Stop aux pubs

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2823
Windows 6.0.6001 Service Pack 1

19/09/2009 17:35:26
mbam-log-2009-09-19 (17-35-26).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 364100
Temps écoulé: 1 hour(s), 41 minute(s), 35 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bc4be15d-6a34-4356-9e97-79e43da32b1d} (Adware.Shopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\BIFROST1.2 (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiufewcgevg (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Users\Greg\Local Settings\Application Data\Bron.tok-12-24 (Worm.Brontok) -> Quarantined and deleted successfully.
C:\Users\Greg\Local Settings\Application Data\Bron.tok-12-25 (Worm.Brontok) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\EoRezo\EoRezoBHO.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\Windows\System32\gjboqbmhasuwvp.exe.vir (Adware.SnappyAds) -> Quarantined and deleted successfully.
C:\Program Files\eChanblard\EvID4226Patch.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\ProgramData\PSSCS\data\vssvcs.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\autorun.inf (SuspectAutorun.Rootdrive.H) -> Quarantined and deleted successfully.
C:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.

ComboFix 09-09-18.02 - Greg 19/09/2009 18:06.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Basique   6.0.6001.1.1252.33.1036.18.2814.1589 [GMT 2:00]
Lancé depuis: c:\users\Greg\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Greg\AppData\Local\Bron.tok.A12.em.bin
c:\users\Greg\AppData\Local\Kosong.Bron.Tok.txt
c:\users\Greg\AppData\Roaming\020000006c3493d5517C.manifest
c:\users\Greg\AppData\Roaming\020000006c3493d5517O.manifest
c:\users\Greg\AppData\Roaming\020000006c3493d5517P.manifest
c:\users\Greg\AppData\Roaming\020000006c3493d5517S.manifest
c:\windows\Installer\296e28.msi
c:\windows\Installer\479ea.msi
c:\windows\system32\Ijl11.dll
c:\windows\UA000082.DLL

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-08-19 au 2009-09-19  ))))))))))))))))))))))))))))))))))))
.

2009-09-19 16:20 . 2009-09-19 16:20	--------	d-----w-	c:\users\private\AppData\Local\temp
2009-09-19 16:20 . 2009-09-19 16:20	--------	d-----w-	c:\users\Default\AppData\Local\temp
2009-09-19 13:56 . 2009-09-19 13:56	106112	----a-w-	c:\users\private\AppData\Local\GDIPFONTCACHEV1.DAT
2009-09-19 13:56 . 2009-09-19 13:56	--------	d-----w-	c:\users\private\AppData\Roaming\Nero
2009-09-19 12:19 . 2009-09-19 12:19	--------	d-----w-	c:\users\Greg\AppData\Roaming\Malwarebytes
2009-09-19 12:19 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-19 12:19 . 2009-09-19 12:19	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-09-19 12:19 . 2009-09-19 12:19	--------	d-----w-	c:\programdata\Malwarebytes
2009-09-19 12:19 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-09-19 08:04 . 2009-09-19 08:26	--------	d-----w-	c:\program files\Ad-Remover
2009-09-18 21:33 . 2008-06-05 16:18	5737	----a-w-	c:\users\Greg\AppData\Local\gnc.exe
2009-09-18 20:48 . 2009-09-18 21:33	--------	d-----w-	c:\program files\Navilog1
2009-09-18 18:04 . 2009-09-18 18:09	--------	d-----w-	C:\ToolBar SD
2009-09-17 20:11 . 2009-09-17 20:12	--------	d-----w-	c:\program files\trend micro
2009-09-17 20:11 . 2009-09-17 20:12	--------	d-----w-	C:\rsit
2009-09-14 19:21 . 2009-09-14 19:21	--------	d-----w-	c:\program files\Files-Sauvegarde
2009-09-12 15:17 . 2009-09-12 15:17	--------	d-----w-	c:\program files\Microsoft.NET
2009-09-12 15:14 . 2009-09-12 15:15	--------	d-----w-	c:\windows\SHELLNEW
2009-09-12 15:12 . 2009-09-12 15:12	--------	d-----r-	C:\MSOCache
2009-09-12 14:20 . 2009-09-12 14:29	--------	d-----w-	c:\program files\QCMPackageLite FRA
2009-09-12 14:11 . 2009-09-12 14:12	--------	d-----w-	c:\program files\QCM
2009-09-12 13:04 . 2009-09-12 13:11	--------	d-----w-	c:\program files\Questy
2009-09-11 19:26 . 2009-09-11 19:26	--------	d-----w-	c:\program files\Mattgo27 Apps
2009-09-09 19:00 . 2009-09-09 19:02	--------	d-----w-	c:\program files\nLite
2009-09-09 18:53 . 2009-06-10 12:11	2868224	----a-w-	c:\windows\system32\mf.dll
2009-09-07 15:54 . 2009-09-07 16:30	--------	d-----w-	c:\users\Greg\AppData\Local\Ahead
2009-09-07 14:58 . 2009-08-28 12:39	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2009-09-07 14:58 . 2009-08-28 10:15	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-31 10:34 . 2009-08-31 10:34	--------	d-----w-	c:\users\Greg\AppData\Local\Opera
2009-08-31 10:34 . 2009-08-31 10:34	--------	d-----w-	c:\program files\Opera
2009-08-30 21:47 . 2009-08-30 21:47	--------	d-----w-	c:\users\Greg\AppData\Roaming\AchrafCherti
2009-08-30 10:22 . 2009-08-30 10:22	--------	d-----w-	c:\program files\FileZilla FTP Client
2009-08-30 10:22 . 2009-08-30 10:22	--------	d-----w-	c:\program files\loliwin
2009-08-30 10:06 . 2009-08-30 10:06	--------	d-----w-	c:\users\Greg\AppData\Roaming\K-Meleon
2009-08-30 01:01 . 2009-08-30 01:01	--------	d-----w-	c:\windows\CheckSur
2009-08-29 20:45 . 2009-08-30 21:49	--------	d-----w-	C:\Mes Sites Web
2009-08-29 20:35 . 2009-08-29 20:42	--------	d-----w-	C:\LiberKey
2009-08-29 20:13 . 2009-08-29 20:13	--------	d-----w-	c:\users\Greg\AppData\Roaming\MfcEmbed
2009-08-29 19:07 . 2009-08-29 19:07	--------	d-----w-	c:\users\Greg\AppData\Local\Passwords Max
2009-08-28 18:22 . 2008-01-17 06:17	3948	----a-w-	c:\windows\system32\drivers\nvphy.bin
2009-08-28 15:32 . 2009-08-28 15:32	--------	d-----w-	c:\users\Greg\AppData\Roaming\KeePass
2009-08-28 12:37 . 2009-08-17 16:04	23152	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2009-08-28 12:37 . 2009-08-17 16:04	51376	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2009-08-28 12:37 . 2009-08-17 16:05	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys
2009-08-28 12:37 . 2009-08-17 16:05	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2009-08-28 12:37 . 2009-08-17 16:02	97480	----a-w-	c:\windows\system32\AvastSS.scr
2009-08-28 12:36 . 2009-08-17 16:10	1279456	----a-w-	c:\windows\system32\aswBoot.exe
2009-08-28 12:36 . 2009-08-17 16:05	53328	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2009-08-28 10:07 . 2009-08-28 10:07	--------	d-----w-	c:\program files\CCleaner
2009-08-28 01:08 . 2009-08-28 01:08	--------	d-----w-	c:\program files\FlashCrypt
2009-08-28 00:43 . 2009-08-28 00:43	--------	d-----w-	c:\users\Greg\AppData\Roaming\gnupg
2009-08-28 00:42 . 2009-08-28 09:24	--------	d-----w-	c:\program files\AutoKrypt8
2009-08-28 00:26 . 2009-08-28 00:26	--------	d-----w-	c:\program files\File and Folder Protector
2009-08-28 00:26 . 2009-08-28 00:26	--------	d--h--w-	c:\windows\ffpext
2009-08-28 00:26 . 2009-05-28 18:28	44288	----a-w-	c:\windows\system32\drivers\FDCDNT.SYS
2009-08-28 00:16 . 2009-08-28 00:20	--------	d-----w-	c:\program files\SafeHouse Explorer
2009-08-28 00:16 . 2009-08-28 00:16	--------	d-----w-	C:\SafeHouse
2009-08-27 23:31 . 2009-05-03 10:22	73392	----a-w-	c:\windows\system32\fsproflt.exe
2009-08-27 23:31 . 2008-06-05 17:37	43792	----a-w-	c:\windows\system32\drivers\FSPFltd.sys
2009-08-27 20:58 . 2009-08-27 20:58	35363	----a-w-	c:\windows\system32\windrvNT.sys
2009-08-27 20:58 . 2007-02-07 17:50	77824	----a-w-	c:\windows\system32\FLKill.exe
2009-08-27 20:58 . 2004-05-10 10:42	110592	----a-w-	c:\windows\system32\suppdll.dll
2009-08-27 20:58 . 2009-08-27 20:58	--------	d-----w-	c:\program files\Folder Lock
2009-08-27 18:18 . 2009-08-27 18:44	--------	d-----w-	c:\program files\Universal Shield 4.3
2009-08-27 16:39 . 2006-08-14 14:06	4635409	----a-w-	c:\windows\system32\Crk_Sarkophage.exe
2009-08-27 16:14 . 2006-06-02 23:07	453120	----a-w-	c:\windows\system32\srksrv.exe
2009-08-27 16:12 . 2006-06-02 23:25	1048064	----a-w-	c:\windows\system32\Sarkophage.exe
2009-08-27 16:11 . 2009-08-28 00:20	--------	d-----w-	c:\program files\Sarkophage
2009-08-27 11:36 . 2009-08-27 11:36	--------	d-----w-	c:\program files\Audacity
2009-08-27 10:43 . 2009-06-22 10:22	2048	----a-w-	c:\windows\system32\tzres.dll
2009-08-26 22:40 . 2009-08-26 22:41	--------	d-----w-	c:\users\Greg\AppData\Roaming\DeepBurner Pro
2009-08-26 22:07 . 2009-08-26 22:14	--------	d-----w-	c:\program files\1toX
2009-08-26 15:59 . 2009-09-18 18:54	89	----a-w-	c:\users\Greg\AppData\Local\epbtecnh.bat

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-19 15:35 . 2008-12-25 17:37	--------	d-----w-	c:\program files\eChanblard
2009-09-19 13:57 . 2009-07-03 18:11	81896	----a-w-	c:\programdata\nvModes.dat
2009-09-17 20:07 . 2008-09-07 22:03	--------	d-----w-	c:\programdata\NVIDIA
2009-09-15 17:57 . 2008-11-16 20:03	--------	d-----w-	c:\program files\adslTV
2009-09-14 15:35 . 2008-08-05 02:11	--------	d-----w-	c:\programdata\Microsoft Help
2009-09-12 17:51 . 2008-11-14 18:20	106112	----a-w-	c:\users\Greg\AppData\Local\GDIPFONTCACHEV1.DAT
2009-09-12 15:18 . 2008-08-05 01:49	--------	d-----w-	c:\program files\Microsoft Works
2009-09-10 20:37 . 2008-11-15 15:33	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-09-10 15:54 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-09-09 20:13 . 2008-08-05 00:37	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-08 19:55 . 2008-11-23 12:06	--------	d-----w-	c:\program files\Common Files\Nero
2009-09-08 19:51 . 2008-11-23 12:06	--------	d-----w-	c:\programdata\Nero
2009-09-07 15:52 . 2008-11-23 12:55	--------	d-----w-	c:\users\Greg\AppData\Roaming\Nero
2009-09-07 15:49 . 2008-11-23 12:07	--------	d-----w-	c:\program files\Nero
2009-09-07 15:45 . 2008-08-05 10:01	669566	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-07 15:45 . 2008-08-05 10:01	123556	----a-w-	c:\windows\system32\perfc00C.dat
2009-09-07 14:55 . 2009-06-21 00:09	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-08-29 20:02 . 2009-02-15 21:42	--------	d-----w-	c:\users\Greg\AppData\Roaming\gtk-2.0
2009-08-28 19:58 . 2009-03-09 22:38	--------	d-----w-	c:\users\Greg\AppData\Roaming\FileZilla
2009-08-28 18:57 . 2009-01-27 19:20	--------	d-----w-	c:\programdata\Apple Computer
2009-08-27 10:39 . 2009-06-14 14:29	--------	d-----w-	c:\program files\Astonsoft
2009-08-27 10:39 . 2008-12-30 12:38	680	----a-w-	c:\users\Greg\AppData\Local\d3d9caps.dat
2009-08-26 12:28 . 2009-07-25 16:14	90	----a-w-	c:\users\Greg\AppData\Local\smquq.bat
2009-08-26 12:26 . 2009-06-15 14:24	--------	d-----w-	c:\users\Greg\AppData\Roaming\PhotoFiltre Studio X
2009-08-26 12:26 . 2009-03-08 14:11	--------	d-----w-	c:\users\Greg\AppData\Roaming\Notepad++
2009-08-26 12:26 . 2009-06-15 14:09	--------	d-----w-	c:\users\Greg\AppData\Roaming\IcoFX
2009-08-25 23:25 . 2009-08-13 21:40	--------	d-----w-	c:\users\Greg\AppData\Roaming\TeamViewer
2009-08-18 13:54 . 2009-01-28 14:53	--------	d-----w-	c:\program files\MAGIX
2009-08-18 13:54 . 2009-01-28 14:53	--------	d-----w-	c:\programdata\MAGIX
2009-08-18 13:26 . 2009-08-18 13:26	--------	d-----w-	c:\users\Greg\AppData\Roaming\MAGIX
2009-08-17 14:34 . 2009-08-17 14:34	--------	d-----w-	c:\program files\LCP
2009-08-17 14:34 . 2009-08-17 14:34	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2009-08-14 17:07 . 2009-09-09 18:54	897608	----a-w-	c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 18:54	104960	----a-w-	c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 18:54	17920	----a-w-	c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 18:54	9728	----a-w-	c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 18:54	17920	----a-w-	c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 18:54	11264	----a-w-	c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 18:54	27136	----a-w-	c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 18:54	19968	----a-w-	c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 18:54	8704	----a-w-	c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 18:54	10240	----a-w-	c:\windows\system32\finger.exe
2009-08-09 17:49 . 2009-08-09 17:49	--------	d-----w-	c:\program files\Inno Setup 5
2009-08-09 17:10 . 2009-08-09 16:39	--------	d-----w-	c:\users\Greg\AppData\Roaming\Audacity
2009-08-09 15:06 . 2009-05-30 16:45	--------	d-----w-	c:\program files\Image-Line
2009-08-09 12:02 . 2009-03-08 14:11	--------	d-----w-	c:\program files\Notepad++
2009-08-05 09:49 . 2009-01-27 21:46	--------	d-----w-	c:\program files\Ulead Systems
2009-08-04 20:03 . 2009-08-04 20:03	--------	d-----w-	c:\program files\Camouflage
2009-08-01 12:47 . 2009-08-01 12:47	--------	d-----w-	c:\program files\AIST
2009-07-30 23:09 . 2009-07-30 23:09	--------	d-----w-	c:\program files\Bonjour
2009-07-30 23:09 . 2008-08-05 02:17	--------	d-----w-	c:\program files\Common Files\Adobe
2009-07-30 22:57 . 2009-07-30 22:57	--------	d-----w-	c:\program files\Common Files\Macrovision Shared
2009-07-30 21:40 . 2009-07-30 21:40	--------	d-----w-	c:\users\Greg\AppData\Roaming\Reallusion
2009-07-30 16:38 . 2009-07-30 16:38	--------	d-----w-	c:\users\Greg\AppData\Roaming\DivX
2009-07-30 16:30 . 2009-07-30 16:30	--------	d-----w-	c:\programdata\Pinnacle
2009-07-30 15:42 . 2009-07-30 15:42	--------	d-----w-	c:\programdata\InstallShield
2009-07-30 15:37 . 2008-08-05 00:37	--------	d-----w-	c:\program files\Common Files\InstallShield
2009-07-30 11:57 . 2009-01-27 21:46	--------	d-----w-	c:\programdata\Ulead Systems
2009-07-30 11:47 . 2009-07-30 11:47	--------	d-----w-	c:\program files\Common Files\InterVideo
2009-07-29 10:03 . 2008-11-14 22:05	--------	d-----w-	c:\users\Greg\AppData\Roaming\dvdcss
2009-07-27 18:02 . 2009-07-27 18:02	--------	d-----w-	c:\users\Greg\AppData\Roaming\Canneverbe_Limited
2009-07-27 16:50 . 2008-11-18 19:03	--------	d-----w-	c:\programdata\DVD Shrink
2009-07-22 20:14 . 2009-07-22 20:14	--------	d-----w-	c:\program files\PhotoZoom Pro 2
2009-07-22 13:34 . 2009-07-22 13:34	--------	d-----w-	c:\users\Greg\AppData\Roaming\FLV Extract
2009-07-22 12:16 . 2009-07-22 11:46	--------	d-----w-	c:\users\Greg\AppData\Roaming\FMZilla
2009-07-22 11:32 . 2009-07-12 21:51	87	----a-w-	c:\users\Greg\AppData\Local\iwiqyoq.bat
2009-07-21 21:52 . 2009-08-01 12:13	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-08-01 12:13	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-08-01 12:13	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-08-01 12:13	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-12 14:05	71680	----a-w-	c:\windows\system32\atl.dll
2009-07-14 13:00 . 2009-08-12 14:05	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-12 14:05	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-12 14:05	7680	----a-w-	c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-12 14:05	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-07-13 21:27 . 2009-07-13 21:27	380	----a-w-	c:\windows\system32\ppa_service.dat
2009-07-13 21:27 . 2009-07-13 21:27	43008	----a-w-	c:\windows\system32\ppa_service.dll
2009-07-13 21:27 . 2009-07-13 21:27	128000	----a-w-	c:\windows\system32\ppa_service.exe
2009-07-11 19:32 . 2009-09-09 18:54	293376	----a-w-	c:\windows\system32\wlanmsm.dll
2009-07-11 19:32 . 2009-09-09 18:54	302592	----a-w-	c:\windows\system32\wlansec.dll
2009-07-11 19:32 . 2009-09-09 18:54	513024	----a-w-	c:\windows\system32\wlansvc.dll
2009-07-11 19:29 . 2009-09-09 18:54	127488	----a-w-	c:\windows\system32\L2SecHC.dll
2008-08-05 10:04 . 2008-08-05 10:04	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2008-12-12 132392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-11 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-11 92704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-06-11 468264]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SWClient"="c:\program files\SoftActivity\AMSys\swsys.exe" [2008-04-10 700280]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-06-12 151552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-12-02 2221352]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\users\Greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Weezo.lnk - c:\program files\Weezo\bin\Weezo.exe [2009-7-18 2539520]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TrayMin230.lnk - c:\program files\Philips\Philips SPC230NC Webcam\TrayMin230.exe [2009-1-12 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\fsproflt]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F963AA7E-6D4D-44D8-BAEC-2599EDCC503C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{D6143534-FB01-462B-8C93-934AA5AB497C}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{DF4429FF-CA60-4BCD-BE18-123B43D9E6A7}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{7C3351CC-D292-4BF4-AC72-6798329A517B}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{A169C82C-ABAA-4A8C-B5A3-D4F2B9FE2C11}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath 
"UDP Query User{BAFDB7FE-FE92-4FB4-B6ED-41CF7EF7CA6B}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath 
"TCP Query User{C6594DD9-D4CB-4B2E-A90D-172E481F3EE3}c:\\program files\\thq\\pandemic studios\\full spectrum warrior\\launcher.exe"= UDP:c:\program files\thq\pandemic studios\full spectrum warrior\launcher.exe:Launcher
"UDP Query User{FAE35846-3D86-4C9B-87D3-0887ABEAED57}c:\\program files\\thq\\pandemic studios\\full spectrum warrior\\launcher.exe"= TCP:c:\program files\thq\pandemic studios\full spectrum warrior\launcher.exe:Launcher
"TCP Query User{531EF1FC-7C99-4A5B-9252-CD8518228B13}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{2D016EC7-96EB-4EA6-BD4C-1E56B375F18E}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{948AC0D1-FA47-4096-9A69-6FDD1B19BFEB}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{2F855F90-BDF6-442A-919D-F642653BBF57}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{BB67A055-812C-4DAF-8084-E8D898BE92DD}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{FC25A1B6-8B4D-473D-978A-73FA9CE418FA}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"TCP Query User{0F5B8806-F86B-4B1D-B03F-8E2FB0F5B170}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{CECB773A-545F-4055-932E-0F1073FE16BD}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{49EDD902-F067-4409-AE59-BE715D01D681}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{3500181A-8CC7-46A7-B952-2CFBA3E064F5}c:\\program files\\dc++\\dcplusplus.exe"= UDP:c:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{37F327DA-2EA7-4E40-AB33-CF7DEFA9E82D}c:\\program files\\dc++\\dcplusplus.exe"= TCP:c:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{0222D152-287E-4B0D-95C2-15F504DBD7B5}c:\\program files\\echanblard\\emule.exe"= UDP:c:\program files\echanblard\emule.exe:eMule
"UDP Query User{54AC250C-6105-46F9-8EC7-64A7B4EEC96F}c:\\program files\\echanblard\\emule.exe"= TCP:c:\program files\echanblard\emule.exe:eMule
"TCP Query User{5D7F9BD2-B04E-40FD-A4E3-C345EC13C32E}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{9E95ED95-9417-4468-BB76-AD3CD300C237}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{88FAFA8F-60A1-406B-B0A0-D92991ECF998}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{FB7BA1A2-ECFA-4FAB-BE87-F466306AFF61}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{2A0E2A00-8537-49B1-A236-2995505F63C6}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{3ED5DAB2-C978-4AAB-9CF2-2D0CFDE46E8E}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{5EAA0784-0AF4-4581-9CAF-A17BFFFA6216}c:\\program files\\america's army\\system\\armyops.exe"= UDP:c:\program files\america's army\system\armyops.exe:ArmyOps
"UDP Query User{90F29CC4-BACA-4706-9DE5-D42829AFE1A2}c:\\program files\\america's army\\system\\armyops.exe"= TCP:c:\program files\america's army\system\armyops.exe:ArmyOps
"TCP Query User{4D1B109E-8F3A-4D2B-BFDE-5D8EBCD3154B}c:\\program files\\softactivity\\activity monitor\\swatcher.exe"= UDP:c:\program files\softactivity\activity monitor\swatcher.exe:Activity Monitor
"UDP Query User{42D700CD-F1F6-4641-BCDF-491AEF8BE380}c:\\program files\\softactivity\\activity monitor\\swatcher.exe"= TCP:c:\program files\softactivity\activity monitor\swatcher.exe:Activity Monitor
"TCP Query User{79F01706-C4BD-4DF4-B6C6-8D90B16C8FA2}c:\\program files\\softactivity\\amsys\\swsys.exe"= UDP:c:\program files\softactivity\amsys\swsys.exe:SoftActivity AM Client
"UDP Query User{F8001B61-84E8-488E-8830-A6CBE778116E}c:\\program files\\softactivity\\amsys\\swsys.exe"= TCP:c:\program files\softactivity\amsys\swsys.exe:SoftActivity AM Client
"{6BB115DD-97CF-48E2-83B7-82839A6295AB}"= UDP:990:LocalSubnet:LocalSubnet|IF={A234C4A0-6EC5-4A22-B64C-238B457FB522}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"TCP Query User{08A14C54-FA03-4347-95CA-17CBA7809B10}c:\\program files\\sprite software\\sprite backup\\spriteservice.exe"= UDP:c:\program files\sprite software\sprite backup\spriteservice.exe:Sprite Backup PC Service
"UDP Query User{FFF240D9-D966-4E2F-AA05-A4EA636DC228}c:\\program files\\sprite software\\sprite backup\\spriteservice.exe"= TCP:c:\program files\sprite software\sprite backup\spriteservice.exe:Sprite Backup PC Service
"TCP Query User{9DD8186C-2B29-44B3-90EB-7F78332C5C8B}c:\\spn\\edt.exe"= UDP:c:\spn\edt.exe:edt
"UDP Query User{565CA6FF-D7FB-46D6-9B5A-B6E654DC5BCC}c:\\spn\\edt.exe"= TCP:c:\spn\edt.exe:edt
"TCP Query User{5374DF3F-D5C0-4628-AFB2-895CB32A068C}c:\\program files\\adsltv\\vlc.exe"= UDP:c:\program files\adsltv\vlc.exe:VLC media player
"UDP Query User{3B3AFA33-F56A-4BFF-8368-C36CBD4EFFD7}c:\\program files\\adsltv\\vlc.exe"= TCP:c:\program files\adsltv\vlc.exe:VLC media player
"{5AA817D0-2D51-4FF6-A2A4-125D2DAF9D3F}"= UDP:c:\program files\UltraVNC\vncviewer.exe:vncviewer.exe
"{FFB6356D-6373-4384-A23B-B590B95AE211}"= TCP:c:\program files\UltraVNC\vncviewer.exe:vncviewer.exe
"TCP Query User{3C562BD6-27B0-48AB-8526-F24553FC9E26}c:\\program files\\ultravnc\\winvnc.exe"= UDP:c:\program files\ultravnc\winvnc.exe:VNC server for Win32
"UDP Query User{D28FF048-DD2E-4B6F-8F01-E6FDD961DF0F}c:\\program files\\ultravnc\\winvnc.exe"= TCP:c:\program files\ultravnc\winvnc.exe:VNC server for Win32
"TCP Query User{59144353-C814-47B3-9B57-81A986630E88}c:\\program files\\elcomsoft\\distributed password recovery\\esdprs.exe"= UDP:c:\program files\elcomsoft\distributed password recovery\esdprs.exe:Elcomsoft Distributed Password Recovery Server
"UDP Query User{41856312-8E61-404C-A948-10E3451E1951}c:\\program files\\elcomsoft\\distributed password recovery\\esdprs.exe"= TCP:c:\program files\elcomsoft\distributed password recovery\esdprs.exe:Elcomsoft Distributed Password Recovery Server
"TCP Query User{640068C9-A3AB-405F-84A0-7848F11865D2}c:\\program files\\argus surveillance dvr\\webserverforadmin.exe"= UDP:c:\program files\argus surveillance dvr\webserverforadmin.exe:WebServerForAdmin
"UDP Query User{0A459837-292D-4CD1-804C-B42A0E4BC929}c:\\program files\\argus surveillance dvr\\webserverforadmin.exe"= TCP:c:\program files\argus surveillance dvr\webserverforadmin.exe:WebServerForAdmin
"TCP Query User{132C5A8B-8C27-4745-BC10-A7FFB0F8F4E7}c:\\video surveillance facile\\vds.exe"= UDP:c:\video surveillance facile\vds.exe:Vds
"UDP Query User{1339C923-762C-4C7A-96D3-346AA9EC44C6}c:\\video surveillance facile\\vds.exe"= TCP:c:\video surveillance facile\vds.exe:Vds
"TCP Query User{60FDA769-DC00-4BE8-B010-8AB942409AF6}c:\\vdp\\vdp.exe"= UDP:c:\vdp\vdp.exe:Video surveillance PRO 2008
"UDP Query User{07E5FC6A-1314-4407-AD44-EAD25F55A845}c:\\vdp\\vdp.exe"= TCP:c:\vdp\vdp.exe:Video surveillance PRO 2008
"TCP Query User{F4D92CEF-99C8-4A72-931F-437511BCBBC9}c:\\program files\\wyzo\\wyzo.exe"= UDP:c:\program files\wyzo\wyzo.exe:Wyzo
"UDP Query User{BE6672A2-F81D-4149-9CC1-177623D0B634}c:\\program files\\wyzo\\wyzo.exe"= TCP:c:\program files\wyzo\wyzo.exe:Wyzo
"{1E9D18BF-FF4B-4948-8314-4CDB3E4BD0AE}"= UDP:80:port
"TCP Query User{D20C2D94-3308-49D7-8183-E907E1340D61}c:\\program files\\g6 ftp server\\g6ftpsrv.exe"= UDP:c:\program files\g6 ftp server\g6ftpsrv.exe:BPFTP Server for Internet.
"UDP Query User{FC1A5FBC-5D7E-4E5F-96CA-EB7FFB512816}c:\\program files\\g6 ftp server\\g6ftpsrv.exe"= TCP:c:\program files\g6 ftp server\g6ftpsrv.exe:BPFTP Server for Internet.
"TCP Query User{44474AAE-3B8B-4EEB-949E-7D97DDB2A680}c:\\program files\\bearflix\\bearflix.exe"= Disabled:UDP:c:\program files\bearflix\bearflix.exe:BearFlix
"UDP Query User{358A0BB9-E8FF-4599-8E2E-DA6EC0643110}c:\\program files\\bearflix\\bearflix.exe"= Disabled:TCP:c:\program files\bearflix\bearflix.exe:BearFlix
"{BC981857-89D5-4025-97E1-06F621AEC10F}"= UDP:21:ftp
"TCP Query User{9FAD14BE-03DF-49A1-AA00-247AF04BAD99}c:\\users\\greg\\downloads\\ftpservfr.exe"= UDP:c:\users\greg\downloads\ftpservfr.exe:ftpservfr.exe
"UDP Query User{843984B3-1896-46D8-90F7-3A68DD37A025}c:\\users\\greg\\downloads\\ftpservfr.exe"= TCP:c:\users\greg\downloads\ftpservfr.exe:ftpservfr.exe
"TCP Query User{05D6C3C8-80E1-43FC-BFEC-497FF589C499}c:\\program files\\bpftp server\\bpftpserver.exe"= UDP:c:\program files\bpftp server\bpftpserver.exe:BulletProof FTP Server (http://www.bpftpserver.com)
"UDP Query User{00D844C3-7C33-4641-9058-60CF2A6D0F1E}c:\\program files\\bpftp server\\bpftpserver.exe"= TCP:c:\program files\bpftp server\bpftpserver.exe:BulletProof FTP Server (http://www.bpftpserver.com)
"TCP Query User{6F3CB18E-05B0-42A7-B379-01AB1F57009E}c:\\program files\\wlite\\wlite.exe"= UDP:c:\program files\wlite\wlite.exe:webcamXP
"UDP Query User{DBA62A59-F53A-4D23-A5DB-7CE2AE903AF4}c:\\program files\\wlite\\wlite.exe"= TCP:c:\program files\wlite\wlite.exe:webcamXP
"TCP Query User{90911E78-ABD4-479D-857D-3F05C15D7F10}c:\\users\\greg\\downloads\\[filzup.com]programmes\\programmes\\trojans\\bifrost\\bifrost.exe"= UDP:c:\users\greg\downloads\[filzup.com]programmes\programmes\trojans\bifrost\bifrost.exe:bifrost.exe
"UDP Query User{26D43F30-6C88-4558-BA02-940BE3754D98}c:\\users\\greg\\downloads\\[filzup.com]programmes\\programmes\\trojans\\bifrost\\bifrost.exe"= TCP:c:\users\greg\downloads\[filzup.com]programmes\programmes\trojans\bifrost\bifrost.exe:bifrost.exe
"TCP Query User{1051C072-D9C9-4CD8-96C0-43527FAB1B63}c:\\users\\greg\\downloads\\archive install\\setup.exe"= UDP:c:\users\greg\downloads\archive install\setup.exe:setup.exe
"UDP Query User{B6A2BF2C-DBF2-417B-85BD-2E2C9B3F956C}c:\\users\\greg\\downloads\\archive install\\setup.exe"= TCP:c:\users\greg\downloads\archive install\setup.exe:setup.exe
"TCP Query User{4D286753-9EDC-41B7-90AD-1714E8A62164}c:\\users\\greg\\documents\\[filzup.com]programmes\\programmes\\trojans\\bifrost\\bifrost.exe"= UDP:c:\users\greg\documents\[filzup.com]programmes\programmes\trojans\bifrost\bifrost.exe:bifrost.exe
"UDP Query User{B5356EED-E381-45E5-9CEC-ED87246EFCFD}c:\\users\\greg\\documents\\[filzup.com]programmes\\programmes\\trojans\\bifrost\\bifrost.exe"= TCP:c:\users\greg\documents\[filzup.com]programmes\programmes\trojans\bifrost\bifrost.exe:bifrost.exe
"TCP Query User{A7304C66-51EA-480A-A39E-2FCBF038F48E}c:\\users\\greg\\documents\\[filzup.com]programmes\\programmes\\trojans\\turkojan\\client.exe"= UDP:c:\users\greg\documents\[filzup.com]programmes\programmes\trojans\turkojan\client.exe:client.exe
"UDP Query User{6889E848-514D-4ADE-AD83-3C2A26CEAF72}c:\\users\\greg\\documents\\[filzup.com]programmes\\programmes\\trojans\\turkojan\\client.exe"= TCP:c:\users\greg\documents\[filzup.com]programmes\programmes\trojans\turkojan\client.exe:client.exe
"TCP Query User{93DAA426-F9B8-4530-97AF-E2686DFAC7ED}c:\\users\\greg\\documents\\[filzup.com]programmes\\programmes\\trojans\\poisson\\poison ivy 2.3.2.exe"= UDP:c:\users\greg\documents\[filzup.com]programmes\programmes\trojans\poisson\poison ivy 2.3.2.exe:poison ivy 2.3.2.exe
"UDP Query User{0E6119B4-4261-49D7-A003-38FA9F0CA056}c:\\users\\greg\\documents\\[filzup.com]programmes\\programmes\\trojans\\poisson\\poison ivy 2.3.2.exe"= TCP:c:\users\greg\documents\[filzup.com]programmes\programmes\trojans\poisson\poison ivy 2.3.2.exe:poison ivy 2.3.2.exe
"TCP Query User{901D67FC-5984-40B8-8BBB-297555A65468}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{0A48B3AB-E422-4775-A27B-DB86D98ECCB9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{FB0268BE-EAC0-42C0-B43A-477A0968F69D}c:\\program files\\zattoo\\zattood.exe"= UDP:c:\program files\zattoo\zattood.exe:zattood
"UDP Query User{182E1CB6-CC4F-48BD-AB9F-67FA2F89C01B}c:\\program files\\zattoo\\zattood.exe"= TCP:c:\program files\zattoo\zattood.exe:zattood
"{0178FDD4-FF83-4D72-9EE5-5C1AB446ABD9}"= UDP:c:\program files\FrostWire\FrostWire.exe:FrostWire
"{437493DE-F46F-4B0B-BC0A-EEF90D28FA9F}"= TCP:c:\program files\FrostWire\FrostWire.exe:FrostWire
"TCP Query User{77BD888F-BF9B-4CB2-AD7C-4FFF2F5E8BF2}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{385BF15A-4AD4-470E-AF90-6CFC969F8517}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"TCP Query User{18EBDD1E-29B4-413F-85E9-0AC7819574D9}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{21DD64D9-BF0D-4DF3-93AF-973F440FC3D3}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{2AD340F6-C8EA-4DFE-BD4D-5DE2EF620F2F}c:\\program files\\cain\\cain.exe"= UDP:c:\program files\cain\cain.exe:Cain - Password Recovery Utility
"UDP Query User{BDB7E093-BEE4-429E-A2B8-668ED887324B}c:\\program files\\cain\\cain.exe"= TCP:c:\program files\cain\cain.exe:Cain - Password Recovery Utility
"TCP Query User{7C91CB90-55B1-44DF-890E-05458A903758}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{209D32BA-16F5-4F50-9148-16BF3E6FEF27}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{CA7A4F22-5651-4006-9E19-924D65611B54}c:\\users\\greg\\downloads\\mysql-noinstall-5.1.36-win32\\mysql-5.1.36-win32\\bin\\mysqld.exe"= UDP:c:\users\greg\downloads\mysql-noinstall-5.1.36-win32\mysql-5.1.36-win32\bin\mysqld.exe:mysqld.exe
"UDP Query User{E17F9B82-37F5-43EE-9448-099167298AB7}c:\\users\\greg\\downloads\\mysql-noinstall-5.1.36-win32\\mysql-5.1.36-win32\\bin\\mysqld.exe"= TCP:c:\users\greg\downloads\mysql-noinstall-5.1.36-win32\mysql-5.1.36-win32\bin\mysqld.exe:mysqld.exe
"TCP Query User{039176B2-3250-409F-A32A-C696F1836C69}c:\\program files\\java\\jre1.6.0_07\\bin\\javaw.exe"= UDP:c:\program files\java\jre1.6.0_07\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{C1A56A74-EFB4-4B81-8D1F-BDD33B2F0E58}c:\\program files\\java\\jre1.6.0_07\\bin\\javaw.exe"= TCP:c:\program files\java\jre1.6.0_07\bin\javaw.exe:Java(TM) Platform SE binary
"TCP Query User{EFD8F289-5232-4E75-AB37-9872A3DD2B65}c:\\windows\\system32\\javaw.exe"= UDP:c:\windows\system32\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{BAB3168D-D14E-46D2-8869-41553140F0DC}c:\\windows\\system32\\javaw.exe"= TCP:c:\windows\system32\javaw.exe:Java(TM) Platform SE binary
"{0A4BC2EA-1924-435D-B0AB-F2961BE114C5}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{976F2D46-40B9-4AD7-9FC9-0CE28E078BAF}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{FF49C566-8392-42BB-B110-0878ED86F864}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{6C23F541-E208-4E7C-8F55-E1A32C833D4C}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{07C57568-997C-4517-8038-AE3ED10B30F3}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{B449CAA1-6EE5-4BCB-B1EB-9D5D64BECF13}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"TCP Query User{84B97C2A-B4A2-42D5-BFF7-C5048BB7CADD}c:\\windows\\system32\\ftp.exe"= UDP:c:\windows\system32\ftp.exe:Logiciel de transfert de fichiers
"UDP Query User{A03C8E52-5A1E-4F22-AF89-53E858ABCD60}c:\\windows\\system32\\ftp.exe"= TCP:c:\windows\system32\ftp.exe:Logiciel de transfert de fichiers
"TCP Query User{EA3E3677-14CE-486D-A9E6-DE88AE845736}c:\\program files\\bulletproof_ftp_server___crack\\bpftpserver.exe"= UDP:c:\program files\bulletproof_ftp_server___crack\bpftpserver.exe:BulletProof FTP Server (http://www.bpftpserver.com)
"UDP Query User{7E00D5A0-D695-46D2-9217-BDFECD48B3BB}c:\\program files\\bulletproof_ftp_server___crack\\bpftpserver.exe"= TCP:c:\program files\bulletproof_ftp_server___crack\bpftpserver.exe:BulletProof FTP Server (http://www.bpftpserver.com)
"TCP Query User{A5ABC467-BE80-4A8C-8066-E7CDB66CB573}c:\\program files\\bulletproof_ftp_server___crack\\bpftpserver.exe"= UDP:c:\program files\bulletproof_ftp_server___crack\bpftpserver.exe:BulletProof FTP Server (http://www.bpftpserver.com)
"UDP Query User{111806AF-BA09-4347-A204-217FA8E60D22}c:\\program files\\bulletproof_ftp_server___crack\\bpftpserver.exe"= TCP:c:\program files\bulletproof_ftp_server___crack\bpftpserver.exe:BulletProof FTP Server (http://www.bpftpserver.com)
"TCP Query User{B19F1492-A872-43D5-8DC9-D71C7DEB565A}c:\\users\\greg\\temp\\teamviewer\\version4\\teamviewer.exe"= UDP:c:\users\greg\temp\teamviewer\version4\teamviewer.exe:teamviewer.exe
"UDP Query User{8E168617-ADA3-4307-BFAA-E82E4FB8E462}c:\\users\\greg\\temp\\teamviewer\\version4\\teamviewer.exe"= TCP:c:\users\greg\temp\teamviewer\version4\teamviewer.exe:teamviewer.exe
"TCP Query User{CB508FFF-179B-449B-BEB7-49E113F195F0}c:\\users\\greg\\documents\\mes fichiers reçus\\teamviewerportable_fr\\teamviewer.exe"= UDP:c:\users\greg\documents\mes fichiers reçus\teamviewerportable_fr\teamviewer.exe:teamviewer.exe
"UDP Query User{C86142FC-BD50-4494-890F-77C6FEB4B174}c:\\users\\greg\\documents\\mes fichiers reçus\\teamviewerportable_fr\\teamviewer.exe"= TCP:c:\users\greg\documents\mes fichiers reçus\teamviewerportable_fr\teamviewer.exe:teamviewer.exe
"TCP Query User{7D5B13DC-12A2-4895-8C80-4C0D9097D1B6}c:\\program files\\autokrypt8\\jre\\bin\\javaw.exe"= UDP:c:\program files\autokrypt8\jre\bin\javaw.exe:javaw
"UDP Query User{D4C8AF06-83C3-4999-B19E-6C7DF9E971B6}c:\\program files\\autokrypt8\\jre\\bin\\javaw.exe"= TCP:c:\program files\autokrypt8\jre\bin\javaw.exe:javaw
"TCP Query User{8F6FB126-3ABB-4C7E-8D55-43D4D8F388AD}c:\\users\\greg\\desktop\\apps\\portableemule\\emule\\emule.exe"= UDP:c:\users\greg\desktop\apps\portableemule\emule\emule.exe:emule.exe
"UDP Query User{BB1001D1-21A2-4D9C-8DF6-CDD6E911AAFE}c:\\users\\greg\\desktop\\apps\\portableemule\\emule\\emule.exe"= TCP:c:\users\greg\desktop\apps\portableemule\emule\emule.exe:emule.exe
"TCP Query User{A784CC4E-A7CF-4E23-8D9C-EFB221CF5D95}c:\\program files\\amsn\\bin\\wish.exe"= UDP:c:\program files\amsn\bin\wish.exe:Wish Application
"UDP Query User{88F566A0-D129-4F02-AE57-0484B49653FB}c:\\program files\\amsn\\bin\\wish.exe"= TCP:c:\program files\amsn\bin\wish.exe:Wish Application
"TCP Query User{DD333DD8-7EDF-4173-88C6-B89EAC6B76CD}c:\\users\\greg\\desktop\\amsnportable\\app\\amsn\\bin\\wish.exe"= UDP:c:\users\greg\desktop\amsnportable\app\amsn\bin\wish.exe:wish.exe
"UDP Query User{22FD2C94-1CF5-45ED-9DA3-DB4342FE7D11}c:\\users\\greg\\desktop\\amsnportable\\app\\amsn\\bin\\wish.exe"= TCP:c:\users\greg\desktop\amsnportable\app\amsn\bin\wish.exe:wish.exe
"TCP Query User{7B700C84-A49A-45DD-8848-9DD806ED92EB}c:\\users\\greg\\desktop\\programmes\\personnel\\amsnportable\\app\\amsn\\bin\\wish.exe"= UDP:c:\users\greg\desktop\programmes\personnel\amsnportable\app\amsn\bin\wish.exe:wish.exe
"UDP Query User{E0BA7D8A-73BE-406F-B933-36312B603BA2}c:\\users\\greg\\desktop\\programmes\\personnel\\amsnportable\\app\\amsn\\bin\\wish.exe"= TCP:c:\users\greg\desktop\programmes\personnel\amsnportable\app\amsn\bin\wish.exe:wish.exe
"TCP Query User{54307644-7504-4325-A997-71DF96858F2B}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{594B2354-4959-4108-88CF-75A43330EA71}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
"{E297756B-1506-4E96-8195-A6F5880163C9}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{899F11BF-B421-463D-86BA-AB0683457774}"= UDP:c:\program files\Weezo\Apache\bin\weezoHttpd.exe:Weezo HTTP Server
"{C39CD69F-7037-4E49-94A5-B1E79869FCC3}"= TCP:c:\program files\Weezo\Apache\bin\weezoHttpd.exe:Weezo HTTP Server

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [28/08/2009 14:37 114768]
R1 hdbga;hdbga;c:\windows\System32\drivers\hdbga.sys [01/11/2007 17:50 194848]
R1 HMFAxCore8ca4fd17866cac11805503e882557762;HMFAxCore8ca4fd17866cac11805503e882557762;c:\windows\System32\drivers\HMFAxCore8ca4fd17866cac11805503e882557762.sys [08/06/2009 11:41 22304]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [28/08/2009 14:37 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [28/08/2009 14:36 53328]
R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 04:33 21504]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [05/08/2008 04:36 361808]
R3 SAgentDriver;SAgent Driver;c:\program files\SoftActivity\AMSys\sagendrv.sys [01/02/2009 17:49 31312]
S3 LcAgent;LC Remote Agent;c:\windows\Temp\lcagent.exe --> c:\windows\Temp\lcagent.exe [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [06/11/2007 22:22 34064]
S3 PAEAFLT.sys;USB Composite Device;c:\windows\System32\drivers\PAEAFLT.sys [12/01/2009 12:20 8576]
S3 SPC230NC;Philips SPC230NC Webcam;c:\windows\System32\drivers\SPC230NC.SYS [12/01/2009 12:20 461056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'
.
.
------- Examen supplémentaire -------
.
mWindow Title = 
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxp://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\9uthopxu.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox
FF - component: c:\users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\9uthopxu.default\extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}\components\mpint.dll
FF - plugin: c:\program files\adslTV\npvlc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
 
 
 
 
 
 
 
FF - user.js: keyword.enabled - true
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?t=Web&k=");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-19 18:21
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 


c:\windows\TEMP\TMP000000745B0A906F8657E168 524288 bytes executable
C:\sccfg.sys 86 bytes

Scan terminé avec succès
Fichiers cachés: 2

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-09-19 18:25
ComboFix-quarantined-files.txt  2009-09-19 16:25

Avant-CF: 61 352 484 864 octets libres
Après-CF: 66 962 366 464 octets libres

426	--- E O F ---	2009-09-17 20:01

Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared	4.5.0.24	2009.09.20	-
AhnLab-V3	5.0.0.2	2009.09.19	-
AntiVir	7.9.1.19	2009.09.18	TR/Crypt.XPACK.Gen
Antiy-AVL	2.0.3.7	2009.09.18	-
Authentium	5.1.2.4	2009.09.19	W32/SuspPack.AA.gen!Eldorado
Avast	4.8.1351.0	2009.09.19	-
AVG	8.5.0.412	2009.09.20	Corrupted
BitDefender	7.2	2009.09.20	-
CAT-QuickHeal	10.00	2009.09.19	Trojan.Agent.ATV
ClamAV	0.94.1	2009.09.19	-
Comodo	2379	2009.09.20	-
DrWeb	5.0.0.12182	2009.09.20	-
eSafe	7.0.17.0	2009.09.17	-
eTrust-Vet	31.6.6746	2009.09.18	-
F-Prot	4.5.1.85	2009.09.19	W32/SuspPack.AA.gen!Eldorado
F-Secure	8.0.14470.0	2009.09.20	-
Fortinet	3.120.0.0	2009.09.19	-
GData	19	2009.09.20	-
Ikarus	T3.1.1.72.0	2009.09.20	-
Jiangmin	11.0.800	2009.09.20	Rootkit.Agent.bxo
K7AntiVirus	7.10.849	2009.09.19	-
Kaspersky	7.0.0.125	2009.09.20	-
McAfee	5746	2009.09.19	New Malware.b
McAfee+Artemis	5746	2009.09.19	Suspect-29!03BE6242C933
McAfee-GW-Edition	6.8.5	2009.09.20	Trojan.Crypt.XPACK.Gen
Microsoft	1.5005	2009.09.20	-
NOD32	4441	2009.09.19	-
Norman	6.01.09	2009.09.18	-
nProtect	2009.1.8.0	2009.09.20	-
Panda	10.0.2.2	2009.09.20	-
PCTools	4.4.2.0	2009.09.19	-
Prevx	3.0	2009.09.20	High Risk Rootkit
Rising	21.47.62.00	2009.09.20	-
Sophos	4.45.0	2009.09.20	-
Sunbelt	3.2.1858.2	2009.09.19	-
Symantec	1.4.4.12	2009.09.20	-
TheHacker	6.5.0.2.012	2009.09.18	Trojan/OnLineGames.saxh
TrendMicro	8.950.0.1094	2009.09.20	-
VBA32	3.12.10.10	2009.09.20	-
ViRobot	2009.9.18.1943	2009.09.18	-
VirusBuster	4.6.5.0	2009.09.19	-
Information additionnelle
File size: 194848 bytes
MD5...: 03be6242c933e943ad3136de8be3b028
SHA1..: b6ee8f6c73119cb6561c9e963496a2c905a83e30
SHA256: 1855e4e23f1b4dbb7defd033eb7da89c3865b5e16713c453d91cf54300da58b6
ssdeep: 3072:Sy7biI9BIzUydVImgJ9FenbD/zY9TBfIPj6NJpIn:SoiIgdVwxenn09TBg6
JIn
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1c0
timedatestamp.....: 0x477a0000 (Tue Jan 01 08:55:28 2008)
machinetype.......: 0x14c (I386)

( 1 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1c0 0x5 0x40 4.55 f56de6b82d12b896287855b2eaee2f73

( 0 imports )

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=48EA418F2050EDCEF969023C57159700E4E7BFA6' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=48EA418F2050EDCEF969023C57159700E4E7BFA6</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Logfile of random's system information tool 1.06 (written by random/random)
Run by Greg at 2009-09-20 16:48:25
Microsoft® Windows Vista™ Édition Familiale Basique  Service Pack 1
System drive C: has 64 GB (28%) free of 230 GB
Total RAM: 2814 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:48:30, on 20/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\Philips\SPC230NC\Monitor.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Sprite Software\Sprite Backup\SpriteService.exe
C:\Program Files\Philips\Philips SPC230NC Webcam\TrayMin230.exe
C:\Program Files\Weezo\bin\Weezo.exe
C:\Program Files\Weezo\Apache\bin\weezoHttpd.exe
C:\Program Files\Weezo\Apache\bin\weezoHttpd.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Greg\Documents\HACK\Désinfection pc\RSIT.exe
C:\Program Files\trend micro\Greg.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SPC230NC_Monitor] C:\Windows\Philips\SPC230NC\Monitor.exe
O4 - HKLM\..\Run: [SPC_Monitor] C:\Windows\Philips\SPC230NC\Monitor.exe
O4 - HKLM\..\Run: [SWClient] C:\Program Files\SoftActivity\AMSys\swsys.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpriteService] "C:\Program Files\Sprite Software\Sprite Backup\SpriteService.exe"
O4 - Startup: Weezo.lnk = C:\Program Files\Weezo\bin\Weezo.exe
O4 - Global Startup: TrayMin230.lnk = C:\Program Files\Philips\Philips SPC230NC Webcam\TrayMin230.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - http://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LC Remote Agent (LcAgent) - Unknown owner - C:\Windows\Temp\lcagent.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8792 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-07-11 13543968]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-07-11 92704]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-04-17 1049896]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2008-06-11 468264]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2008-03-14 202032]
"HP Health Check Scheduler"=c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15 70912]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2008-04-15 488752]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"SPC230NC_Monitor"=C:\Windows\Philips\SPC230NC\Monitor.exe [2007-12-10 323584]
"SPC_Monitor"=C:\Windows\Philips\SPC230NC\Monitor.exe [2007-12-10 323584]
"SWClient"=C:\Program Files\SoftActivity\AMSys\swsys.exe [2008-04-10 700280]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
"NeroCheck"=C:\Windows\system32\NeroCheck.exe [2001-06-12 151552]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-08-17 81000]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-12-02 2221352]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [2008-12-12 132392]
"SpriteService"=C:\Program Files\Sprite Software\Sprite Backup\SpriteService.exe [2006-08-15 544768]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
TrayMin230.lnk - C:\Program Files\Philips\Philips SPC230NC Webcam\TrayMin230.exe

C:\Users\Greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Weezo.lnk - C:\Program Files\Weezo\bin\Weezo.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\fsproflt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fsproflt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"FilterAdministratorToken"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149
"NoLogOff"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2009-09-20 14:31:25 ----A---- C:\ComboFix.txt
2009-09-20 14:23:24 ----D---- C:\$RECYCLE.BIN
2009-09-20 14:20:33 ----D---- C:\Windows\temp
2009-09-20 00:22:32 ----D---- C:\Program Files\Sprite Software
2009-09-20 00:00:47 ----D---- C:\Program Files\Ressources Windows Mobile
2009-09-19 23:20:48 ----D---- C:\Program Files\Safari
2009-09-19 18:04:18 ----A---- C:\Windows\zip.exe
2009-09-19 18:04:18 ----A---- C:\Windows\SWXCACLS.exe
2009-09-19 18:04:18 ----A---- C:\Windows\SWSC.exe
2009-09-19 18:04:18 ----A---- C:\Windows\SWREG.exe
2009-09-19 18:04:18 ----A---- C:\Windows\sed.exe
2009-09-19 18:04:18 ----A---- C:\Windows\PEV.exe
2009-09-19 18:04:18 ----A---- C:\Windows\NIRCMD.exe
2009-09-19 18:04:18 ----A---- C:\Windows\grep.exe
2009-09-19 18:04:09 ----D---- C:\Windows\ERDNT
2009-09-19 18:03:22 ----D---- C:\Qoobox
2009-09-19 14:19:50 ----D---- C:\Users\Greg\AppData\Roaming\Malwarebytes
2009-09-19 14:19:44 ----D---- C:\ProgramData\Malwarebytes
2009-09-19 14:19:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-19 10:04:20 ----D---- C:\Program Files\Ad-Remover
2009-09-18 22:48:42 ----A---- C:\cleannavi.txt
2009-09-18 22:48:10 ----D---- C:\Program Files\Navilog1
2009-09-18 20:05:35 ----A---- C:\TB.txt
2009-09-18 20:04:52 ----D---- C:\ToolBar SD
2009-09-17 22:29:44 ----A---- C:\Windows\NeroDigital.ini
2009-09-17 22:11:34 ----D---- C:\Program Files\trend micro
2009-09-17 22:11:33 ----D---- C:\rsit
2009-09-14 21:21:12 ----D---- C:\Program Files\Files-Sauvegarde
2009-09-12 17:17:50 ----D---- C:\Program Files\Microsoft Visual Studio
2009-09-12 17:17:50 ----D---- C:\Program Files\Common Files\DESIGNER
2009-09-12 17:17:19 ----D---- C:\Program Files\Microsoft.NET
2009-09-12 17:14:46 ----D---- C:\Windows\SHELLNEW
2009-09-12 17:12:33 ----RD---- C:\MSOCache
2009-09-12 16:20:46 ----D---- C:\Program Files\QCMPackageLite FRA
2009-09-12 16:11:50 ----D---- C:\Program Files\QCM
2009-09-12 15:04:22 ----D---- C:\Program Files\Questy
2009-09-11 21:26:43 ----D---- C:\Program Files\Mattgo27 Apps
2009-09-09 21:00:20 ----D---- C:\Program Files\nLite
2009-09-09 20:55:14 ----A---- C:\Windows\system32\jscript.dll
2009-09-09 20:54:50 ----A---- C:\Windows\system32\netiohlp.dll
2009-09-09 20:54:49 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-09-09 20:54:49 ----A---- C:\Windows\system32\ROUTE.EXE
2009-09-09 20:54:49 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-09-09 20:54:49 ----A---- C:\Windows\system32\netevent.dll
2009-09-09 20:54:49 ----A---- C:\Windows\system32\MRINFO.EXE
2009-09-09 20:54:49 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-09-09 20:54:49 ----A---- C:\Windows\system32\finger.exe
2009-09-09 20:54:49 ----A---- C:\Windows\system32\ARP.EXE
2009-09-09 20:54:21 ----A---- C:\Windows\system32\wlanmsm.dll
2009-09-09 20:54:20 ----A---- C:\Windows\system32\L2SecHC.dll
2009-09-09 20:54:18 ----A---- C:\Windows\system32\wlansec.dll
2009-09-09 20:54:16 ----A---- C:\Windows\system32\wlansvc.dll
2009-09-09 20:53:58 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-09-09 20:53:58 ----A---- C:\Windows\system32\mf.dll
2009-09-07 17:52:39 ----A---- C:\Windows\system32\MsiExec.exe.log
2009-09-07 16:58:13 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-09-07 16:58:11 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-08-31 12:34:47 ----D---- C:\Users\Greg\AppData\Roaming\Opera
2009-08-31 12:34:30 ----D---- C:\Program Files\Opera
2009-08-30 23:47:39 ----D---- C:\Users\Greg\AppData\Roaming\AchrafCherti
2009-08-30 12:22:32 ----D---- C:\Program Files\FileZilla FTP Client
2009-08-30 12:22:01 ----D---- C:\Program Files\loliwin
2009-08-30 12:06:17 ----D---- C:\Users\Greg\AppData\Roaming\K-Meleon
2009-08-30 03:01:53 ----D---- C:\Windows\CheckSur
2009-08-29 22:45:36 ----D---- C:\Mes Sites Web
2009-08-29 22:35:59 ----D---- C:\LiberKey
2009-08-29 22:13:17 ----D---- C:\Users\Greg\AppData\Roaming\MfcEmbed
2009-08-28 17:32:49 ----D---- C:\Users\Greg\AppData\Roaming\KeePass
2009-08-28 14:36:38 ----A---- C:\Windows\system32\aswBoot.exe
2009-08-28 12:07:10 ----D---- C:\Program Files\CCleaner
2009-08-28 03:08:06 ----D---- C:\Program Files\FlashCrypt
2009-08-28 02:43:26 ----D---- C:\Users\Greg\AppData\Roaming\gnupg
2009-08-28 02:42:50 ----D---- C:\Program Files\AutoKrypt8
2009-08-28 02:26:14 ----HD---- C:\Windows\ffpext
2009-08-28 02:26:14 ----D---- C:\Program Files\File and Folder Protector
2009-08-28 02:16:36 ----D---- C:\SafeHouse
2009-08-28 02:16:36 ----D---- C:\Program Files\SafeHouse Explorer
2009-08-28 01:31:51 ----A---- C:\Windows\system32\fsproflt.exe
2009-08-27 22:58:40 ----A---- C:\Windows\system32\suppdll.dll
2009-08-27 22:58:40 ----A---- C:\Windows\system32\FLKill.exe
2009-08-27 22:58:38 ----D---- C:\Program Files\Folder Lock
2009-08-27 20:18:22 ----D---- C:\Program Files\Universal Shield 4.3
2009-08-27 18:39:36 ----A---- C:\Windows\system32\Crk_Sarkophage.exe
2009-08-27 18:14:48 ----A---- C:\Windows\system32\srksrv.exe
2009-08-27 18:12:00 ----A---- C:\Windows\system32\Sarkophage.exe
2009-08-27 18:11:59 ----D---- C:\Program Files\Sarkophage
2009-08-27 13:36:48 ----D---- C:\Program Files\Audacity
2009-08-27 12:43:37 ----A---- C:\Windows\system32\tzres.dll
2009-08-27 00:40:58 ----D---- C:\Users\Greg\AppData\Roaming\DeepBurner Pro
2009-08-27 00:24:42 ----A---- C:\Windows\winfile.ini
2009-08-27 00:23:07 ----D---- C:\Program Files\WinZip
2009-08-27 00:07:10 ----D---- C:\Program Files\1toX

======List of files/folders modified in the last 1 months======

2009-09-20 14:31:29 ----D---- C:\Windows\system32\fr-FR
2009-09-20 14:31:29 ----D---- C:\Windows\system32\drivers
2009-09-20 14:31:29 ----D---- C:\Windows\System32
2009-09-20 14:31:28 ----RD---- C:\Users
2009-09-20 14:23:58 ----D---- C:\Windows
2009-09-20 14:23:58 ----A---- C:\Windows\system.ini
2009-09-20 14:22:37 ----D---- C:\Windows\WindowsMobile
2009-09-20 14:21:07 ----D---- C:\Windows\system32\config
2009-09-20 14:14:00 ----D---- C:\Windows\AppPatch
2009-09-20 14:13:57 ----D---- C:\Program Files\Common Files
2009-09-20 14:05:29 ----D---- C:\Windows\system32\catroot2
2009-09-20 13:53:37 ----D---- C:\Windows\inf
2009-09-20 13:53:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-09-20 13:06:10 ----SHD---- C:\System Volume Information
2009-09-20 11:53:05 ----SD---- C:\Users\Greg\AppData\Roaming\Microsoft
2009-09-20 11:36:06 ----SHD---- C:\Windows\Installer
2009-09-20 11:35:16 ----D---- C:\Windows\system32\LogFiles
2009-09-20 11:31:02 ----RD---- C:\Program Files
2009-09-20 11:31:02 ----D---- C:\ProgramData
2009-09-20 11:30:59 ----SD---- C:\Windows\Downloaded Program Files
2009-09-20 00:17:21 ----D---- C:\Program Files\Mozilla Firefox
2009-09-20 00:04:46 ----D---- C:\Windows\system32\catroot
2009-09-19 23:32:57 ----D---- C:\Users\Greg\AppData\Roaming\Apple Computer
2009-09-19 23:20:24 ----D---- C:\Program Files\Bonjour
2009-09-19 21:24:28 ----D---- C:\Windows\Prefetch
2009-09-19 18:24:00 ----D---- C:\Windows\Tasks
2009-09-19 17:35:25 ----D---- C:\Program Files\eChanblard
2009-09-17 22:07:34 ----D---- C:\ProgramData\NVIDIA
2009-09-15 19:57:22 ----D---- C:\Program Files\adslTV
2009-09-14 17:35:54 ----D---- C:\ProgramData\Microsoft Help
2009-09-12 17:19:35 ----RSD---- C:\Windows\assembly
2009-09-12 17:18:21 ----D---- C:\Program Files\Microsoft Works
2009-09-12 17:18:16 ----D---- C:\Program Files\Common Files\microsoft shared
2009-09-12 17:17:59 ----D---- C:\Program Files\Microsoft Office
2009-09-12 17:17:28 ----RSD---- C:\Windows\Fonts
2009-09-12 17:15:03 ----A---- C:\Windows\win.ini
2009-09-12 17:14:59 ----D---- C:\Program Files\Common Files\System
2009-09-12 16:57:23 ----D---- C:\Program Files\WinRAR
2009-09-12 11:39:39 ----D---- C:\Windows\rescache
2009-09-10 22:48:35 ----D---- C:\Windows\winsxs
2009-09-10 22:37:28 ----D---- C:\Program Files\Microsoft Silverlight
2009-09-10 17:54:39 ----D---- C:\Windows\Debug
2009-09-10 17:54:05 ----D---- C:\Program Files\Windows Mail
2009-09-09 22:13:18 ----HD---- C:\Program Files\InstallShield Installation Information
2009-09-08 21:55:06 ----D---- C:\Program Files\Common Files\Nero
2009-09-08 21:51:53 ----D---- C:\ProgramData\Nero
2009-09-07 17:52:55 ----D---- C:\Users\Greg\AppData\Roaming\Nero
2009-09-07 17:49:26 ----D---- C:\Program Files\Nero
2009-09-07 17:49:21 ----D---- C:\Windows\Cursors
2009-09-07 16:55:37 ----D---- C:\Program Files\Messenger Plus! Live
2009-08-29 23:36:51 ----D---- C:\Windows\system32\Tasks
2009-08-29 22:22:13 ----D---- C:\Users\Greg\AppData\Roaming\Mozilla
2009-08-29 22:02:35 ----D---- C:\Users\Greg\AppData\Roaming\gtk-2.0
2009-08-28 23:38:20 ----A---- C:\Windows\system32\mrt.exe
2009-08-28 21:58:57 ----D---- C:\Users\Greg\AppData\Roaming\FileZilla
2009-08-28 20:57:59 ----D---- C:\ProgramData\Apple Computer
2009-08-28 12:15:17 ----D---- C:\Windows\Minidump
2009-08-27 14:31:12 ----AD---- C:\ProgramData\TEMP
2009-08-27 12:42:09 ----D---- C:\Program Files\Internet Explorer
2009-08-27 12:39:55 ----D---- C:\Program Files\Astonsoft
2009-08-26 14:27:28 ----D---- C:\Windows\system32\Msdtc
2009-08-26 14:27:26 ----D---- C:\Windows\system32\wbem
2009-08-26 14:26:06 ----D---- C:\Windows\system32\spool
2009-08-26 14:26:05 ----D---- C:\Users\Greg\AppData\Roaming\PhotoFiltre Studio X
2009-08-26 14:26:05 ----D---- C:\Users\Greg\AppData\Roaming\Notepad++
2009-08-26 14:26:04 ----D---- C:\Users\Greg\AppData\Roaming\IcoFX
2009-08-26 14:26:02 ----D---- C:\Windows\registration
2009-08-26 14:19:25 ----D---- C:\Windows\Logs
2009-08-26 01:25:51 ----D---- C:\Users\Greg\AppData\Roaming\TeamViewer
2009-08-25 08:17:00 ----D---- C:\Windows\system32\CodeIntegrity
2009-08-24 22:07:04 ----D---- C:\Windows\system

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-08-17 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-08-17 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-08-17 51376]
R1 HMFAxCore8ca4fd17866cac11805503e882557762;HMFAxCore8ca4fd17866cac11805503e882557762; \??\C:\Windows\system32\drivers\HMFAxCore8ca4fd17866cac11805503e882557762.sys [2009-06-08 22304]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-08-17 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-08-17 53328]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 windrvNT;windrvNT; \??\C:\Windows\system32\windrvNT.sys [2009-08-27 35363]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-18 8704]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-04-29 909824]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2008-06-05 222208]
R3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-11-01 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-11-01 208896]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-01-29 1042464]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-07-11 7530656]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2008-04-25 14848]
R3 SAgentDriver;SAgent Driver; \??\C:\Program Files\SoftActivity\AMSys\sagendrv.sys [2008-04-10 31312]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-04-17 199344]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-11-01 661504]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2008-01-21 200704]
S3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys []
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys []
S3 PAEAFLT.sys;USB Composite Device; C:\Windows\system32\DRIVERS\PAEAFLT.sys [2007-09-26 8576]
S3 Pcouffin;Low level access layer for CD devices; C:\Windows\System32\Drivers\Pcouffin.sys []
S3 pfc;Padus ASPI Shell; C:\Windows\system32\drivers\pfc.sys [2003-11-07 14604]
S3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS []
S3 SPC230NC;Philips SPC230NC Webcam; C:\Windows\system32\DRIVERS\SPC230NC.SYS [2007-12-31 461056]
S3 usb_rndisx;Carte RNDIS USB; C:\Windows\system32\DRIVERS\usb8023x.sys [2008-01-21 15872]
S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-21 73088]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 xnacc;Contrôleur XBOX 360 pour le service de pilote Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2008-01-21 521216]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-08-17 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-08-17 138680]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Capture Device Service;Capture Device Service; C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168]
R2 ezSharedSvc;Easybits Shared Services for Windows; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2008-04-15 94208]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-12-02 877864]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-30 935208]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-07-11 196608]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Recovery Service for Windows;Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [2008-04-26 361808]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-18 386560]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-08-17 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-08-17 352920]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2008-01-09 148832]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-07-31 654848]
S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2007-07-24 181800]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LcAgent;LC Remote Agent; C:\Windows\Temp\lcagent.exe []
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-12-12 537896]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

-----------------EOF-----------------