Infecter par TR/Dropper.Gen et/ou autre

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3855
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/03/2010 10:02:25
mbam-log-2010-03-12 (10-02-25).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 207887
Temps écoulé: 1 hour(s), 18 minute(s), 25 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
C:\WINDOWS\wiwmbu.exe (Trojan.Downloader) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\remote system protection (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Downloader) -> Data: c:\windows\wiwmbu.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\wiwmbu.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Documents and Settings\Anne\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Documents and Settings\Anne\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Documents and Settings\Anne\Mes documents\Téléchargements\teracopy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Documents and Settings\Anne\Mes documents\Téléchargements\GIRL147852369.JPG.exe (Trojan.Email.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\A6W4PP65\ybxliiv[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\A6W4PP65\yekhhiijfg[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\GM8EBENY\your_exe[1].exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\GM8EBENY\iolylzjjg[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\wiwmbu.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temp\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temp\ctv4016.exe (Trojan.Dropper) -> Delete on reboot.
C:\Program Files\Adobe\acrotray .exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\o1o9cv1zwu.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Utilisateur\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3855
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/03/2010 11:49:43
mbam-log-2010-03-12 (11-49-43).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 207806
Temps écoulé: 1 hour(s), 3 minute(s), 48 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
C:\Documents and Settings\Utilisateur\Application Data\Microsoft\winlog.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Local Settings\Temp\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Application Data\Microsoft\winlog.exe (Trojan.Agent) -> Quarantined and deleted successfully.

ComboFix 10-03-11.05 - Utilisateur 12/03/2010  15:06:09.1.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.894.476 [GMT 1:00]
Lancé depuis: c:\documents and settings\Utilisateur\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Utilisateur\Application Data\Microsoft\download.exe
c:\documents and settings\Utilisateur\rundll32 .exe
c:\program files\Internet Explorer\js.mui
c:\program files\Internet Explorer\wmpscfgs.exe
c:\windows\system32\ctfmon .exe
c:\windows\system32\o1o9cv1zwu.dll
D:\Autorun.inf

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-02-12 au 2010-03-12  ))))))))))))))))))))))))))))))))))))
.

2010-03-12 12:31 . 2010-03-12 12:33	--------	d-----w-	C:\rsit
2010-03-11 22:02 . 2010-03-11 22:02	--------	d-sh--w-	c:\documents and settings\NetworkService\PrivacIE
2010-03-11 22:01 . 2010-03-11 22:01	--------	d-----r-	c:\documents and settings\NetworkService\Favoris
2010-03-11 21:44 . 2010-03-11 21:44	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Malwarebytes
2010-03-11 21:44 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-11 21:44 . 2010-03-11 21:44	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-11 21:44 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-11 21:44 . 2010-03-11 21:44	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-11 21:18 . 2010-03-11 21:18	--------	d-----w-	c:\program files\Trend Micro
2010-03-11 20:53 . 2010-03-11 20:53	--------	d-----w-	C:\VundoFix Backups
2010-03-11 20:43 . 2010-03-11 20:47	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\QuickScan
2010-03-11 20:43 . 2010-03-05 17:33	791456	----a-w-	c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-03-11 20:43 . 2010-03-05 17:03	629152	----a-w-	c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-03-11 08:12 . 2010-03-12 12:20	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-03-11 08:12 . 2010-03-11 08:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-10 23:21 . 2010-03-10 23:21	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Windows Search
2010-03-10 23:16 . 2010-03-10 23:16	--------	d-sh--w-	c:\documents and settings\Administrateur\IETldCache
2010-03-10 22:59 . 2010-03-10 22:59	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2010-03-10 22:55 . 2010-03-10 22:56	--------	d-----w-	c:\documents and settings\Utilisateur\Local Settings\Application Data\Windows Server
2010-03-10 08:42 . 2009-10-23 15:28	3558912	------w-	c:\windows\system32\dllcache\moviemk.exe
2010-03-04 22:19 . 2010-02-12 10:03	293376	------w-	c:\windows\system32\browserchoice.exe
2010-02-27 08:39 . 2010-02-27 08:39	--------	d-----w-	c:\program files\Symantec
2010-02-25 21:47 . 2010-02-25 21:47	--------	d-----w-	c:\documents and settings\Utilisateur\Local Settings\Application Data\WBFSManager
2010-02-25 21:45 . 2010-02-25 21:45	--------	d-----w-	c:\program files\WBFS
2010-02-24 11:20 . 2010-02-24 12:30	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\TeraCopy
2010-02-16 19:36 . 2010-02-16 19:36	6868368	----a-w-	c:\documents and settings\Utilisateur\Application Data\ESTsoft\ALUpdate\ALZIP\newfile\TEMP\ALZip7_52.exe
2010-02-16 14:39 . 2010-02-16 14:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Estsoft
2010-02-16 14:38 . 2010-02-16 19:30	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\ESTsoft
2010-02-16 14:38 . 2010-02-16 14:38	--------	d-----w-	c:\program files\ESTsoft
2010-02-15 11:46 . 2010-02-15 11:46	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\ImgBurn
2010-02-15 09:32 . 2010-02-15 09:33	--------	d-----w-	c:\program files\ImgBurn
2010-02-13 17:53 . 2010-02-13 17:53	--------	d-----w-	c:\program files\RealVNC

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-12 12:21 . 2010-01-29 10:58	--------	d-----w-	c:\program files\QuickTime
2010-03-12 07:39 . 2004-08-17 09:31	536240	----a-w-	c:\windows\system32\perfh00C.dat
2010-03-12 07:39 . 2004-08-17 09:31	94724	----a-w-	c:\windows\system32\perfc00C.dat
2010-03-11 02:05 . 2009-08-01 21:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-10 22:56 . 2009-08-01 15:18	--------	d-----w-	c:\program files\SuperCopier2
2010-03-08 20:15 . 2010-01-11 21:33	479680	----a-w-	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-03-02 20:21 . 2009-08-08 19:25	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2010-02-27 08:40 . 2006-04-13 06:30	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-02-18 10:27 . 2009-12-18 15:41	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\uTorrent
2010-02-13 17:46 . 2009-08-01 21:44	--------	d-----w-	c:\program files\OpenOffice.org 3
2010-01-31 21:18 . 2010-01-31 21:18	--------	d-----w-	c:\documents and settings\All Users\Application Data\DVD Shrink
2010-01-31 21:18 . 2010-01-31 21:18	--------	d-----w-	c:\program files\DVD Shrink
2010-01-30 16:46 . 2010-01-30 16:46	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Apple Computer
2010-01-30 10:53 . 2010-01-30 09:02	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Winamp
2010-01-30 09:07 . 2010-01-30 09:02	--------	d-----w-	c:\program files\Winamp
2010-01-30 09:03 . 2010-01-30 09:03	--------	d-----w-	c:\program files\Winamp Detect
2010-01-29 10:58 . 2010-01-29 10:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-29 10:58 . 2010-01-29 10:58	--------	d-----w-	c:\program files\Fichiers communs\Apple
2010-01-29 10:57 . 2010-01-29 10:57	--------	d-----w-	c:\program files\Apple Software Update
2010-01-29 10:57 . 2010-01-29 10:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2010-01-27 10:34 . 2010-01-27 10:33	--------	d-----w-	c:\program files\PDFCreator
2010-01-25 11:29 . 2010-01-25 11:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\SlySoft
2010-01-25 11:27 . 2009-08-01 12:30	74576	----a-w-	c:\documents and settings\Utilisateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-25 11:25 . 2010-01-25 11:25	0	--sh--w-	c:\windows\S7A4FE689.tmp
2010-01-25 11:22 . 2010-01-25 11:22	--------	d-----w-	c:\program files\SlySoft
2010-01-24 08:52 . 2010-01-24 08:48	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\Teleca
2010-01-24 08:51 . 2010-01-24 08:51	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
2010-01-24 08:51 . 2010-01-24 08:51	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-24 08:48 . 2010-01-24 08:47	--------	d-----w-	c:\program files\Fichiers communs\Teleca Shared
2010-01-24 08:48 . 2010-01-24 08:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\HTC
2010-01-24 08:48 . 2010-01-24 08:47	--------	d-----w-	c:\documents and settings\All Users\Application Data\Teleca
2010-01-24 08:47 . 2010-01-24 08:46	--------	d-----w-	c:\program files\HTC
2010-01-24 08:46 . 2010-01-24 08:46	--------	d-----w-	c:\program files\Spirent Communications
2010-01-23 10:23 . 2010-01-23 10:03	--------	d-----w-	c:\program files\LG Electronics
2010-01-23 10:15 . 2010-01-23 10:15	24576	----a-w-	c:\documents and settings\Utilisateur\Application Data\LG Electronics\LG PC Suite III\UpdateHelper.exe
2010-01-23 10:03 . 2010-01-23 10:03	--------	d--h--w-	c:\documents and settings\Utilisateur\Application Data\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2010-01-23 10:03 . 2010-01-23 10:03	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\LG Electronics
2010-01-22 09:44 . 2010-01-03 10:18	--------	d-----w-	c:\documents and settings\Utilisateur\Application Data\gtk-2.0
2009-12-31 16:50 . 2004-08-05 08:00	353792	----a-w-	c:\windows\system32\drivers\srv.sys
2009-12-29 09:20 . 2009-08-01 21:47	1	----a-w-	c:\documents and settings\Utilisateur\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-21 19:07 . 2004-08-05 08:00	916480	----a-w-	c:\windows\system32\wininet.dll
2009-12-19 15:31 . 2009-12-19 15:31	3584	----a-r-	c:\documents and settings\Utilisateur\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-12-18 14:50 . 2009-12-18 14:50	0	-c--a-w-	c:\windows\nsreg.dat
2009-12-18 14:04 . 2009-12-18 14:04	152576	----a-w-	c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-18 14:04 . 2009-11-10 18:24	79488	----a-w-	c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-18 14:02 . 2009-08-01 21:28	56816	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-12-17 07:41 . 2004-08-05 08:00	347648	----a-w-	c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2004-08-05 08:00	33280	----a-w-	c:\windows\system32\csrsrv.dll
2006-08-22 03:29 . 2009-08-01 21:22	22	--sha-w-	c:\windows\SMINST\HPCD.SYS
.
[code]<pre>
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\Fichiers communs\Adobe\ARM\1.0\adobearm .exe
c:\program files\Fichiers communs\Nero\Lib\nerocheck .exe
c:\program files\Fichiers communs\Nero\Lib\nmindexstoresvr .exe
c:\program files\HP\HP Software Update\hpwuschd2 .exe
c:\program files\HP\QuickPlay\qpservice .exe
c:\program files\HPQ\Default Settings\cpqset .exe
c:\program files\HPQ\HP Wireless Assistant\hp wireless assistant .exe
c:\program files\HPQ\Quick Launch Buttons\eabservr .exe
c:\program files\HTC\HTC Sync\Application Launcher\application launcher .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Nero\Nero8\Nero BackItUp\nbkeyscan .exe
c:\program files\QuickTime\qttask       .exe
c:\program files\QuickTime\qttask      .exe
c:\program files\QuickTime\qttask     .exe
c:\program files\QuickTime\qttask    .exe
c:\program files\QuickTime\qttask   .exe
c:\program files\QuickTime\qttask  .exe
c:\program files\QuickTime\qttask .exe
c:\program files\SlySoft\CloneCD\clonecdtray .exe
c:\program files\Spybot - Search & Destroy\teatimer .exe
c:\program files\SuperCopier2\supercopier2 .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Synaptics\SynTP\syntpstart .exe
c:\windows\SMINST\recguard .exe
</pre>/code

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2010-03-12 40448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\quicktime\qttask      .exe -atboottime" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2010-03-11 40448]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 40448]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-03-12 40448]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2010-03-12 40448]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2010-03-12 40448]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2010-03-12 40448]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2010-03-12 40448]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2010-03-12 40448]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2010-03-12 40448]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-12 40448]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2010-03-12 40448]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2010-03-12 40448]
"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2010-03-12 40448]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2010-03-12 40448]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-03-12 40448]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-12 40448]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Orange\\IEWInternet\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\eMule\\emule.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/08/2009 22:28 108289]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [22/08/2005 10:06 231424]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [29/09/2009 08:11 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [29/09/2009 08:11 10496]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [29/09/2009 08:11 12928]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\androidusb.sys [24/01/2010 09:46 24576]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [05/08/2009 20:41 99840]
.
Contenu du dossier 'Tâches planifiées'

2010-03-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
TCP: {9C73AB8A-3348-4FCE-885F-06278B7543B0} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - component: c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\u7cmegkg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{A3BA40A2-74F1-52BD-F434-00B15A2C8953} - c:\windows\system32\o1o9cv1zwu.dll
SharedTaskScheduler-{A3BA40A2-74F1-52BD-F434-00B15A2C8953} - c:\windows\system32\o1o9cv1zwu.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-12 15:11
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????h????P???? ???B?????????????hLC? ?????? 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(844)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-03-12  15:14:32
ComboFix-quarantined-files.txt  2010-03-12 14:14

Avant-CF: 45 958 107 136 octets libres
Après-CF: 46 184 136 704 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 75AAB97C10ACA60993B98B844C7EA07D

List'em by g3n-h@ckm@n 1.3.2.1

User : Utilisateur (Administrateurs) 
Update on 10/03/2010 by g3n-h@ckm@n ::::: 17.30
Start at: 21:43:35 | 12/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Turion(tm) 64 Mobile Technology ML-34
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 85,66 Go (43,02 Go free) | NTFS
D:\ -> Disque fixe local | 6,48 Go (1,17 Go free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque fixe local | 7,13 Go (6,45 Go free) [FAT] | FAT32
G:\ -> Disque fixe local
H:\ -> Disque amovible | 978,72 Mo (218,12 Mo free) | FAT
 
Boot: Normal 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
c:\program files\ati technologies\ati control panel\atiptaxx .exe
c:\program files\hp\hp software update\hpwuschd2 .exe
c:\program files\synaptics\syntp\syntpenh .exe
c:\program files\hp\quickplay\qpservice .exe
c:\program files\hpq\hp wireless assistant\hp wireless assistant .exe
c:\program files\hpq\quick launch buttons\eabservr .exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
c:\program files\java\jre6\bin\jusched .exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Teleca Shared\logger.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\DbgOut.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
C:\Program Files\Spybot - Search & Destroy\teatimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run" 
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SpybotSD TeaTimer	REG_SZ         	C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
ATIPTA	REG_SZ         	"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" 
HP Software Update	REG_SZ         	C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe 
SynTPEnh	REG_SZ         	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
QPService	REG_SZ         	"C:\Program Files\HP\QuickPlay\QPService.exe" 
eabconfg.cpl	REG_SZ         	C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start 
Cpqset	REG_SZ         	C:\Program Files\HPQ\Default Settings\cpqset.exe 
RecGuard	REG_SZ         	C:\Windows\SMINST\RecGuard.exe 
hpWirelessAssistant	REG_SZ         	C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe 
SynTPStart	REG_SZ         	C:\Program Files\Synaptics\SynTP\SynTPStart.exe 
avgnt	REG_SZ         	"C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 
SunJavaUpdateSched	REG_SZ         	"C:\Program Files\Java\jre6\bin\jusched.exe" 
NeroFilterCheck	REG_SZ         	C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe 
NBKeyScan	REG_SZ         	"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" 
Mobile Connectivity Suite	REG_SZ         	"C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" /startoptions 
CloneCDTray	REG_SZ         	"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s 
QuickTime Task	REG_SZ         	"c:\program files\quicktime\qttask      .exe" -atboottime 
Adobe Reader Speed Launcher	REG_SZ         	"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
Adobe ARM	REG_SZ         	"C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDrives	REG_DWORD      	0 (0x0) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
HonorAutoRunSetting	REG_DWORD      	1 (0x1) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDrives	REG_DWORD      	0 (0x0) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 DefaultDomainName	REG_SZ         	PORTABLE 
 DefaultUserName	REG_SZ         	Utilisateur 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	Explorer.exe 
 ShutdownWithoutLogon	REG_SZ         	0 
 System	REG_SZ         	 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 SfcQuota	REG_DWORD      	-1 (0xffffffff) 
 allocatecdroms	REG_SZ         	0 
 allocatedasd	REG_SZ         	0 
 allocatefloppies	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 scremoveoption	REG_SZ         	0 
 AllowMultipleTSSessions	REG_DWORD      	1 (0x1) 
 UIHost	REG_EXPAND_SZ  	logonui.exe 
 LogonType	REG_DWORD      	1 (0x1) 
 Background	REG_SZ         	0 0 0 
 DebugServerCommand	REG_SZ         	no 
 SFCDisable	REG_DWORD      	0 (0x0) 
 WinStationsDisabled	REG_SZ         	0 
 DefaultPassword	REG_SZ         	 
 HibernationPreviouslyEnabled	REG_DWORD      	1 (0x1) 
 ShowLogonOptions	REG_DWORD      	0 (0x0) 
 AltDefaultUserName	REG_SZ         	Utilisateur 
 AltDefaultDomainName	REG_SZ         	PORTABLE 
 ChangePasswordUseKerberos	REG_DWORD      	1 (0x1) 
 Userinit	REG_SZ         	C:\WINDOWS\system32\userinit.exe, 

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{56F9679E-7826-4C84-81F3-532071A8BCC5}	REG_SZ         	 

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe	REG_SZ         	C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe:*:enabled:CSS
C:\Program Files\Messenger\msmsgs.exe	REG_SZ         	C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\uTorrent\uTorrent.exe	REG_SZ         	C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Program Files\eMule\emule.exe	REG_SZ         	C:\Program Files\eMule\emule.exe:*:Enabled:eMule

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Lexmark 3500-4500 Series\app4r.exe	REG_SZ         	C:\Program Files\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A3BA40A2-74F1-52BD-F434-00B15A2C8953}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer=192.168.1.1 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer=192.168.1.1 

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
## 
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
 
=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse                 	 
    85,66 Go total,  43,02 Go libre (50%),  12% fragmenté (fragmentation du fichier 24%)

Vous devriez défragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\WINDOWS\002487_.tmp  
Present !! : C:\WINDOWS\System32\SET*.tmp 
Present !! : C:\WINDOWS\Tasks\At1.job  
Present !! : C:\WINDOWS\Tasks\At2.job  
Present !! : C:\WINDOWS\Tasks\At3.job  
Present !! : C:\WINDOWS\Tasks\At4.job  
Present !! : C:\WINDOWS\Tasks\At5.job  
Present !! : C:\WINDOWS\Tasks\At6.job  
Present !! : C:\WINDOWS\Tasks\At7.job  
Present !! : C:\WINDOWS\Tasks\At8.job  
Present !! : C:\WINDOWS\Tasks\At9.job  
Present !! : C:\WINDOWS\Tasks\At1.job  
Present !! : C:\WINDOWS\Tasks\At10.job  
Present !! : C:\WINDOWS\Tasks\At11.job  
Present !! : C:\WINDOWS\Tasks\At12.job  
Present !! : C:\WINDOWS\Tasks\At13.job  
Present !! : C:\WINDOWS\Tasks\At14.job  
Present !! : C:\WINDOWS\Tasks\At15.job  
Present !! : C:\WINDOWS\Tasks\At16.job  
Present !! : C:\WINDOWS\Tasks\At17.job  
Present !! : C:\WINDOWS\Tasks\At18.job  
Present !! : C:\WINDOWS\Tasks\At19.job  
Present !! : C:\WINDOWS\Tasks\At2.job  
Present !! : C:\WINDOWS\Tasks\At20.job  
Present !! : C:\WINDOWS\Tasks\At21.job  
Present !! : C:\WINDOWS\Tasks\At22.job  
Present !! : C:\WINDOWS\Tasks\At23.job  
Present !! : C:\WINDOWS\Tasks\At24.job  
Present !! : C:\WINDOWS\Tasks\At3.job  
Present !! : C:\WINDOWS\Tasks\At4.job  
Present !! : C:\WINDOWS\Tasks\At5.job  
Present !! : C:\WINDOWS\Tasks\At6.job  
Present !! : C:\WINDOWS\Tasks\At7.job  
Present !! : C:\WINDOWS\Tasks\At8.job  
Present !! : C:\WINDOWS\Tasks\At9.job  
Present !! : C:\Documents and Settings\Utilisateur\Application Data\usb.inf  
Present !! : C:\Documents and Settings\Utilisateur\LOCAL Settings\Temp\wmpscfgs.exe  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : HKEY_USERS\S-1-5-21-2959120336-474453583-3100428193-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-12 21:50:46
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????????h????P???? ???B?????????????hLC? ?????? 

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
kernel: MBR read successfully
user & kernel MBR OK 

 
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials 
 
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:51:02,25 

Kill'em by g3n-h@ckm@n 1.3.2.1 
 
User : Utilisateur (Administrateurs) 
Update on 10/03/2010 by g3n-h@ckm@n ::::: 17.30
Start at: 22:02:39 | 12/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Turion(tm) 64 Mobile Technology ML-34
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 85,66 Go (43,02 Go free) | NTFS
D:\ -> Disque fixe local | 6,48 Go (1,17 Go free) [HP_RECOVERY] | FAT32
E:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\WINDOWS\002487_.tmp 
 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET145.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET146.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET148.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET149.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET174.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET175.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At1.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At2.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At3.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At4.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At5.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At6.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At7.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At8.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At9.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At10.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At11.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At12.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At13.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At14.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At15.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At16.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At17.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At18.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At19.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At20.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At21.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At22.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At23.job 
Quarantined & Deleted !! : C:\WINDOWS\Tasks\At24.job 
Quarantined & Deleted !! : C:\Documents and Settings\Utilisateur\Application Data\usb.inf 
Quarantined & Deleted !! : C:\Documents and Settings\Utilisateur\LOCAL Settings\Temp\wmpscfgs.exe 
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 

Logfile of random's system information tool 1.06 (written by random/random)
Run by Utilisateur at 2010-03-12 22:27:57
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 44 GB (50%) free of 88 GB
Total RAM: 894 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:28:14, on 12/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
c:\program files\ati technologies\ati control panel\atiptaxx .exe
c:\program files\hp\hp software update\hpwuschd2 .exe
c:\program files\synaptics\syntp\syntpenh .exe
c:\program files\hpq\quick launch buttons\eabservr .exe
c:\program files\hp\quickplay\qpservice .exe
c:\program files\java\jre6\bin\jusched .exe
c:\program files\slysoft\clonecd\clonecdtray .exe
c:\program files\htc\htc sync\application launcher\application launcher .exe
c:\program files\spybot - search & destroy\teatimer .exe
c:\program files\hpq\hp wireless assistant\hp wireless assistant .exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Fichiers communs\Teleca Shared\logger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ctv992.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\DbgOut.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Utilisateur\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Utilisateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {A3BA40A2-74F1-52BD-F434-00B15A2C8953} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Mobile Connectivity Suite] "C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "c:\program files\quicktime\qttask       .exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C73AB8A-3348-4FCE-885F-06278B7543B0}: NameServer = 192.168.1.1
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 9714 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BA40A2-74F1-52BD-F434-00B15A2C8953}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2006-04-13 1179136]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2010-03-12 40448]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2010-03-12 40448]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-03-12 40448]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2010-03-12 40448]
"eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [2010-03-12 40448]
"Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2010-03-12 40448]
"RecGuard"=C:\Windows\SMINST\RecGuard.exe [2010-03-12 40448]
"hpWirelessAssistant"=C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2010-03-12 40448]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2010-03-12 40448]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-03-12 40448]
"NeroFilterCheck"=C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe [2010-03-12 40448]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2010-03-12 40448]
"Mobile Connectivity Suite"=C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe [2010-03-12 40448]
"CloneCDTray"=C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [2010-03-12 40448]
"QuickTime Task"=c:\program files\quicktime\qttask       .exe [2010-03-12 40448]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-03-12 40448]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2010-03-12 40448]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2010-03-12 40448]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Démarrage rapide de HP Photosmart Premier.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-01 47104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe"="C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Lexmark 3500-4500 Series\app4r.exe"="C:\Program Files\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 2 months======

2010-03-12 22:14:02 ----SHD---- C:\RECYCLER
2010-03-12 22:00:28 ----D---- C:\Kill'em
2010-03-12 21:43:32 ----A---- C:\List'em.txt
2010-03-12 21:43:05 ----D---- C:\Program Files\List_Kill'em
2010-03-12 15:14:33 ----A---- C:\ComboFix.txt
2010-03-12 15:04:18 ----A---- C:\Boot.bak
2010-03-12 15:04:11 ----RASHD---- C:\cmdcons
2010-03-12 15:01:29 ----A---- C:\WINDOWS\zip.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\SWSC.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\SWREG.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\sed.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\PEV.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\MBR.exe
2010-03-12 15:01:29 ----A---- C:\WINDOWS\grep.exe
2010-03-12 15:01:21 ----D---- C:\WINDOWS\ERDNT
2010-03-12 15:00:49 ----AD---- C:\Qoobox
2010-03-12 13:31:08 ----D---- C:\rsit
2010-03-11 22:44:38 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Malwarebytes
2010-03-11 22:44:30 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-03-11 22:44:28 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-11 22:18:12 ----D---- C:\Program Files\Trend Micro
2010-03-11 21:53:55 ----D---- C:\VundoFix Backups
2010-03-11 21:53:55 ----A---- C:\VundoFix.txt
2010-03-11 21:43:13 ----D---- C:\Documents and Settings\Utilisateur\Application Data\QuickScan
2010-03-11 09:12:52 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-11 09:12:52 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-11 03:06:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-11 03:04:50 ----A---- C:\WINDOWS\system32\MRT.INI
2010-03-11 00:14:06 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-09 22:21:27 ----AH---- C:\a.txt
2010-03-05 01:11:44 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-03-04 23:19:29 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-02-27 09:39:05 ----D---- C:\Program Files\Symantec
2010-02-25 22:45:24 ----D---- C:\Program Files\WBFS
2010-02-24 12:20:49 ----D---- C:\Documents and Settings\Utilisateur\Application Data\TeraCopy
2010-02-24 10:26:46 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-16 15:39:16 ----D---- C:\Documents and Settings\All Users\Application Data\Estsoft
2010-02-16 15:38:30 ----D---- C:\Program Files\ESTsoft
2010-02-16 15:38:30 ----D---- C:\Documents and Settings\Utilisateur\Application Data\ESTsoft
2010-02-15 12:46:02 ----D---- C:\Documents and Settings\Utilisateur\Application Data\ImgBurn
2010-02-15 10:32:58 ----D---- C:\Program Files\ImgBurn
2010-02-13 18:53:55 ----D---- C:\Program Files\RealVNC
2010-02-11 11:32:48 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-11 11:32:42 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-11 11:30:03 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-11 11:29:57 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-11 11:29:51 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-11 11:29:43 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-11 11:28:29 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-11 11:28:14 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-01-31 22:18:37 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2010-01-31 22:18:35 ----D---- C:\Program Files\DVD Shrink
2010-01-30 17:46:14 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Apple Computer
2010-01-30 10:04:16 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-01-30 10:04:08 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-01-30 10:03:52 ----D---- C:\WINDOWS\Logs
2010-01-30 10:03:32 ----D---- C:\Program Files\Winamp Detect
2010-01-30 10:02:59 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2010-01-30 10:02:59 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2010-01-30 10:02:59 ----N---- C:\WINDOWS\system32\pxafs.dll
2010-01-30 10:02:53 ----D---- C:\Program Files\Winamp
2010-01-30 10:02:53 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Winamp
2010-01-29 11:58:46 ----D---- C:\Program Files\QuickTime
2010-01-29 11:58:38 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2010-01-29 11:58:00 ----D---- C:\Program Files\Fichiers communs\Apple
2010-01-29 11:57:37 ----D---- C:\Program Files\Apple Software Update
2010-01-29 11:57:37 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2010-01-27 11:33:13 ----A---- C:\WINDOWS\system32\pdfcmnnt.dll
2010-01-27 11:33:10 ----D---- C:\Program Files\PDFCreator
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\VB6FR.DLL
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\MSMPIDE.DLL
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL
2010-01-27 11:33:10 ----A---- C:\WINDOWS\system32\MSCC2FR.DLL
2010-01-25 12:29:54 ----D---- C:\Documents and Settings\All Users\Application Data\SlySoft
2010-01-25 12:25:16 ----SH---- C:\WINDOWS\S7A4FE689.tmp
2010-01-25 12:22:03 ----D---- C:\Program Files\SlySoft
2010-01-24 09:51:45 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2010-01-24 09:51:36 ----HDC---- C:\WINDOWS\$NtUninstallWdf01007$
2010-01-24 09:48:40 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Teleca
2010-01-24 09:48:06 ----D---- C:\Documents and Settings\All Users\Application Data\HTC
2010-01-24 09:47:59 ----D---- C:\Program Files\Fichiers communs\Teleca Shared
2010-01-24 09:47:59 ----D---- C:\Documents and Settings\All Users\Application Data\Teleca
2010-01-24 09:46:51 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-24 09:46:51 ----A---- C:\WINDOWS\system32\WdfCoInstaller01007.dll
2010-01-24 09:46:46 ----D---- C:\Program Files\Spirent Communications
2010-01-24 09:46:38 ----D---- C:\Program Files\HTC
2010-01-24 09:45:35 ----D---- C:\WINDOWS\Downloaded Installations
2010-01-23 11:26:08 ----D---- C:\Sounds
2010-01-23 11:25:39 ----A---- C:\WINDOWS\Sublock.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\LGMobileDL.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\Imei_dll.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\esn.dll
2010-01-23 11:25:39 ----A---- C:\WINDOWS\AuthDll.dll
2010-01-23 11:03:40 ----A---- C:\WINDOWS\system32\NMSDVDXU.dll
2010-01-23 11:03:21 ----HD---- C:\Documents and Settings\Utilisateur\Application Data\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2010-01-23 11:03:21 ----D---- C:\Program Files\LG Electronics
2010-01-23 11:03:21 ----D---- C:\Documents and Settings\Utilisateur\Application Data\LG Electronics
2010-01-13 08:49:22 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 08:49:16 ----A---- C:\WINDOWS\imsins.BAK
2010-01-13 08:49:09 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 2 months======

2010-03-12 22:18:33 ----RD---- C:\Program Files
2010-03-12 22:18:31 ----SD---- C:\WINDOWS\Tasks
2010-03-12 22:18:29 ----D---- C:\Program Files\Adobe
2010-03-12 22:16:48 ----D---- C:\WINDOWS
2010-03-12 22:16:44 ----ASH---- C:\hpqp.ini
2010-03-12 22:16:41 ----D---- C:\WINDOWS\SMINST
2010-03-12 22:15:56 ----A---- C:\XP_TV.ini
2010-03-12 22:14:19 ----D---- C:\WINDOWS\Temp
2010-03-12 22:14:11 ----D---- C:\WINDOWS\Prefetch
2010-03-12 22:14:09 ----D---- C:\WINDOWS\Debug
2010-03-12 22:03:32 ----D---- C:\WINDOWS\system32
2010-03-12 22:02:41 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-12 22:01:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-12 15:16:13 ----D---- C:\Program Files\Internet Explorer
2010-03-12 15:11:34 ----A---- C:\WINDOWS\system.ini
2010-03-12 15:10:25 ----SD---- C:\Documents and Settings\Utilisateur\Application Data\Microsoft
2010-03-12 15:09:06 ----D---- C:\WINDOWS\system32\drivers
2010-03-12 15:09:06 ----D---- C:\WINDOWS\AppPatch
2010-03-12 15:09:04 ----D---- C:\Program Files\Fichiers communs
2010-03-12 15:04:19 ----RASH---- C:\boot.ini
2010-03-12 15:01:29 ----SHD---- C:\System Volume Information
2010-03-12 15:01:29 ----D---- C:\WINDOWS\system32\Restore
2010-03-12 13:17:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-03-12 10:42:22 ----D---- C:\Program Files\Mozilla Firefox
2010-03-12 10:04:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-03-12 08:39:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-11 15:04:59 ----RSHD---- C:\WINDOWS\system32\dllcache
2010-03-11 13:44:24 ----A---- C:\WINDOWS\NeroDigital.ini
2010-03-11 03:06:18 ----D---- C:\Program Files\Movie Maker
2010-03-11 03:06:13 ----HD---- C:\WINDOWS\inf
2010-03-11 03:06:08 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-11 03:06:08 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-11 03:05:29 ----SHD---- C:\WINDOWS\Installer
2010-03-11 03:05:29 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-03-11 03:05:29 ----D---- C:\Config.Msi
2010-03-11 00:15:02 ----D---- C:\Documents and Settings
2010-03-10 23:56:17 ----D---- C:\Program Files\SuperCopier2
2010-03-02 21:45:47 ----D---- C:\WINDOWS\system32\LogFiles
2010-03-02 21:21:06 ----D---- C:\Program Files\Fichiers communs\Adobe
2010-03-02 21:21:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-03-02 06:30:12 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-27 09:40:12 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-25 22:45:26 ----D---- C:\WINDOWS\WinSxS
2010-02-24 10:27:30 ----D---- C:\WINDOWS\ie8updates
2010-02-18 11:27:38 ----D---- C:\Documents and Settings\Utilisateur\Application Data\uTorrent
2010-02-13 18:46:28 ----D---- C:\Program Files\OpenOffice.org 3
2010-01-30 10:04:20 ----D---- C:\WINDOWS\system32\DirectX
2010-01-24 18:34:10 ----RSD---- C:\WINDOWS\Fonts
2010-01-23 09:11:44 ----N---- C:\WINDOWS\system32\tzchange.exe
2010-01-22 10:44:05 ----D---- C:\Documents and Settings\Utilisateur\Application Data\gtk-2.0

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 43008]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys []
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2004-05-05 4228]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-08-01 28520]
R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-18 56816]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-01 1412608]
R3 BCM43XX;Pilote pour carte réseau Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 CAMCAUD;Conexant AMC Audio; C:\WINDOWS\system32\drivers\camc6aud.sys [2005-08-01 38016]
R3 CAMCHALA;CAMCHALA; C:\WINDOWS\system32\drivers\camc6hal.sys [2005-08-01 349312]
R3 CmBatt;Pilote d'adaptateur secteur Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-08-22 1035008]
R3 HSFHWATI;HSFHWATI; C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-08-22 231424]
R3 LgBttPort;LGE Bluetooth TransPort; C:\WINDOWS\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
R3 LGVMODEM;LGE Virtual Modem; C:\WINDOWS\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2005-09-30 78720]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-09-15 213696]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-08-22 718464]
S3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-08-18 56648]
S3 catchme;catchme; \??\C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\catchme.sys []
S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys []
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2005-08-22 1035008]
S3 HTCAND32;HTC Device Driver; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-11-12 101120]
S3 hwusbfake;Huawei DataCard USB Fake; C:\WINDOWS\system32\DRIVERS\ewusbfake.sys [2008-11-12 99840]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 SMCIRDA;Pilote de périphérique SMC IrCC Miniport; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-08-23 36937]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20050901.036\symidsco.sys []
S3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-09-20 162432]
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2009-08-21 13056]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2009-08-21 20864]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2009-08-21 24960]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-01-19 503144]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-08-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-23 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-01 393216]
R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2008-12-03 69632]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2005-12-21 98304]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2005-11-15 73728]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Fix Navipromo version 4.0.8 commencé le 13/03/2010 22:04:35,37

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\navilog1

Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Turion(tm) 64 Mobile Technology ML-34 )
BIOS : Ver 1.00PARTTBL
USER : Utilisateur ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)


C:\ (Local Disk) - NTFS - Total:85 Go (Free:37 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:1 Go)
E:\ (CD or DVD)


Recherche executée en mode normal 


[b]Aucune Infection Navipromo/Egdaccess trouvée[/b]



*** Scan terminé 13/03/2010 22:05:06,85 ***