Désinstaller ZoneAlarm [Résolu]

Bsr
soit tu as chopé un virus ,trojan ou rootkit qui bloque l'utilisation de certains logiciels
où ton zonealarm date d'il y a quelque temps, je me rappelle qu'une mise à jour avait bloqué mon pc (+- 2 ans)


as tu un antivirus et antispyware? réagissent 'ils encore?

Bonjour et merci de ta réponse rapide!
En fait tout marche, antivirus, antispy, etc!
Mais tout à l'heure, j'ai fait une analyse avec malware byte, et je suis tombé sur ceci:

http://nsa07.casimages.com/img/2009/07/17/090717125701555067.jpg

Est-ce que ça a un rapport? Je n'ai rien fait avec ces deux alertes, car je ne sais vraiment pas ce que c'est!
Merci beaucoup de ton aide!

tu as avast comme antivirus...non?
mbam a découvert que quelquechose a désactivé ton parefeu et ton antivirus
en tous cas tu peux faire confiance à mbam supprime ce qu'il trouve

mets à jour ton AV et ASW et fait des scans, post les rapports

utilise combofix
http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
sans installer la console de récupération

Non, j'utilise Avira.
Je vais donc faire ça alors et utiliser le logiciel que tu m'as donné. Je te tiens au courant.
Merci de ton aide!

Bonjour AnthoineR,
Pas de souci, suis aussi ce topic si jamais Redbart a la réponse.

Redbart, l'antivirus ne fonctionne plus aujourd'hui :x Avec Avira ça met: Guard: Arrêté...
:s

Malware Byte marche, et je télécharge ton logiciel.

Voici le rapport de scan de Combofix:

ComboFix 09-07-14.08 - Total 17/07/2009 13:16.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.32.1036.18.1022.620 [GMT 2:00]
Running from: c:\documents and settings\Total\Mes documents\Mes fichiers reçus\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1915241607-2632762473-526908049-1003
c:\recycler\S-1-5-21-823518204-1958367476-725345543-1003
c:\recycler\S-1-5-21-87015899-124256012-3399165187-500
c:\windows\Installer\65eec.msp

.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.

2009-07-16 21:34 . 2009-07-16 21:34 -------- d-----w- c:\windows\system32\wbem\Repository
2009-07-16 21:30 . 2009-07-16 21:48 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-07-16 20:36 . 2009-07-16 21:28 -------- d-----w- c:\program files\Unlocker
2009-07-16 19:50 . 2009-07-16 19:50 -------- d-----w- c:\documents and settings\Administrateur\IETldCache
2009-07-16 19:48 . 2005-08-10 09:15 135 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2009-07-16 19:48 . 2009-07-16 21:29 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft
2009-07-16 19:48 . 2009-07-16 21:28 -------- d-----w- c:\documents and settings\Administrateur\Favoris
2009-07-16 19:48 . 2009-07-16 21:29 -------- d-----w- c:\documents and settings\Administrateur\Modèles
2009-07-16 19:48 . 2009-07-16 21:29 -------- d-s---w- c:\documents and settings\Administrateur
2009-07-16 17:53 . 2009-07-16 17:53 -------- d-----w- c:\windows\l2schemas
2009-07-16 17:50 . 2009-07-16 17:54 -------- d-----w- c:\windows\ServicePackFiles
2009-07-16 17:41 . 2009-07-16 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-07-09 20:38 . 2009-07-09 20:38 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-07-09 20:38 . 2009-07-09 20:38 -------- d-----w- c:\documents and settings\Total\Application Data\skypePM
2009-07-09 20:33 . 2009-07-09 20:33 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-07-09 20:32 . 2009-07-09 20:33 -------- d-----r- c:\program files\Skype
2009-07-07 17:10 . 2009-07-07 17:10 -------- d-sh--w- C:\found.000
2009-07-04 07:48 . 2009-07-04 07:48 -------- d-sh--w- c:\documents and settings\Total\PrivacIE
2009-07-03 13:34 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-03 13:34 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-03 13:34 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-03 13:34 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-03 13:33 . 2009-07-03 13:33 -------- d-----w- c:\program files\Avira
2009-07-03 13:33 . 2009-07-03 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-02 21:10 . 2009-07-02 21:10 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2009-07-02 21:10 . 2009-07-02 21:10 -------- d-----w- c:\documents and settings\Total\Application Data\Intel
2009-07-02 21:10 . 2009-07-02 21:10 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2009-07-02 21:10 . 2009-07-02 21:10 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2009-07-02 21:10 . 2007-02-12 10:41 2732032 ----a-w- c:\windows\system32\Netw2r32.dll
2009-07-02 21:10 . 2007-02-12 10:40 557056 ----a-w- c:\windows\system32\Netw2c32.dll
2009-07-02 21:09 . 2009-07-02 21:09 -------- d-----w- c:\program files\Fichiers communs\Intel
2009-07-02 21:09 . 2009-07-02 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2009-07-02 21:03 . 2009-07-02 21:03 -------- d-----w- c:\windows\Modio
2009-07-02 21:00 . 2009-07-02 21:00 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-02 20:52 . 2009-07-02 20:52 -------- d-sh--w- c:\documents and settings\Total\IETldCache
2009-07-02 20:49 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-07-02 20:49 . 2009-07-02 20:49 -------- d-----w- c:\windows\ie8updates
2009-07-02 20:48 . 2009-04-30 21:16 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-07-02 20:48 . 2009-04-30 21:16 1985024 ------w- c:\windows\system32\dllcache\iertutil.dll
2009-07-02 20:48 . 2009-04-30 21:16 11064832 ------w- c:\windows\system32\dllcache\ieframe.dll
2009-07-02 20:48 . 2009-04-30 21:16 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-02 20:46 . 2009-07-16 17:53 -------- d-----w- c:\windows\system32\fr-FR
2009-07-02 20:46 . 2009-07-02 20:48 -------- dc-h--w- c:\windows\ie8
2009-07-02 19:25 . 2009-06-16 10:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2009-07-02 19:25 . 2009-07-02 19:25 -------- d-----w- C:\Intel
2009-07-02 19:22 . 2009-05-28 15:43 27792 ----a-w- c:\windows\system32\drivers\point32.sys
2009-07-02 19:22 . 2009-07-02 19:22 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-07-02 19:20 . 2009-07-02 19:20 -------- d-----w- c:\program files\MSXML 6.0
2009-07-01 18:20 . 2009-07-01 18:20 -------- d-----w- c:\documents and settings\Total\Local Settings\Application Data\KodakGallery
2009-07-01 18:13 . 2009-07-01 18:13 -------- d-----w- c:\windows\system32\BWKDLogs
2009-07-01 17:56 . 2001-08-23 15:47 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-07-01 17:56 . 2004-08-03 22:54 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-07-01 17:56 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-07-01 17:56 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2009-07-01 17:55 . 2009-07-01 17:55 -------- d-----w- c:\program files\Fichiers communs\Kodak
2009-07-01 17:53 . 2009-07-01 18:14 -------- d-----w- c:\program files\Kodak
2009-07-01 17:52 . 2009-07-01 17:52 77824 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\ess\bindbins\BindBins.exe
2009-07-01 17:52 . 2009-07-01 17:52 229376 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\QUICK\procheck.exe
2009-07-01 17:52 . 2009-07-01 17:52 19666504 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\QUICK\QuickTimeInstaller.exe
2009-07-01 17:52 . 2009-07-01 17:52 69632 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\Ksu\ksustop.exe
2009-07-01 17:51 . 2009-07-01 17:51 1179648 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_140002_14e331d\EasyShrx.Dll
2009-07-01 17:51 . 2007-06-21 22:11 2024840 ----a-r- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_140002_14e331d\Setup.exe
2009-07-01 17:51 . 2009-07-01 18:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
2009-07-01 17:51 . 2009-07-01 17:51 114688 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Registration\KodakCameraAPI_7.4.20.2.dll
2009-06-26 14:06 . 2009-06-26 14:06 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-06-26 13:56 . 2009-06-26 13:56 -------- d-----w- c:\program files\MSXML 4.0
2009-06-25 19:23 . 2008-05-08 12:28 202752 ------w- c:\windows\system32\dllcache\rmcast.sys
2009-06-25 19:20 . 2008-06-14 17:59 272768 ----a-w- c:\windows\system32\drivers\bthport.sys
2009-06-25 19:20 . 2008-06-14 17:59 272768 ------w- c:\windows\system32\dllcache\bthport.sys
2009-06-25 19:06 . 2008-10-24 11:10 453632 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2009-06-25 19:05 . 2008-12-11 11:57 333184 ------w- c:\windows\system32\dllcache\srv.sys
2009-06-25 19:05 . 2008-05-01 14:31 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2009-06-25 19:05 . 2008-04-11 18:51 683520 ------w- c:\windows\system32\dllcache\inetcomm.dll
2009-06-25 19:01 . 2008-12-16 12:49 351232 ------w- c:\windows\system32\dllcache\winhttp.dll
2009-06-25 18:59 . 2008-10-03 10:17 247326 ------w- c:\windows\system32\dllcache\strmdll.dll
2009-06-25 18:59 . 2008-10-15 16:59 332800 ------w- c:\windows\system32\dllcache\netapi32.dll
2009-06-25 18:59 . 2008-09-04 16:45 1106944 ------w- c:\windows\system32\dllcache\msxml3.dll
2009-06-25 18:58 . 2008-04-21 21:27 219136 ------w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 11:11 . 2009-07-17 11:11 37060 ----a-w- c:\windows\Internet Logs\zlclient_2nd_2009_07_17_12_05_59_small.dmp.zip
2009-07-17 10:05 . 2009-07-17 10:05 37425 ----a-w- c:\windows\Internet Logs\zlclient_2nd_2009_07_17_07_53_43_small.dmp.zip
2009-07-17 05:48 . 2009-07-17 05:48 11030461 ----a-w- c:\windows\Internet Logs\GLB4_2nd_2009_07_17_00_08_16_full.dmp.zip
2009-07-16 22:08 . 2009-07-16 22:08 23115 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_07_17_00_03_49_small.dmp.zip
2009-07-16 22:03 . 2009-07-16 22:03 47302 ----a-w- c:\windows\Internet Logs\GLBCA_2nd_2009_07_16_23_50_27_small.dmp.zip
2009-07-16 21:49 . 2009-07-16 21:49 45984 ----a-w- c:\windows\Internet Logs\GLBBF_2nd_2009_07_16_23_42_27_small.dmp.zip
2009-07-16 21:42 . 2009-07-16 21:42 36570 ----a-w- c:\windows\Internet Logs\zlclient_2nd_2009_07_16_23_37_21_small.dmp.zip
2009-07-16 21:38 . 2009-05-04 12:06 39048 ----a-w- c:\documents and settings\Total\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-16 21:37 . 2009-07-16 21:37 23119 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_07_16_23_36_42_small.dmp.zip
2009-07-16 21:36 . 2009-07-16 21:36 34139 ----a-w- c:\windows\Internet Logs\zlclient_2nd_2009_07_16_23_09_44_small.dmp.zip
2009-07-16 21:13 . 2004-08-17 09:31 64016 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-16 21:13 . 2004-08-17 09:31 445584 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-16 17:56 . 2004-08-17 09:30 79463 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-07-16 12:38 . 2009-07-16 12:38 2047067 ----a-w- c:\windows\Internet Logs\tvDebug.zip
2009-07-09 20:44 . 2006-03-21 14:59 -------- d-----w- c:\documents and settings\Total\Application Data\Skype
2009-07-09 20:33 . 2006-03-21 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-07-06 19:32 . 2009-07-06 19:34 1278464 ----a-w- c:\windows\Internet Logs\xDB8.tmp
2009-07-06 19:32 . 2009-07-06 19:34 364544 ----a-w- c:\windows\Internet Logs\xDB7.tmp
2009-07-02 21:09 . 2006-03-21 17:54 -------- d-----w- c:\program files\Intel
2009-07-02 18:34 . 2006-03-21 17:54 -------- d-----w- c:\program files\ATI Technologies
2009-07-02 18:21 . 2009-05-17 12:37 -------- d-----w- c:\program files\ma-config.com
2009-07-02 18:21 . 2009-05-17 12:37 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-07-01 18:18 . 2006-03-21 14:47 -------- d-----w- c:\program files\QuickTime
2009-07-01 18:18 . 2006-03-21 17:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-26 15:46 . 2009-05-04 12:30 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-25 15:28 . 2009-06-25 15:29 477696 ----a-w- c:\windows\Internet Logs\xDB6.tmp
2009-06-16 14:54 . 2004-08-05 08:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:54 . 2004-08-05 08:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:21 . 2009-06-16 14:21 -------- d-----w- c:\program files\Fichiers communs\FotoWire
2009-06-16 14:21 . 2009-06-16 14:21 -------- d-----w- c:\documents and settings\Total\Application Data\FotoWire
2009-06-16 14:21 . 2009-06-16 14:19 -------- d-----w- c:\program files\Logitech
2009-06-16 14:20 . 2009-06-16 14:20 -------- d-----w- c:\program files\Fichiers communs\Logitech
2009-06-16 14:19 . 2006-03-21 17:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-16 14:14 . 2009-05-27 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2009-06-16 14:14 . 2009-05-27 15:18 -------- d-----w- c:\program files\Fichiers communs\LogiShrd
2009-06-12 21:18 . 2009-06-12 21:19 1208832 ----a-w- c:\windows\Internet Logs\xDB5.tmp
2009-06-12 21:18 . 2009-06-12 21:19 29184 ----a-w- c:\windows\Internet Logs\xDB4.tmp
2009-06-12 18:40 . 2009-06-12 18:41 405504 ----a-w- c:\windows\Internet Logs\xDB3.tmp
2009-06-03 19:27 . 2004-08-05 08:00 1296896 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 15:53 . 2009-06-02 14:52 -------- d-----w- c:\program files\PhotoFiltre
2009-05-29 18:25 . 2009-05-29 18:26 990720 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2009-05-28 15:43 . 2009-05-28 15:43 5500 ----a-w- c:\windows\Fonts\SWMacro.otf
2009-05-28 15:37 . 2009-05-28 15:37 127984 ----a-w- c:\windows\Fonts\Swkeys1.ttf
2009-05-27 15:20 . 2009-05-27 15:20 -------- d-----w- c:\documents and settings\Total\Application Data\Leadertech
2009-05-27 15:18 . 2009-05-27 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech
2009-05-25 15:13 . 2009-05-05 11:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-13 05:04 . 2004-08-05 08:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:43 . 2004-08-05 08:00 347136 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 12:49 . 2009-05-04 12:49 0 ----a-w- c:\windows\nsreg.dat
2009-04-29 04:52 . 2004-08-05 08:00 1024000 ----a-w- c:\windows\system32\browseui(2).dll
2009-04-29 04:52 . 2004-08-05 08:00 474624 ----a-w- c:\windows\system32\shlwapi(3).dll
2009-04-19 20:09 . 2004-08-05 08:00 1846784 ----a-w- c:\windows\system32\win32k.sys
2009-06-12 21:26 . 2009-05-17 14:53 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-20 344064]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 36975]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 794624]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-10-18 278528]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-28 1468296]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-02-27 1368064]
"IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2009-02-27 1202448]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Zone Labs Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-08-29 980736]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2005-5-31 577597]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-6-21 282624]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-3-21 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [3/07/2009 15:34 108289]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2006-03-21 c:\windows\Tasks\Connexion facile à Internet.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-03 09:04]

2009-07-02 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2009-05-28 15:43]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNOTIFY.EXE
HKLM-Run-AGRSMMSG - AGRSMMSG.exe


.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Total\Application Data\Mozilla\Firefox\Profiles\aa35f2w7.default\
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-17 13:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?1?2?-??@???? ???B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|ù•Ñw*]
"C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\netprovcredman.dll
.
Completion time: 2009-07-17 13:21
ComboFix-quarantined-files.txt 2009-07-17 11:21

Pre-Run: 78.065.229.824 octets libres
Post-Run: 78.637.146.112 octets libres

257 --- E O F --- 2009-07-17 05:54












Et par la même occasion, voici le rapport de Malware Byte:

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2144
Windows 5.1.2600 Service Pack 2

17/07/2009 14:10:38
mbam-log-2009-07-17 (14-10-38).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 147504
Temps écoulé: 32 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Après avoir vainement cherché, vérifié que mon horloge dans la barre des tâches était bien à la bonne heure etc..., j'en profite également pour poster le rapport ComboFix de mon ordi :

ComboFix 09-07-14.08 - Nouvel utilisateur 17/07/2009 13:51.1.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.3054.2419

[GMT 2:00]
Running from: c:\documents and settings\Nouvel utilisateur\Bureau\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

{17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Pro Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions

)))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\null.sys

.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17

)))))))))))))))))))))))))))))))
.

2009-07-17 10:34 . 2009-07-17 10:34 -------- d-----w-

c:\documents and settings\Nouvel utilisateur\Application Data\Malwarebytes
2009-07-17 10:34 . 2009-07-13 11:36 38160 ----a-w-

c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-17 10:34 . 2009-07-17 10:34 -------- d-----w-

c:\program files\Malwarebytes' Anti-Malware
2009-07-17 10:34 . 2009-07-17 10:34 -------- d-----w-

c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-17 10:34 . 2009-07-13 11:36 19096 ----a-w-

c:\windows\system32\drivers\mbam.sys
2009-07-16 16:55 . 2009-07-16 16:55 -------- d-sh--w-

c:\documents and settings\ME\IETldCache
2009-07-15 19:02 . 2009-07-15 19:02 -------- d-----w-

c:\program files\iPod
2009-07-15 19:01 . 2009-07-15 19:02 -------- d-----w-

c:\program files\iTunes
2009-07-15 18:56 . 2009-07-15 18:56 75040 ----a-w- c:\documents and

settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes

8.2.1.6\SetupAdmin.exe
2009-07-03 12:05 . 2009-07-03 12:05 -------- d-----w-

c:\documents and settings\Nouvel utilisateur\Application Data\Leadertech
2009-07-03 11:59 . 2009-07-03 11:59 -------- d-----w-

c:\program files\EA Games
2009-06-21 19:38 . 2009-06-21 19:38 -------- d-----w-

c:\documents and settings\Nouvel utilisateur\Application Data\LEAPS
2009-06-18 05:22 . 2009-06-18 05:22 -------- d-sh--w-

c:\documents and settings\Nouvel utilisateur\PrivacIE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report

))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 12:01 . 2008-01-14 20:38 -------- d-----w-

c:\documents and settings\Nouvel utilisateur\Application Data\WTablet
2009-07-16 20:47 . 2009-02-18 19:32 -------- d-----w-

c:\program files\Navilog1
2009-07-16 18:55 . 2008-02-10 12:50 -------- d-----w-

c:\program files\RegCleaner
2009-07-15 19:06 . 2009-05-26 17:56 -------- d-----w-

c:\program files\Safari
2009-07-15 19:02 . 2008-01-31 21:53 -------- d-----w-

c:\program files\Fichiers communs\Apple
2009-07-15 05:04 . 2008-01-14 21:28 4212 ---h--w-

c:\windows\system32\zllictbl.dat
2009-07-10 05:05 . 2008-02-11 06:08 36057766 ----a-w-

c:\windows\Internet Logs\tvDebug.zip
2009-07-09 11:35 . 2009-04-19 14:46 138184 ----a-w-

c:\windows\system32\drivers\PnkBstrK.sys
2009-07-09 11:34 . 2009-04-19 14:46 183112 ----a-w-

c:\windows\system32\PnkBstrB.exe
2009-07-08 05:04 . 2008-03-08 08:03 -------- d-----w-

c:\documents and settings\LocalService\Application Data\WTablet
2009-07-07 20:41 . 2009-07-08 05:04 3230720 ----a-w-

c:\windows\Internet Logs\xDB1C.tmp
2009-07-07 08:25 . 2008-01-14 19:10 300176 ----a-w- c:\documents and

settings\Nouvel utilisateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-04 09:51 . 2009-04-19 14:46 66872 ----a-w-

c:\windows\system32\PnkBstrA.exe
2009-07-03 11:02 . 2008-01-17 08:43 -------- d-----w-

c:\documents and settings\Nouvel utilisateur\Application Data\FileZilla
2009-06-26 09:21 . 2008-06-01 17:06 327688 ----a-w-

c:\windows\system32\drivers\avgldx86.sys
2009-06-26 09:21 . 2008-06-01 17:06 11952 ----a-w-

c:\windows\system32\avgrsstx.dll
2009-06-26 09:21 . 2008-01-15 10:47 27784 ----a-w-

c:\windows\system32\drivers\avgmfx86.sys
2009-06-23 05:02 . 2001-08-28 11:00 81040 ----a-w-

c:\windows\system32\perfc00C.dat
2009-06-23 05:02 . 2001-08-28 11:00 501312 ----a-w-

c:\windows\system32\perfh00C.dat
2009-06-16 14:54 . 2004-08-19 14:09 119808 ----a-w-

c:\windows\system32\t2embed.dll
2009-06-16 14:54 . 2001-08-28 11:00 82432 ----a-w-

c:\windows\system32\fontsub.dll
2009-06-15 21:12 . 2009-02-17 21:56 664 ----a-w-

c:\windows\system32\d3d9caps.dat
2009-06-15 14:14 . 2009-06-15 14:14 196824 ---ha-w-

c:\windows\system32\mlfcache.dat
2009-06-13 09:16 . 2008-01-14 19:02 -------- d-----w-

c:\documents and settings\All Users\Application Data\Apple
2009-06-10 19:18 . 2008-01-15 10:05 -------- d-----w-

c:\program files\QuickTime Alternative
2009-06-05 09:42 . 2009-04-21 10:05 2060288 ----a-w-

c:\windows\system32\usbaaplrc.dll
2009-06-05 09:42 . 2008-01-31 21:54 39424 ----a-w-

c:\windows\system32\drivers\usbaapl.sys
2009-06-03 19:27 . 2004-08-19 14:09 1296896 ----a-w-

c:\windows\system32\quartz.dll
2009-05-26 17:58 . 2008-01-31 21:55 -------- d-----w-

c:\documents and settings\Nouvel utilisateur\Application Data\Apple Computer
2009-05-26 17:57 . 2009-05-26 17:57 -------- d-----w-

c:\program files\Apple Software Update
2009-05-15 09:01 . 2009-06-01 21:03 104924 ----a-w-

c:\windows\Fonts\Holiday_Home.ttf
2009-05-13 05:04 . 2004-08-19 14:09 915456 ----a-w-

c:\windows\system32\wininet.dll
2009-05-10 16:38 . 2008-06-01 17:06 108552 ----a-w-

c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:43 . 2004-08-19 14:09 347136 ----a-w-

c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w-

c:\windows\system32\GPhotos.scr
2009-04-24 08:02 . 2009-04-15 17:44 2545152 ----a-w- c:\documents and

settings\Nouvel utilisateur\Local Settings\Application

Data\cooliris-win-ie-release-1.10.0.24532.en-US.msi
2009-04-19 20:09 . 2004-08-19 14:00 1846784 ----a-w-

c:\windows\system32\win32k.sys
.

------- Sigcheck -------

[-] 2008-04-14 02:34 14336 E4BDF223CD75478BF44567B4D5C2634D

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\svchos

t.exe
[-] 2004-08-19 14:10 14336 2979B03D5382A602623C0535B16AB9C0

c:\windows\system32\svchost.exe
[-] 2004-08-19 14:10 14336 2979B03D5382A602623C0535B16AB9C0

c:\windows\system32\dllcache\svchost.exe

[-] 2005-03-02 18:20 578048 C34920EB988CE98910BD6B0417F334EB

c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:50 579072 4D88AAF39ADABFE45958EA1384E2C4FF

c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2004-08-19 14:09 578048 61C8C283AD063BB697AE61A155C64A5A

c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:10 578048 0DF75FB73F705B011630159A43D7C354

c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2008-04-14 02:33 579584 E853F84D3CE2FAA2A802E33CF89AC023

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\user32

.dll
[-] 2007-03-08 15:37 578560 753354F594809A9B96F73999B435A533

c:\windows\system32\user32.dll
[-] 2007-03-08 15:37 578560 753354F594809A9B96F73999B435A533

c:\windows\system32\dllcache\user32.dll

[-] 2008-04-14 02:33 82432 FB836F9E62D82904C983AD21296A5D9C

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ws2_32

.dll
[-] 2004-08-19 14:09 82944 EED74B969B2CA1ACC558FF60FB420E28

c:\windows\system32\ws2_32.dll
[-] 2004-08-19 14:09 82944 EED74B969B2CA1ACC558FF60FB420E28

c:\windows\system32\dllcache\ws2_32.dll

[-] 2007-10-11 05:59 670208 0465CDE31ADD22F6233FFB4FE4AF01CF

c:\windows\$hf_mig$\KB942615\SP2QFE\wininet.dll
[-] 2007-10-10 23:22 825344 871AE10D6AE8877E9636AE5017953D52

c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 01:42 825344 F4FD487241D3AC291046A22CEBD2CF71

c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 12:34 827392 5A0093F59B505C008ED0CEE615563C72

c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 07:19 827392 78D3D2B0BE6AD3E6D82CCB115CF74310

c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-06-23 15:40 827904 52589BAE67DD9859724287372668690B

c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 09:10 827904 4B0E70D44297877A313045BD059770E1

c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[-] 2008-10-16 19:33 827904 37D1A1BFE3D9904F2C3D11592456F9C0

c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[-] 2008-12-20 23:47 827904 4E192082A5FCE9EF19198A24CDEA3442

c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[-] 2009-03-03 00:15 828416 39F71B559A97ED722F939A0EA7235323

c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[-] 2009-04-29 04:37 828928 754097815B575A721AB58B1C55476805

c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
[-] 2009-05-13 05:08 915456 722E8ABB39238BAD1B1E13D97C49DB4D

c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[-] 2007-10-11 06:13 663552 D2FD027E5D3AF96DEE6C5CC225079DF0

c:\windows\$NtUninstallKB942615$\wininet.dll
[-] 2004-08-19 14:09 660480 4E958B97EFC3D801F49283D1820F48B7

c:\windows\$NtUninstallKB942615_0$\wininet.dll
[-] 2007-10-11 05:59 670208 0465CDE31ADD22F6233FFB4FE4AF01CF

c:\windows\ie7\wininet.dll
[-] 2007-08-13 17:54 818688 A4A0FC92358F39538A6494C42EF99FE9

c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:49 824832 BC5119C53BDD48DABC628D448A3BDCCB

c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-12-07 02:08 824832 4FC90BECE54FAC81B0090B94E27BFB6B

c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 12:58 826368 8E027981DDFFA690D456FE18B37415A0

c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 826368 02D6AABD5F5A32C61478B5CDFE50E4A8

c:\windows\ie7updates\KB953838-IE7\wininet.dll
[-] 2008-06-23 16:28 826368 AC0BD61DC2C64906FBFE50E005FEFA2C

c:\windows\ie7updates\KB956390-IE7\wininet.dll
[-] 2008-08-26 08:11 826368 E30CACD98479B36A3DBFA3267BF62DD0

c:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-10-16 20:18 826368 CFBFA47415E85018E2CDC509E5E3D011

c:\windows\ie7updates\KB961260-IE7\wininet.dll
[-] 2008-12-20 22:47 826368 0551C946E305CEE0A79BA744DC141BFC

c:\windows\ie7updates\KB963027-IE7\wininet.dll
[-] 2009-03-03 00:13 826368 68A2567FDD62AE7E31D8A885C5173EF9

c:\windows\ie7updates\KB969897-IE7\wininet.dll
[-] 2009-04-29 04:45 827392 08EFECB3F17F38F23F14148D374ACBC9

c:\windows\ie8\wininet.dll
[-] 2009-03-08 02:34 914944 6CE32F7778061CCC5814D5E0F282D369

c:\windows\ie8updates\KB969897-IE8\wininet.dll
[-] 2008-04-14 02:33 670208 4A6E04EA20F48D750D9BFED8600D516B

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\winine

t.dll
[-] 2007-10-10 23:49 824832 BC5119C53BDD48DABC628D448A3BDCCB

c:\windows\SoftwareDistribution\Download\3da5fb25f9bca1c53dde30405d5bbc6e\SP2GDR

\wininet.dll
[-] 2007-10-10 23:22 825344 871AE10D6AE8877E9636AE5017953D52

c:\windows\SoftwareDistribution\Download\3da5fb25f9bca1c53dde30405d5bbc6e\SP2QFE

\wininet.dll
[-] 2009-05-13 05:04 915456 FEADC209186574B0471D694FF5634F70

c:\windows\SoftwareDistribution\Download\40bc3e8679e1bad2a30cd389d408d57e\SP3GDR

\wininet.dll
[-] 2009-05-13 05:08 915456 722E8ABB39238BAD1B1E13D97C49DB4D

c:\windows\SoftwareDistribution\Download\40bc3e8679e1bad2a30cd389d408d57e\SP3QFE

\wininet.dll
[-] 2009-05-13 05:04 915456 FEADC209186574B0471D694FF5634F70

c:\windows\system32\wininet.dll
[-] 2009-05-13 05:04 915456 FEADC209186574B0471D694FF5634F70

c:\windows\system32\dllcache\wininet.dll

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8

c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48

c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D

c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E

c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2004-08-03 21:14 359040 9F4B36614A0FC234525BA224957DE55C

c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178

c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\tcpip.

sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9

c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9

c:\windows\system32\drivers\tcpip.sys

[-] 2008-04-14 02:34 512000 DD73D6B9F6B4CB630CF35B438B540174

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\winlog

on.exe
[-] 2004-08-19 14:10 506368 123EEA158F74D0F67A51DCDF065D1091

c:\windows\system32\winlogon.exe
[-] 2004-08-19 14:10 506368 123EEA158F74D0F67A51DCDF065D1091

c:\windows\system32\dllcache\winlogon.exe

[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ndis.s

ys
[-] 2004-08-03 21:14 182912 558635D3AF1C7546D26067D5D9B6959E

c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-03 21:14 182912 558635D3AF1C7546D26067D5D9B6959E

c:\windows\system32\drivers\ndis.sys

[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ip6fw.

sys
[-] 2004-08-03 21:00 29056 4448006B6BC60E6C027932CFC38D6855

c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-03 21:00 29056 4448006B6BC60E6C027932CFC38D6855

c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 18:13 2059008 5311776074B6C13F983DC75BAEAC9C0C

c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 16:08 2061440 7A56A64EB50399613587E90292DD2AAB

c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[-] 2009-02-09 11:42 2065024 0150FE5C1E07F8AE422FEC6C8E8A0C98

c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[-] 2009-02-10 17:06 2068096 F751E041E682F53EAF34F7FAEA78994D

c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[-] 2009-02-09 11:17 2068224 ED5E20AE4AC5A63A4FF43FFE704A5153

c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 13:39 2065024 DCBC1A6D150B5EE1BD6257186157B0F3

c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[-] 2008-08-14 13:23 2068096 8DA71F1900721E1E4FCB5B02D55FB771

c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[-] 2008-08-14 17:26 2068096 755B50949D0DBC0F0136B0DB58765331

c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2004-08-19 14:20 2017280 35567C8C50986C2BC5C3EFD79CB045E4

c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 18:08 2017280 50B3A210B6FA8D3089A36A32E7D8B21F

c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2008-08-14 13:44 2017792 7D0242CD4B2242BC766435DC1A1D49FA

c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2007-02-28 16:02 2017792 11C942F6519575079BAA9F14AEE35E88

c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2009-02-09 11:50 2059776 663D7167ED065786EC9DCFF2569A39F7

c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2008-04-14 02:07 2067968 B71A8F101CEFAF82FC5EC16130A54A3F

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ntkrnl

pa.exe
[-] 2009-02-09 11:50 2017792 0CEAF5FB401082156BE8EBAC8B923995

c:\windows\system32\ntkrnlpa.exe
[-] 2009-02-09 11:50 2059776 663D7167ED065786EC9DCFF2569A39F7

c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 18:13 2181632 3E2A0A4A0C0B19FC113618A9562A3B2A

c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 16:08 2184192 8E244108562E0E452EB68DFF64CB08A9

c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[-] 2009-02-09 11:43 2188160 B55AA66BC9269BC5257B915FFDAA790B

c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[-] 2009-02-09 11:24 2191104 AB896577F35CF5FED7A9F87D3C3205ED

c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[-] 2009-02-10 17:16 2191232 BEF458B8424553279E95E250D1E0CE7E

c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2008-08-14 13:39 2188032 C6649255E51F145B6E15C505AB68E459

c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[-] 2008-08-14 13:23 2191232 C8D4D5974F9671DA0A37175650912960

c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[-] 2008-08-14 17:26 2191232 D79210549BBF09B7638E860440504299

c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2004-08-19 14:04 2150400 36F32A5A83DF734E022734D93860A9A4

c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 18:07 2137600 E75F7AA5A33479F29C636FD0890F5762

c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2008-08-14 13:44 2138112 F54F9151170D876D9540CB8021CC83D5

c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2007-02-28 16:02 2138112 C7A39C47C064AE50417A944B60F37B6A

c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2009-02-09 11:50 2182528 4183ED119200F8520F5E834498AFB927

c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2008-04-14 02:08 2191104 099D639DA1EF6968D4E41795BB507E6B

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ntoskr

nl.exe
[-] 2009-02-09 11:50 2138112 8D57501F4865CFAC25034939E0FF6F8D

c:\windows\system32\ntoskrnl.exe
[-] 2009-02-09 11:50 2182528 4183ED119200F8520F5E834498AFB927

c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2007-06-13 13:22 1037312 D0288319660EDCFED07C7E74C4EA38A5

c:\windows\explorer.exe
[-] 2007-06-13 13:10 1037312 B795475444D6D57A572C14B9E1A29839

c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-19 14:09 1036288 2A7BD330924252A2FD80344FC949BB72

c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 02:34 1037824 F2317622D29F9FF0F88AEECD5F60F0DD

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\explor

er.exe
[-] 2007-06-13 13:22 1037312 D0288319660EDCFED07C7E74C4EA38A5

c:\windows\system32\dllcache\explorer.exe

[-] 2009-02-09 09:53 111104 51A24094F076961A7FF73E5F7E991D68

c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe
[-] 2009-02-09 11:23 111104 C3FB1D70CB88722267949694BA51759E

c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe
[-] 2009-02-09 11:16 111104 62789101F9C2401ED598AA2CDE7450C0

c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2004-08-19 14:10 108544 63DCDE1A0D86EEB8924D6738FF616EAD

c:\windows\$NtUninstallKB956572$\services.exe
[-] 2008-04-14 02:34 109056 54CB50058851D95E56EC70D09F70857F

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\servic

es.exe
[-] 2009-02-09 10:08 111104 9D6BF82FE50D55F20F8E10E0F6653886

c:\windows\system32\services.exe
[-] 2009-02-09 10:08 111104 9D6BF82FE50D55F20F8E10E0F6653886

c:\windows\system32\dllcache\services.exe

[-] 2008-04-14 02:34 13312 91E6024D6D4DCDECDB36C43ECF9BBECB

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\lsass.

exe
[-] 2004-08-19 14:09 13312 259AF82A0932EEA4F316F92DB94707B6

c:\windows\system32\lsass.exe
[-] 2004-08-19 14:09 13312 259AF82A0932EEA4F316F92DB94707B6

c:\windows\system32\dllcache\lsass.exe

[-] 2008-04-14 02:33 15360 59DC5BB82E4C8E0B3EADCFDBC44BA6E4

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\ctfmon

.exe
[-] 2004-08-19 14:09 15360 64E41E8FEE655B03E3F19DED21BA5118

c:\windows\system32\ctfmon.exe
[-] 2004-08-19 14:09 15360 64E41E8FEE655B03E3F19DED21BA5118

c:\windows\system32\dllcache\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788

c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2004-08-19 14:10 57856 DF9FC62AD51CB082B0AE371919A232CB

c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2008-04-14 02:34 57856 460E4CE148BD07218DA0B6A3D31885A9

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\spools

v.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F

c:\windows\system32\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F

c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-14 02:34 26624 E74DDB12188C2FF57A78624DBF7332FC

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\userin

it.exe
[-] 2004-08-19 14:10 25088 84717891F0734C611721F56C60B5FBC3

c:\windows\system32\userinit.exe
[-] 2004-08-19 14:10 25088 84717891F0734C611721F56C60B5FBC3

c:\windows\system32\dllcache\userinit.exe

[-] 2008-04-14 02:33 297984 710BC85A8C22626EE094439E3EA0D38C

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\termsr

v.dll
[-] 2004-08-19 14:09 297984 78F90C3E230AD122BCB116ABAD5FEFE9

c:\windows\system32\termsrv.dll
[-] 2004-08-19 14:09 297984 78F90C3E230AD122BCB116ABAD5FEFE9

c:\windows\system32\dllcache\termsrv.dll

[-] 2007-04-16 16:11 1051136 62E3F0E9ABFCBCEE62C51546F622C455

c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2009-03-21 13:58 1054208 2087E2764822A8D93A4CA7FA0FED35E8

c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll
[-] 2009-03-21 14:07 1054720 98F08549604D090B6B2514AF845F329F

c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll
[-] 2009-03-21 14:00 1056768 C3AF0EEE26B59484E674673E3016AAB7

c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2004-08-19 14:09 1048576 C88F74591579DBDE273C61312B2D3886

c:\windows\$NtUninstallKB935839$\kernel32.dll
[-] 2007-04-16 15:53 1049600 6F1FE2AE7B22EB9CED1BFF533C9455EA

c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2008-04-14 02:33 1054720 3AC8886DFA5AB641417DF4D3B7F5512E

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\kernel

32.dll
[-] 2009-03-21 14:20 1051136 534040750B9E70B156A98F5D0E8F6D2A

c:\windows\system32\kernel32.dll
[-] 2009-03-21 14:20 1051136 534040750B9E70B156A98F5D0E8F6D2A

c:\windows\system32\dllcache\kernel32.dll

[-] 2008-04-14 02:33 17408 9F2C862E39BF8E8FC51C3F6A6BCEB415

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\powrpr

of.dll
[-] 2004-08-19 14:09 17408 29D5E58FB089C41898A81BD4C8970F22

c:\windows\system32\powrprof.dll
[-] 2004-08-19 14:09 17408 29D5E58FB089C41898A81BD4C8970F22

c:\windows\system32\dllcache\powrprof.dll

[-] 2008-04-14 02:33 110080 0469B73DB32E5520F342C5E163AA3CCA

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\imm32.

dll
[-] 2004-08-19 14:09 110080 E55DAFA1A354BD5CB69151563DC9748A

c:\windows\system32\imm32.dll
[-] 2004-08-19 14:09 110080 E55DAFA1A354BD5CB69151563DC9748A

c:\windows\system32\dllcache\imm32.dll

[-] 2008-04-14 02:33 1571840 E17C85D5B5CF477638433B851A98499E

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\sfcfil

es.dll
[-] 2008-01-14 14:59 1548288 27ADFD1055B6D91256D663DF9FD44940

c:\windows\system32\sfcfiles.dll


[-] 2008-04-14 02:05 25216 16813155807C6881F4BFBF6657424659

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\kbdcla

ss.sys
[-] 2004-08-19 14:00 25216 E798705E8DC7FAB596EF6BFDF167E007

c:\windows\system32\drivers\kbdclass.sys

[-] 2008-04-14 02:33 851968 F4B7146C7EED6C4E158DCD9B5266C25A

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\comres

.dll
[-] 2004-08-19 14:09 851968 E2F47BBB69D1E4E5ED1AF720893B4460

c:\windows\system32\comres.dll
[-] 2004-08-19 14:09 851968 E2F47BBB69D1E4E5ED1AF720893B4460

c:\windows\system32\dllcache\comres.dll

[-] 2008-04-14 02:33 22016 982B2C204337C3B12211E1E1D9BA8C9C

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\lpk.dl

l
[-] 2004-08-19 14:09 22016 3236A6A1650E6C055FD5E87D7C4A05AD

c:\windows\system32\lpk.dll
[-] 2004-08-19 14:09 22016 3236A6A1650E6C055FD5E87D7C4A05AD

c:\windows\system32\dllcache\lpk.dll

[-] 2001-08-28 11:00 4224 DA1F27D85E0D1525F6621372E7B685E9

c:\windows\system32\dllcache\beep.sys

[-] 2001-08-28 11:00 2944 73C1E1F395918BC2C6DD67AF7591A3AD

c:\windows\system32\dllcache\null.sys

[-] 2001-08-28 11:00 924432 E1A34560BF6CE7C703BB67EC4FA70F43

c:\windows\$NtUninstallKB924667$\mfc40u.dll
[-] 2008-04-14 02:33 927504 CE21FE79AD3B913A79E0C742BED6BF85

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\mfc40u

.dll
[-] 2006-11-01 19:18 927504 FCD58951B3B2392007E0EE34D2CF944F

c:\windows\system32\mfc40u.dll
[-] 2006-11-01 19:18 927504 FCD58951B3B2392007E0EE34D2CF944F

c:\windows\system32\dllcache\mfc40u.dll

[-] 2005-04-28 19:36 396288 FD292BFE003558F4C39AA3D44F420AC7

c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-07-26 04:29 398336 B38D431ACE730452CD1FEE4FB7ECD6E2

c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2009-02-09 10:03 401408 BA1EF616F55210820F6462D033088497

c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll
[-] 2009-02-09 10:53 401408 0203B1AAD358F206CB0A3C1F93CCE17A

c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll
[-] 2009-02-09 10:56 401408 F83B964469D230F445613C44DF9FE25D

c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2004-08-19 14:09 395776 C6FE0B727A5D13419D480150631ADC09

c:\windows\$NtUninstallKB894391$\rpcss.dll
[-] 2005-04-28 19:32 395776 D0F724BDF4A0647F1A52985FD629EFCE

c:\windows\$NtUninstallKB902400$\rpcss.dll
[-] 2005-07-26 04:40 397824 CB7D37602638369A516757E994CBB31D

c:\windows\$NtUninstallKB956572$\rpcss.dll
[-] 2008-04-14 02:33 399360 3D65EB82E1FA6DB15A33E024C9E03CAB

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\rpcss.

dll
[-] 2009-02-09 10:20 399360 5620353B93DD08016674E4FEE280190B

c:\windows\system32\rpcss.dll
[-] 2009-02-09 10:20 399360 5620353B93DD08016674E4FEE280190B

c:\windows\system32\dllcache\rpcss.dll

[-] 2008-04-14 02:33 33792 E67A66A3781C1A483F0F8992664CBE0D

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\msgsvc

.dll
[-] 2004-08-19 14:09 33792 DE71362123E81D268088E78543752576

c:\windows\system32\msgsvc.dll
[-] 2004-08-19 14:09 33792 DE71362123E81D268088E78543752576

c:\windows\system32\dllcache\msgsvc.dll

[-] 2004-08-19 14:09 611328 7D3AA1F0E765054CB5F30114F2DB6888

c:\windows\$NtUninstallKB923191$\comctl32.dll
[-] 2008-04-14 02:33 617472 B4AA331468315B6A174C3F0D5B3BC135

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\comctl

32.dll
[-] 2008-04-14 02:30 1054208 F92E6BEA9349D49341383F8403B4DFE5

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\asms\6

0\msft\windows\common\controls\comctl32.dll
[-] 2006-08-25 15:51 617472 5BBCD65CFD7610F36BCA96B72BBAED4B

c:\windows\system32\comctl32.dll
[-] 2006-08-25 15:51 617472 5BBCD65CFD7610F36BCA96B72BBAED4B

c:\windows\system32\dllcache\comctl32.dll
[-] 2001-08-28 11:00 921088 AEF3D788DBF40C7C4D204EA45EB0C505

c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0

_x-ww_1382d70a\comctl32.dll
[-] 2004-08-19 14:07 1050624 7B5D86AF13CEF261180CC0F3BF094366

c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.260

0.2180_x-ww_a84f1ff9\comctl32.dll
[-] 2006-08-25 15:51 1054208 47ABF878B9AEC81B23BA5F89DE597B3A

c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.260

0.2982_x-ww_ac3f9c03\comctl32.dll

[-] 2001-08-28 11:00 12032 E4ABC1212B70BB03D35E60681C447210

c:\windows\system32\drivers\acpiec.sys

[-] 2008-04-14 02:33 5120 9A4E7ECBB5B7FB86F3B926AB039F4FEC

c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\sfc.dl

l
[-] 2004-08-19 14:09 5120 BB695F18354B38CFF693E67EE7A30C22

c:\windows\system32\sfc.dll
[-] 2004-08-19 14:09 5120 BB695F18354B38CFF693E67EE7A30C22

c:\windows\system32\dllcache\sfc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points

))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IRW"="c:\windows\system32\IRW.exe" [2008-04-15 147456]
"Apple_KbdMgr"="c:\program files\Boot Camp\KbdMgr.exe" [2008-04-15 423216]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat

8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"LogitechCommunicationsManager"="c:\program files\Fichiers

communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe"

[2007-07-25 2027792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-26 1948440]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-06-28 2512128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_17\bin\jusched.exe"

[2008-11-10 75264]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device

Support\bin\AppleSyncNotifier.exe" [2009-05-13 177472]
"QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2009-05-26

413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl

[2004-08-19 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-04-15 16855552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Acrobat

8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]
ColorVisionStartup.lnk - c:\program

files\ColorVision\Utility\ColorVisionStartup.exe [2006-1-31 385024]
Lancement rapide d'Adobe Acrobat.lnk -

c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe

[2008-1-16 295606]

[HKEY_LOCAL_MACHINE\software\microsoft\windows

nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-26 09:21 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys

]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys

]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu

Démarrer^Programmes^Démarrage^Logiciel de Synchronisation Orange.lnk]
path=c:\documents and settings\All Users\Menu

Démarrer\Programmes\Démarrage\Logiciel de Synchronisation Orange.lnk
backup=c:\windows\pss\Logiciel de Synchronisation Orange.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security

center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Authoriz

edApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\Authorized

Applications\List]
"%windir%\\system32\\sessmgr.exe"=

%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
"%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\Network

Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= c:\program files\MSN

Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
"c:\\Program Files\\MSN Messenger\\livecall.exe"= c:\program files\MSN

Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\GloballyOp

enPorts\List]
"139:TCP"= 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP"= 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP"= 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP"= 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP"= 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP"= 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\Authoriz

edApplications\List]
"%windir%\\system32\\sessmgr.exe"=

%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
"%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\Network

Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= c:\program files\MSN

Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
"c:\\Program Files\\MSN Messenger\\livecall.exe"= c:\program files\MSN

Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= c:\program

files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= c:\program

files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"= c:\program

files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
"c:\\Program Files\\iTunes\\iTunes.exe"= c:\program

files\iTunes\iTunes.exe:*:Enabled:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\Globally

OpenPorts\List]
"139:TCP"= 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP"= 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP"= 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP"= 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP"= 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP"= 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys

[01/06/2008 19:06 327688]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys

[01/06/2008 19:06 108552]
R2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe

[15/04/2008 16:44 132400]
R2 AppleTimeSrv;Apple Time Service;c:\windows\system32\AppleTimeSrv.exe

[15/04/2008 16:44 99632]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [04/07/2008 08:16

906520]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [04/07/2008 08:16

298776]
R2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [15/04/2008 16:44

5504]
R2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [15/04/2008

16:44 6528]
R3 applebt;Apple Built-in Bluetooth;c:\windows\system32\drivers\applebt.sys

[14/01/2008 21:02 9088]
R3 IRRemoteFlt;IR Receiver Filter

Driver;c:\windows\system32\drivers\IRFilter.sys [14/01/2008 21:05 16512]
R3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\drivers\KeyMagic.sys

[14/01/2008 21:06 19968]
S3 BthKicker;Apple Bluetooth Device

Driver;c:\windows\system32\drivers\BthKicker.sys [14/01/2008 21:05 7424]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter
DcomLaunch REG_MULTI_SZ DcomLaunch TermService
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost -

LocalService
Alerter
LmHosts


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed

components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe"

"c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-07-17

c:\windows\Tasks\User_Feed_Synchronization-{8D246F27-D0C4-4875-A43F-BECB994E0131

}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2009-07-17 c:\windows\Tasks\Utilitaire du fichier Préférences tablette.job
- c:\progra~1\Tablet\Remove.exe [2008-01-14 21:19]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat

8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat

8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat

8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program

files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat

8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program

files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program

files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program

files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xporter vers Microsoft Excel -

c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -

hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {B33E9AC8-169E-4346-BCD9-C98A8BE3F1E9} -

hxxp://www.piclens.com/shared/plinstll.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} -

hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

http://www.gmer.net
Rootkit scan 2009-07-17 14:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1993962763-764733703-682003330-1003\Software\SecuROM\!CAUTI

ON! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e6,37,7f,61,7c,5c,7c,51,83,83,d5,2b,97,36,4b,03,0e,7d,c8,1a,98,74,7b,
06,a3,71,19,3a,95,be,13,5e,e3,a3,c5,ad,86,e7,19,72,29,48,15,ee,8f,0b,bf,70,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800

200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-10

1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800

200C9A66}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800

200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10b.exe"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800

200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{3DA165B6-CC41-11d2-BDC6-00C0

4F79EC6B}\ProgID]
@Denied: (A) (Everyone)
@="{87E5CE98-945B-49E3-AD79-1E3ED20498F5}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{3DA165B6-CC41-11d2-BDC6-00C0

4F79EC6B}\Version]
@Denied: (A) (Everyone)
@="{87E5CE98-945B-49E3-AD79-1E3ED20498F5}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{8D8763AB-E93B-4812-964E-F04E

0008FD50}\Version]
@Denied: (A) (Everyone)
@="{8D8763AB-E93B-4812-964E-F04E0008FD50}"
"{21701DD0-9D7E-43f7-A1B2-E92ED6E90A51}"=hex:04,5e,e7,bb,c9,75,54,d1,61,5c,1d,
ba,8c,c7,61,42,b4,ab,9b,78,60,63,f4,fd,36,34,c9,01

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\InprocServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\ToolboxBitmap32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx, 1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-4445

53540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}\InprocServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}\ToolboxBitmap32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx, 1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-4445

53540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-

0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-

0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-

0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-44

4553540000}]
@Denied: (A 2) (Everyone)

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-44

4553540000}\1.0]
@="Shockwave Flash"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6

823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6

823C6DF1C9}\1.0]
@="FlashBroker"

[HKEY_LOCAL_MACHINE\softwareSoftware\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="C244A355125A6DE1F832C35E3A952D46084EFCCA8222A9

6C396860CF8506DFB568E3DF564FB70B10DC354492A1E8CA156A74F3297ADB0D3A690791E37355D6

8A77465DFA6D134E778FCCF1EB8DD51BBB6EC3CBDD0A001C403F4523974339E3A42ECE0F8AB62F88

46AEC80662355C4765AB11A03273E5F24C72A2B427E382B412FDC73BCFE5F51E6B89D90C72419E87

05EF97E374ED893FEFEB04BD50BAA490A78FDA7D9BAEF48A1C2194E39DCFDFAACD3CFEBC9E127BEC

C74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BEC

C74CA6A0AC4980AC7933A6A0AC4980AC7933A6171C11EC38DE3DC038D530D6EB3452533FF9D2DA38

700E74FC7E86FC21375EA3066233797FA5E795BC65572169CF7860F349F8094625537EE8E8DC4BEF

0D5D5D06E11B6A9D1E8A057CC671B730D42AC3B169F64AB564F3F9712D9913D313F162FBF3E26E71

30307E5A0D1D51BC87480109C03985757AAC536E6490731517552AA6836DFAB6C82F2498146ADFE0

186480613B1BC20CF96BDC8AAA8CAC8CA8F30D147E12ABBC1A90F7CBB95DF500F8450F754AECAE92

B355CCC6A0CCA62A1E6DCA2B551C3EE61B1161DDE0ED4D1461E45C555F751A36C2423AF6E981E96E

101884A37EC8172C8624AB0EEF874027CB73FC62726CF937813B25C23151A3F15CFAC20BF24DBC97

D86C066CD10CCD5BF8D1E9D40000E76D1082EC2622D6A75CA252EC41B14F5AC9D5C5845FF4CE9C64

6B18FE3587CE9FBFD30B586FEC9FEAEDC990D47CBAE9BDF3023E9FA0CC16F28A698E7CE28CF0032C

74F9104347AD87F6FAD8AA43152D5ADD299530BE4F203DA87FB58892966E96445D2E229A6876BADF

A1838574C81BC6E4D8C17699779B8A327CBFA8493143042CBFB4FEBF0E6567A1701D5FBF65ABBF76

E2EB9768C2AD8FA8F292CAE2EB61969F8E537BD379D792CADBE616A97C482116DCF2183536EBA325

3949C00DDA2DBF69037F5348ED20E7FD9D55ED0D22516FDA23E7665D5565C354EB31BB4A9580166C

9965A36834823271B1110D14F01AD270D00FCE922E998E75EACD57733728501D11E4EB4C993BE5ED

5AF5FBC0066815964BE387D94D7B48DED6568EB16164CC04ED911266EEF798D41C942AE704F7A31F

B592270F45F259769935C004B46B0CC0F8B2DF79085A8295C0B1E93290F893F27C7C27DDAD5CCCB9

DB07B3BCDA64B282BE44031C3EF703B755C5F29BD38B1B8CCCB769C82188D3398EA01004FE6F880F

0E740EBB6EDA1D54AAFD5DF6FB4994FA188EB0263DB9C019630761D3D09AFC40FB2873197801741C

5639A8E6BBBB7E6217FC241E26AA0D10D2F518F9046C1F8361F60FC5C0DD534FB00E3865C863FD78

40B6CE310184D36D98DA099B50DDA45858AA9C29B0D629C5D744D0BD5B32D70B549EA02E7969D48E

B1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(816)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(7752)
c:\program files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Fichiers communs\logishrd\LVMVFM\LVPrcSrv.exe
c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe
c:\program files\Fichiers communs\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\logishrd\LVCOMSER\LVComSer.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\oodag.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\WTablet\TabUserW.exe
c:\windows\system32\Tablet.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\rundll32.exe
c:\program files\Fichiers communs\logishrd\LQCVFX\COCIManager.exe
c:\program files\Fichiers communs\Macrovision Shared\FLEXnet

Publisher\FNPLicensingService.exe
c:\program files\Fichiers communs\logishrd\LVCOMSER\LVComSer.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-07-17 14:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-17 12:13

Pre-Run: 7 370 989 568 octets libres
Post-Run: 7 504 797 696 octets libres

531 --- E O F --- 2009-07-15 18:14





Merci,

Ant

Bonjour à tous.

J'ai exactement le même problème depuis ce matin avec Zone Alarm et j'ai moi aussi avast! comme antivirus.
Avez-vous trouvé une solution ?

Cordialement.

Bon ben on est trois lol.
Aidez-nous svp :(

je dirais même 4 :/

j'ai commencé à avoir ces messages hier matin avec la coupure de la navigation après une vingtaine deminutes, j'ai cherché sur le web et je cherche encore mais rien de concluant ... Je voudrais juste ajouter que la connexion internet elle fonctionne (jeux en réseau possible de même que msn) mais ce sont les différents navigateurs qui bloquent chez moi (firefox & IE) faut que je test avec chrome, qui est parti quand j'ai testé l'option restauration du système. De toute façon ça ferai pas avancer le shmilblik je pense.

la partition à problème est sous xp pro sp2

Plus on est de fous, plus on rit...!
Je n'ai aucune idée de ce à quoi c'est dû, comme rab ma connexion fonctionne très bien (je suis en train de l'utiliser actuellement avec le portable).
Ce n'est donc pas un problème de réseau.
Le problème vient donc forcément de ZA, surtout qu'en y repensant ça faisait un bail qu'il avait pas été mis à jour...

Oui exactement Just_me, c'est ZoneAlarm qui bloque la connexion. Idem pour mon pc, j'ai accès qu'à msn, le reste, que nenni.

J'avais testé une procédure presque similaire à celle postée par carabistouilles mais il m'était impossible de supprimer les fichiers demandés.
En cherchant, j'ai cru comprendre qu'en mettant à jour IE une partie du problème disparaissait.
C'est ce que j'ai fait, j'ai installé IE 8.0 puis suivi la version donnée par carabistouilles et mtn je n'ai déjà plus les messages d'erreurs, reste à voir si les navigateurs restent stables mtn et à totalement éradiquer les résidus de zone alarme restants.

merci

Bonjour à tous

J'avais exactement le même problème (mêmes messages d'erreur, navigateurs internet HS après un quart d'heure, impossible de désinstaller ZA même en mode sans échec, etc.), et d'après ce que j'ai compris en consultant pas mal de sites internet, c'est dû au fait que certaines vieilles versions de Zone Alarm ne pouvaient plus fonctionner après le 16 juillet 2009. Le programme ne pouvait donc plus se lancer, ni se désinstaller, ni rien.

Je crois avoir réussi à régler le problème sur mon PC en ramenant l'horloge de l'ordinateur deux jours en arrière, au 15 juillet. Zone alarm fonctionnait à nouveau et après l'avoir désinstallé, j'ai ramené l'horloge de l'ordinateur à la date d'aujourd'hui.

Je croise les doigts, mais pour le moment, je n'ai plus de problèmes et mes navigateurs internet fonctionnent depuis une heure sans soucis...

Bonne soirée

Salut à vous,
Je confirme le pb de zonealarm et la solution.
Mais au lieu de desinstaller zonealarm, le plus simple consiste à :

1- régler l'horloge quelques jours avant
2- mettre zonealarm à jour (a partir du logiciel -> cela mène direct à la page du site)
3- regler l'horloge a nouveau

bon surf,

c'est la faute à jacko et elvis

1 - dans le tuto de CF il était dit qu'il fallait arrêter tout logiciel de protection (av, pf)
2 - mettez à jour les logiciels sur vos pc : java en est à la version 1.6.14, supprimez les anciennes
3 - les gratuits ne sont pas mis à jour , il faut les désinstaller tous les ans et reprendre la nouvelle version

Merci à tous de vos réponses!
J'ai enfin trouvé la solution, grâce à vous!

En fait, j'ai ramené la date du système d'exploitation à quelques jours avant (le 6 juillet 2009), et là, ZoneAlarm est réapparu,
Visiblement comme dit plus haut, c'est dû à une mise à jour de Windows qui bloque totalement le programme...

Donc remettez la date à quelques jours avant, redémarrez et le programme réapparaîtra comme par magie, vous pourrez alors le désinstaller!

Merci à tous de votre aide qui m'a sauvé!
A+ et bonne soirée!

2- mettre zonealarm à jour (a partir du logiciel -> cela mène direct à la page du site)
d'expérience, je doute fort de cette solution, ZA renvoie systématiquement vers une version payante
allez plutot ici :
http://www.clubic.com/lancer-le-telechargement-21814-0-zonealarm.html

Merci à tous de ma part aussi, je l'ai ramené au 14 juillet et j'ai pu désinstaller ZA.
J'ai maintenant un autre problème qui subsiste, qui est le fait que je n'ai toujours pas de connexion, mon navigateur est vide, quand je vais sur un site il reste désespérément vide. J'ai vérifié ma connexion et elle marche puisque le câble est actuellement branché sur le portable.
Pouvez-vous me dire d'où cela peut bien venir ? Et comment faire pour pouvoir reprendre le cours normal de ma navigation sur mon pc fixe ?
J'avais pensé faire une restauration de système, mais est-ce bien judicieux ?

OK mettre une date antérieure permet de lancer, désinstaller, réinstaller Zone Alarm.
Mais ensuite si je reviens à la bonne date je retrouve le problème (affichage de popup d'erreur).