI\Application Data\Skype
2009-04-06 16:18:21 ----D---- D:\Program Files\Skype
2009-04-06 16:18:20 ----D---- D:\Program Files\Fichiers communs\Skype
2009-04-06 16:17:47 ----D---- D:\Documents and Settings\All Users\Application Data\Skype
2009-03-28 19:25:41 ----D---- D:\Documents and Settings\KIMI\Application Data\Real

======List of files/folders modified in the last 2 months======

2009-05-10 22:49:57 ----D---- D:\Program Files\Mozilla Firefox
2009-05-10 22:49:46 ----D---- D:\WINDOWS\system32\drivers
2009-05-10 22:49:46 ----D---- D:\WINDOWS\system32
2009-05-10 22:49:45 ----D---- D:\WINDOWS
2009-05-10 22:48:37 ----D---- D:\WINDOWS\system32\CatRoot2
2009-05-10 22:48:00 ----D---- D:\Documents and Settings\KIMI\Application Data\DMCache
2009-05-10 22:48:00 ----A---- D:\WINDOWS\system.ini
2009-05-10 22:46:04 ----D---- D:\WINDOWS\system32\config
2009-05-10 22:44:47 ----D---- D:\WINDOWS\AppPatch
2009-05-10 22:44:44 ----D---- D:\Program Files\Fichiers communs
2009-05-10 22:42:36 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-05-10 22:42:04 ----D---- D:\WINDOWS\Prefetch
2009-05-10 22:09:43 ----SHD---- D:\System Volume Information
2009-05-10 22:09:43 ----D---- D:\WINDOWS\system32\Restore
2009-05-10 22:06:51 ----RD---- D:\Program Files
2009-05-06 21:02:00 ----SD---- D:\Documents and Settings\KIMI\Application Data\Microsoft
2009-05-01 23:26:14 ----SHD---- D:\WINDOWS\Installer
2009-05-01 22:33:05 ----D---- D:\Program Files\Faronics
2009-04-29 09:12:52 ----D---- D:\WINDOWS\Help
2009-04-27 19:05:52 ----D---- D:\Program Files\Fichiers communs\Real
2009-04-27 19:05:46 ----A---- D:\WINDOWS\system32\rmoc3260.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5032.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5016.dll
2009-04-27 19:05:24 ----A---- D:\WINDOWS\system32\pncrt.dll
2009-04-27 19:00:27 ----SD---- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-23 19:45:38 ----D---- D:\WINDOWS\system32\ReinstallBackups
2009-04-23 19:45:36 ----HD---- D:\WINDOWS\inf
2009-04-23 19:45:29 ----RSHDC---- D:\WINDOWS\system32\dllcache
2009-04-23 19:43:32 ----D---- D:\Program Files\Fichiers communs\Logitech
2009-04-23 19:43:28 ----D---- D:\WINDOWS\WinSxS
2009-04-23 19:43:27 ----D---- D:\Program Files\Logitech
2009-04-14 12:15:42 ----A---- D:\WINDOWS\win.ini
2009-04-14 12:15:41 ----D---- D:\WINDOWS\pss
2009-04-14 04:14:08 ----A---- D:\WINDOWS\system32\0f05b679-.txt
2009-04-11 15:53:58 ----D---- D:\WINDOWS\Debug
2009-03-15 20:53:12 ----D---- D:\Program Files\Internet Download Manager

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 KLIF;Kaspersky Lab Driver; D:\WINDOWS\system32\DRIVERS\klif.sys [2009-04-14 226832]
R2 LF30FS;LF30FS; \??\D:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; D:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; D:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Pilote de classe HID Microsoft; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; D:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-08-24 1052732]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; D:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; D:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 mouhid;Pilote HID de souris; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-09-07 12288]
R3 usbccgp;Pilote parent générique USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; D:\WINDOWS\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmFilter;Logitech Gaming HID Filter Driver; D:\WINDOWS\system32\drivers\WmFilter.sys [2008-01-24 28168]
R3 WmHidLo;Logitech Gaming USB Filter Driver; D:\WINDOWS\system32\drivers\WmHidLo.sys [2008-01-24 29192]
R3 WmVirHid;Logitech Virtual Hid Device Driver; D:\WINDOWS\system32\drivers\WmVirHid.sys [2008-01-24 14728]
R3 WmXlCore;Logitech Translation Layer Driver; D:\WINDOWS\system32\drivers\WmXlCore.sys [2008-01-24 48904]
R4 catchme;catchme; \??\D:\DOCUME~1\KIMI\LOCALS~1\Temp\catchme.sys []
S3 ansghy9d;ansghy9d; D:\WINDOWS\system32\drivers\ansghy9d.sys []
S3 CCDECODE;Décodeur sous-titre fermé; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 LVUSBSta;Logitech USB Monitor Filter; D:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Pilote du Moniteur réseau; D:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 NPF;NetGroup Packet Filter Driver; D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 QCMerced;Logitech QuickCam Communicate; D:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 SLIP;Détrameur décalage BDA; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;Pilote USB audio (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBSTOR;Pilote de stockage de masse USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;Codec Teletext standard; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 DF5Serv;DF5Serv; D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe [2007-10-25 430080]
S2 AVP;Kaspersky Internet Security; D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); D:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; D:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

-----------------EOF-----------------

Tu es la

Avant de continuer ,

peux-tu essayer de m'analyser ceci sur VirusTotal :

D:\Persi0.sys

et

D:\windows\bootstet.dat


Poste moi les rapports obtenus et attends la suite ....



===================
Poste donc ces rapports et je regarderai cela demain ...

Bonne nuit ;)




"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Salut,


la suite :


1-Créer un doc texte sur ton bureau :
pointe ta souris sur ton bureau , clique droit : va dans "nouveau" et choisis "document texte" .

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer :


Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe]
"Debugger"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\04267207]

File::
D:\Persi0.sys
D:\WINDOWS\system32\0f05b679-.txt
D:\WINDOWS\system32\0f05b679.txt


Puis va dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valide ...


2-Nettoyage :

!! Déconnecte toi, ferme toutes tes applications et désactive TOUTES TES DEFENSES ( tu les réactiveras après ) !!

--->Sur ton bureau, fais glisser avec ta souris le fichier CFScript sur l'icône de ComboFix.exe .

(Regarde ici : http://img.photobucket.com/albums/v666/sUBs/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.

Puis patiente le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

!! Ne touches à rien tant que le scan n'est pas terminé !!

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : poste le accompagné d' un nouveau rapport RSIT pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )


"Baby, I'm going on an airplane, And I don't know if I'll be back again"
IMPORTANT : ne vous croyez pas tiré d'affaire tant qu'on ne 
vous l'a pas dit !

Rapport rsit:
Logfile of random's system information tool 1.06 (written by random/random)
Run by KIMI at 2009-05-11 07:26:23
Microsoft Windows XP Professionnel Service Pack 2
System drive D: has 825 MB (8%) free of 10 GB
Total RAM: 1270 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:26:24, on 11/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Logitech\Gaming Software\LWEMon.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
D:\Program Files\Faronics\Deep Freeze\Install D-0\_$Df\FrzState2k.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\KIMI\Bureau\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\KIMI.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] D:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &NeoTrace It! - D:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1C12C-295B-4ED4-93C7-92DEFB761E72}: NameServer = 208.67.222.222 193.55.10.102
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DF5Serv - Faronics Corporation - D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
End of file - 5119 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - D:\Program Files\Internet Download Manager\IDMIECC.dll [2008-01-08 95664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
HelperObject Class - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll [2004-10-01 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-27 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-10 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll [2004-10-01 131072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
"Start WingMan Profiler"=D:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 88584]
"TkBellExe"=D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-27 185872]
"SunJavaUpdateSched"=D:\Program Files\Java\jre6\bin\jusched.exe [2009-05-10 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IDMan"=D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
D:\Program Files\Internet Download Manager\IDMan.exe [2007-12-21 2573744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
D:\WINDOWS\system32\hkcmd.exe [2005-08-24 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
D:\WINDOWS\system32\igfxpers.exe [2005-08-24 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
D:\WINDOWS\system32\igfxtray.exe [2005-08-24 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
D:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
D:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
D:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
D:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
D:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2006-11-26 97357]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SnagIt 7.lnk]
D:\PROGRA~1\TECHSM~1\SNAGIT~1\SnagIt32.exe [2004-10-01 2637824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
D:\WINDOWS\system32\igfxdev.dll [2005-08-24 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
D:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoWinKeys"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoLogOff"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\MSN Messenger\msnmsgr.exe"="D:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Program Files\MSN Messenger\livecall.exe"="D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 2 months======

2009-05-11 07:23:49 ----A---- D:\ComboFix.txt
2009-05-11 07:20:50 ----D---- D:\ComboFix
2009-05-10 23:21:01 ----A---- D:\WINDOWS\system32\javaws.exe
2009-05-10 23:21:01 ----A---- D:\WINDOWS\system32\javaw.exe
2009-05-10 23:21:01 ----A---- D:\WINDOWS\system32\java.exe
2009-05-10 23:21:01 ----A---- D:\WINDOWS\system32\deploytk.dll
2009-05-10 23:20:38 ----D---- D:\Program Files\Java
2009-05-10 23:06:13 ----D---- D:\Documents and Settings\KIMI\Application Data\Sun
2009-05-10 22:49:45 ----D---- D:\WINDOWS\temp
2009-05-10 22:42:19 ----A---- D:\WINDOWS\zip.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\vFind.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\SWXCACLS.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\SWSC.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\SWREG.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\sed.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\NIRCMD.exe
2009-05-10 22:42:19 ----A---- D:\WINDOWS\grep.exe
2009-05-10 22:42:14 ----D---- D:\WINDOWS\ERDNT
2009-05-10 22:42:11 ----D---- D:\Qoobox
2009-05-10 22:00:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Malwarebytes
2009-05-10 22:00:39 ----D---- D:\Program Files\Malwarebytes' Anti-Malware
2009-05-10 22:00:39 ----D---- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-05-10 20:55:13 ----RASHD---- D:\autorun.inf
2009-05-10 20:52:31 ----A---- D:\UsbFix.txt
2009-05-10 20:17:14 ----D---- D:\UsbFix
2009-05-10 20:01:55 ----D---- D:\rsit
2009-05-10 19:58:24 ----D---- D:\Program Files\Trend Micro
2009-05-10 16:41:31 ----D---- D:\Program Files\DAEMON Tools Lite
2009-05-10 16:39:05 ----D---- D:\Documents and Settings\KIMI\Application Data\DAEMON Tools
2009-05-10 12:13:26 ----A---- D:\WINDOWS\UnSetup.exe
2009-05-10 12:13:26 ----A---- D:\WINDOWS\FraUinst.exe
2009-05-10 12:13:07 ----D---- D:\WINDOWS\Lhsp
2009-05-05 20:18:27 ----D---- D:\Documents and Settings\KIMI\Application Data\Help
2009-05-03 16:16:05 ----D---- D:\Program Files\uTorrent
2009-05-03 16:16:03 ----D---- D:\Documents and Settings\KIMI\Application Data\uTorrent
2009-05-03 10:17:01 ----D---- D:\Documents and Settings\KIMI\Application Data\dvdcss
2009-05-02 12:45:59 ----D---- D:\Program Files\VDOWNLOADER
2009-04-27 19:05:58 ----D---- D:\Program Files\Fichiers communs\xing shared
2009-04-27 19:05:08 ----D---- D:\Program Files\Real
2009-04-26 18:07:45 ----D---- D:\Documents and Settings\KIMI\Application Data\Wireshark
2009-04-26 18:04:15 ----D---- D:\Program Files\WinPcap
2009-04-26 18:03:26 ----D---- D:\Program Files\Wireshark
2009-04-26 17:56:30 ----D---- D:\Program Files\NeoTrace Express
2009-04-22 16:56:30 ----D---- D:\Program Files\PhotoFiltre
2009-04-14 10:44:23 ----D---- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-13 16:25:52 ----D---- D:\Program Files\UnH Solutions
2009-04-11 16:40:11 ----D---- D:\Program Files\KP Software
2009-04-11 16:25:17 ----D---- D:\Program Files\TechSmith
2009-04-11 15:52:50 ----D---- D:\Program Files\CCleaner
2009-04-06 16:19:40 ----D---- D:\Documents and Settings\KIMI\Application Data\skypePM
2009-04-06 16:19:01 ----D---- D:\Documents and Settings\KIMI\Application Data\Skype
2009-04-06 16:18:21 ----D---- D:\Program Files\Skype
2009-04-06 16:18:20 ----D---- D:\Program Files\Fichiers communs\Skype
2009-04-06 16:17:47 ----D---- D:\Documents and Settings\All Users\Application Data\Skype
2009-03-28 19:25:41 ----D---- D:\Documents and Settings\KIMI\Application Data\Real

======List of files/folders modified in the last 2 months======

2009-05-11 07:24:53 ----D---- D:\Program Files\Mozilla Firefox
2009-05-11 07:24:08 ----D---- D:\WINDOWS\Prefetch
2009-05-11 07:23:52 ----D---- D:\WINDOWS\system32
2009-05-11 07:23:50 ----D---- D:\WINDOWS
2009-05-11 07:22:46 ----D---- D:\Documents and Settings\KIMI\Application Data\DMCache
2009-05-11 07:22:42 ----A---- D:\WINDOWS\system.ini
2009-05-11 07:22:08 ----D---- D:\WINDOWS\system32\drivers
2009-05-11 07:22:08 ----D---- D:\WINDOWS\AppPatch
2009-05-11 07:22:05 ----D---- D:\Program Files\Fichiers communs
2009-05-11 07:21:16 ----D---- D:\WINDOWS\system32\CatRoot2
2009-05-11 07:21:06 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-05-10 23:21:29 ----SHD---- D:\WINDOWS\Installer
2009-05-10 23:20:38 ----RD---- D:\Program Files
2009-05-10 22:46:04 ----D---- D:\WINDOWS\system32\config
2009-05-10 22:09:43 ----SHD---- D:\System Volume Information
2009-05-10 22:09:43 ----D---- D:\WINDOWS\system32\Restore
2009-05-06 21:02:00 ----SD---- D:\Documents and Settings\KIMI\Application Data\Microsoft
2009-05-01 22:33:05 ----D---- D:\Program Files\Faronics
2009-04-29 09:12:52 ----D---- D:\WINDOWS\Help
2009-04-27 19:05:52 ----D---- D:\Program Files\Fichiers communs\Real
2009-04-27 19:05:46 ----A---- D:\WINDOWS\system32\rmoc3260.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5032.dll
2009-04-27 19:05:26 ----A---- D:\WINDOWS\system32\pndx5016.dll
2009-04-27 19:05:24 ----A---- D:\WINDOWS\system32\pncrt.dll
2009-04-27 19:00:27 ----SD---- D:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-23 19:45:38 ----D---- D:\WINDOWS\system32\ReinstallBackups
2009-04-23 19:45:36 ----HD---- D:\WINDOWS\inf
2009-04-23 19:45:29 ----RSHDC---- D:\WINDOWS\system32\dllcache
2009-04-23 19:43:32 ----D---- D:\Program Files\Fichiers communs\Logitech
2009-04-23 19:43:28 ----D---- D:\WINDOWS\WinSxS
2009-04-23 19:43:27 ----D---- D:\Program Files\Logitech
2009-04-14 12:15:42 ----A---- D:\WINDOWS\win.ini
2009-04-14 12:15:41 ----D---- D:\WINDOWS\pss
2009-04-11 15:53:58 ----D---- D:\WINDOWS\Debug
2009-03-15 20:53:12 ----D---- D:\Program Files\Internet Download Manager

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Pilote HID de clavier; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 KLIF;Kaspersky Lab Driver; D:\WINDOWS\system32\DRIVERS\klif.sys [2009-04-14 226832]
R2 LF30FS;LF30FS; \??\D:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; D:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; D:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Pilote de classe HID Microsoft; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; D:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-08-24 1052732]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; D:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; D:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 mouhid;Pilote HID de souris; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2002-09-07 12288]
R3 usbccgp;Pilote parent générique USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; D:\WINDOWS\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmFilter;Logitech Gaming HID Filter Driver; D:\WINDOWS\system32\drivers\WmFilter.sys [2008-01-24 28168]
R3 WmHidLo;Logitech Gaming USB Filter Driver; D:\WINDOWS\system32\drivers\WmHidLo.sys [2008-01-24 29192]
R3 WmVirHid;Logitech Virtual Hid Device Driver; D:\WINDOWS\system32\drivers\WmVirHid.sys [2008-01-24 14728]
R3 WmXlCore;Logitech Translation Layer Driver; D:\WINDOWS\system32\drivers\WmXlCore.sys [2008-01-24 48904]
R4 catchme;catchme; \??\D:\DOCUME~1\KIMI\LOCALS~1\Temp\catchme.sys []
S3 ansghy9d;ansghy9d; D:\WINDOWS\system32\drivers\ansghy9d.sys []
S3 CCDECODE;Décodeur sous-titre fermé; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 LVUSBSta;Logitech USB Monitor Filter; D:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Pilote du Moniteur réseau; D:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 NPF;NetGroup Packet Filter Driver; D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 QCMerced;Logitech QuickCam Communicate; D:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 SLIP;Détrameur décalage BDA; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;Pilote USB audio (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBSTOR;Pilote de stockage de masse USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;Codec Teletext standard; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 DF5Serv;DF5Serv; D:\Program Files\Faronics\Deep Freeze\Install D-0\DF5Serv.exe [2007-10-25 430080]
R2 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2009-05-10 152984]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; D:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S2 AVP;Kaspersky Internet Security; D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-04-14 206088]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); D:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]

-----------------EOF-----------------