Que fais ta tof sur ce site

salut et merci de t'on aide ,
je te colle en premier lieu le rapport sdfix et le rapport hijackthis a la suite.

merci encore pour t'on aide
a+






[b]SDFix: Version 1.153 /b

Run by Propri‚taire on 05/03/2008 at 17:20

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:

Name:
csrss
Windows TCPIP Service

Path:
"C:\WINDOWS\csrss.exe"
"C:\WINDOWS\tcpip.exe"

csrss - Deleted
Windows TCPIP Service - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files /b:

Trojan Files Found:

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\services.exe - Deleted
C:\WINDOWS\system32\drivers\etc\BackupHosts.bak - Deleted
C:\WINDOWS\system32\real.txt - Deleted





Removing Temp Files

[b]ADS Check /b:



[b]Final Check /b:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-05 17:30:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ae,2c,30,dd,2a,22,d0,df,a2,c7,43,a5,4c,83,1d,6b,93,87,f9,f8,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,66,d3,dc,36,3f,87,97,4c,c2,9b,62,6e,f6,a6,54,6e,08,..
"khjeh"=hex:61,4e,77,4f,64,6f,4b,c8,f1,6c,89,cb,64,98,92,2b,69,b1,c1,72,61,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:dc,f9,8e,93,9a,5f,1b,a3,76,e7,cb,43,84,fe,2b,65,b9,8d,0f,ce,37,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ae,2c,30,dd,2a,22,d0,df,a2,c7,43,a5,4c,83,1d,6b,93,87,f9,f8,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,66,d3,dc,36,3f,87,97,4c,c2,9b,62,6e,f6,a6,54,6e,08,..
"khjeh"=hex:61,4e,77,4f,64,6f,4b,c8,f1,6c,89,cb,64,98,92,2b,69,b1,c1,72,61,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:dc,f9,8e,93,9a,5f,1b,a3,76,e7,cb,43,84,fe,2b,65,b9,8d,0f,ce,37,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:b934cfba
"s1"=dword:07fda5a9
"s2"=dword:71068e1c
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ae,2c,30,dd,2a,22,d0,df,a2,c7,43,a5,4c,83,1d,6b,93,87,f9,f8,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,66,d3,dc,36,3f,87,97,4c,c2,9b,62,6e,f6,a6,54,6e,08,..
"khjeh"=hex:61,4e,77,4f,64,6f,4b,c8,f1,6c,89,cb,64,98,92,2b,69,b1,c1,72,61,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:dc,f9,8e,93,9a,5f,1b,a3,76,e7,cb,43,84,fe,2b,65,b9,8d,0f,ce,37,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ae,2c,30,dd,2a,22,d0,df,a2,c7,43,a5,4c,83,1d,6b,93,87,f9,f8,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,66,d3,dc,36,3f,87,97,4c,c2,9b,62,6e,f6,a6,54,6e,08,..
"khjeh"=hex:61,4e,77,4f,64,6f,4b,c8,f1,6c,89,cb,64,98,92,2b,69,b1,c1,72,61,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:dc,f9,8e,93,9a,5f,1b,a3,76,e7,cb,43,84,fe,2b,65,b9,8d,0f,ce,37,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"="C:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe:*:Enabled:BackWeb-137903"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Mozilla Firefox"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe:*:Enabled:Nero Home"
"H:\\fichiers telecharger\\eMule0.47c\\emule.exe"="H:\\fichiers telecharger\\eMule0.47c\\emule.exe:*:Enabled:eMule"
"C:\\DOCUME~1\\PROPRI~1\\LOCALS~1\\Temp\\services.exe"="C:\\DOCUME~1\\PROPRI~1\\LOCALS~1\\Temp\\services.exe:*:Enabled:Flash Media"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files /b:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes /b:

Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-3DR1T.tmp"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-NJGK6.tmp"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-O5I5Q.tmp"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Fri 29 Jun 2007 6,369 ..SH. --- "C:\WINDOWS\SYSTEM32\acbeg.bak1"
Thu 5 Jul 2007 6,634 ..SH. --- "C:\WINDOWS\SYSTEM32\acbeg.bak2"
Fri 29 Jun 2007 1,024 A..H. --- "C:\WINDOWS\SYSTEM32\mumsbp.exe"
Fri 29 Jun 2007 512 A..H. --- "C:\WINDOWS\SYSTEM32\ogwmcgs.exe"
Sat 4 Aug 2007 756,874 ..SH. --- "C:\WINDOWS\SYSTEM32\pqtwa.bak1"
Sun 5 Aug 2007 745,047 ..SH. --- "C:\WINDOWS\SYSTEM32\pqtwa.bak2"
Thu 26 Jul 2007 739,803 ..SH. --- "C:\WINDOWS\SYSTEM32\ybadd.bak2"
Sat 13 Mar 2004 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 13 Mar 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Wed 4 Jul 2007 400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Wed 4 Jul 2007 48 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Wed 4 Jul 2007 400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v3ks.bla.bak"
Fri 30 Mar 2007 24,576 ...H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\~WRL1631.tmp"
Fri 30 Mar 2007 23,552 ...H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\~WRL3507.tmp"
Sat 21 Jun 2003 377,344 A..H. --- "C:\Program Files\Smart Projects\IsoBuster\Help\AHlp.exe"
Mon 12 Nov 2007 54,784 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\ModŠles\~WRL0004.tmp"
Thu 7 Feb 2008 57,856 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL0004.tmp"
Fri 30 Mar 2007 23,552 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL0173.tmp"
Fri 30 Mar 2007 23,552 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL1127.tmp"
Fri 20 Apr 2007 27,648 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL1392.tmp"
Fri 20 Apr 2007 28,672 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL2158.tmp"
Fri 20 Apr 2007 28,672 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL2179.tmp"
Fri 20 Apr 2007 27,136 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL2404.tmp"
Fri 20 Apr 2007 28,672 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL2798.tmp"
Fri 20 Apr 2007 24,576 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL3001.tmp"
Fri 20 Apr 2007 22,016 ...H. --- "C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Word\~WRL3437.tmp"
Sun 1 Jul 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2e97cbe532c7ab71623b16df846afc0d\download\BIT16.tmp"

[b]Finished!/b


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:04, on 05/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\emaudsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
H:\Program Files\Creative Professional\E-MU USB Audio\E-MU USB Audio\EmuUsbAudioCP.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr3.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [E-MU USB Audio Control Panel] "H:\Program Files\Creative Professional\E-MU USB Audio\E-MU USB Audio\EmuUsbAudioCP.exe"
O4 - HKCU\..\Run: [AVG Control Center] C:\Program Files\Grisoft\AVG7\avgcc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://charon777.free.fr/plugins/hardwaredetection.cab
O20 - Winlogon Notify: awtqp - C:\WINDOWS\
O20 - Winlogon Notify: gebca - C:\WINDOWS\
O20 - Winlogon Notify: gebcaxy - gebcaxy.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: E-MU Audio Service (emaudsv) - E-MU Systems - C:\WINDOWS\system32\emaudsv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
End of file - 7858 bytes

bonsoir ,
voila j'ai analiser les fichiers avec virus total ,et si j'ai bien compris ces deux fichiers
"C:\WINDOWS\SYSTEM32\acbeg.bak1 et
C:\WINDOWS\SYSTEM32\acbeg.bak2" sont infectés a 3% pas plus ,

pour les 3 autres ,
"C:\WINDOWS\SYSTEM32\pqtwa.bak1
C:\WINDOWS\SYSTEM32\pqtwa.bak2
C:\WINDOWS\SYSTEM32\ybadd.bak2 " sont a 0% .

je te poste le log combofix et hijackthis

merci de t'on aide ,bonne soirée a+



ComboFix 08-03-05.1 - Propriétaire 2008-03-05 22:51:57.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.436 [GMT 1:00]
Endroit: C:\Documents and Settings\Propriétaire\Bureau\KillBagle.exe
Command switches used :: C:\Documents and Settings\PropriÚtaire\Bureau\CFSCRIPT.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\lsprst7.dll
C:\WINDOWS\system32\msvcsv60.dll
C:\WINDOWS\system32\ssprs.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE




((((((((((((((((((((((((((((( Fichiers créés 2008-02-05 to 2008-03-05 ))))))))))))))))))))))))))))))))))))
.

2008-03-05 21:23 . 2008-03-05 21:23 <REP> d-------- C:\WINDOWS\LastGood
2008-03-05 20:49 . 2008-03-05 20:49 <REP> d-------- C:\Program Files\Windows Live Favorites
2008-03-05 18:23 . 2008-03-04 19:56 171,008 --a------ C:\MSNCleaner.exe
2008-03-05 18:18 . 2008-03-05 18:18 151,784 --a------ C:\MsnCleaner.zip
2008-03-05 17:40 . 2008-03-05 17:40 <REP> d-------- C:\Program Files\Trend Micro
2008-03-05 17:12 . 2008-03-05 17:13 <REP> d-------- C:\WINDOWS\ERUNT
2008-03-05 17:06 . 2008-03-05 17:35 <REP> d-------- C:\SDFix
2008-03-05 13:42 . 2008-03-05 13:42 <REP> d-------- C:\SAV32CLI
2008-03-05 08:32 . 2008-03-05 08:32 <REP> d-------- C:\WINDOWS\report
2008-03-05 08:32 . 2008-03-05 08:31 35,523,573 --a------ C:\WINDOWS\LPT$VPN.137
2008-03-05 08:31 . 2008-03-05 08:31 <REP> d-------- C:\WINDOWS\AU_Backup
2008-03-05 08:31 . 2008-03-05 08:31 35,523,573 --a------ C:\WINDOWS\VPTNFILE.137
2008-03-05 08:31 . 2008-03-05 08:31 1,922,894 --a------ C:\WINDOWS\tsc.ptn
2008-03-05 08:31 . 2008-03-05 08:31 1,163,344 --a------ C:\WINDOWS\vsapi32.dll
2008-03-05 08:31 . 2008-03-05 08:31 267,845 --a------ C:\WINDOWS\tsc.exe
2008-03-05 08:31 . 2008-03-05 08:31 86,094 --a------ C:\WINDOWS\BPMNT.dll
2008-03-05 08:31 . 2008-03-05 08:31 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-03-05 08:31 . 2008-03-05 09:37 823 --a------ C:\WINDOWS\tsc.ini
2008-03-05 08:29 . 2008-03-05 08:31 <REP> d-------- C:\WINDOWS\AU_Temp
2008-03-05 08:29 . 2008-03-05 08:29 <REP> d-------- C:\WINDOWS\AU_Log
2008-03-05 08:29 . 2008-03-05 08:29 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-03-05 08:29 . 2008-03-05 08:29 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-03-05 08:29 . 2008-03-05 08:29 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-03-05 08:29 . 2008-03-05 08:29 170 --a------ C:\WINDOWS\GetServer.ini
2008-03-04 19:12 . 2008-03-05 15:59 <REP> d-------- C:\Program Files\Windows Live
2008-03-04 19:12 . 2008-03-04 19:16 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-04 19:12 . 2008-03-05 20:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 19:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-05 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-05 14:52 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-03-05 05:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-03-04 19:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-03 13:21 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\AVG7
2008-02-14 16:19 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-02-05 23:58 --------- d-----w C:\Program Files\Microsoft Picture It! PhotoPub
2008-01-13 17:27 --------- d-----w C:\Program Files\Microsoft Works
2008-01-13 14:38 --------- d-----w C:\Program Files\Syncrosoft
2008-01-11 10:02 --------- d-----w C:\Program Files\Steinberg
2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2008-01-10 08:19 --------- d-----w C:\Program Files\Pinnacle
2008-01-10 08:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle
2008-01-07 16:59 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Steinberg
2008-01-07 13:50 54,784 ----a-w C:\WINDOWS\system32\drivers\CDAC11BA.EXE
2008-01-07 13:50 12,464 ----a-w C:\WINDOWS\system32\drivers\CdaC15BA.SYS
2008-01-07 13:50 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2008-01-07 13:50 --------- d-----w C:\Program Files\Fichiers communs\Creative Professional
2008-01-07 13:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Macrovision
2008-01-07 13:46 --------- d-----w C:\Program Files\Creative Professional
2008-01-07 13:46 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Proteus VX
2008-01-07 13:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-07 13:35 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Cakewalk
2008-01-07 13:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Minnetonka Audio Software
2008-01-07 12:24 --------- d-----w C:\Program Files\Cakewalk
2008-01-07 12:23 118,784 ----a-w C:\WINDOWS\dsdxirmv.exe
2008-01-07 08:14 --------- d-----w C:\Program Files\Creative
2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\SYSTEM32\dllcache\mrxdav.sys
2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-12-06 11:03 625,664 ------w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-12-06 11:02 70,656 ------w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2004-03-13 21:22 152 -c--a-w C:\Program Files\MIB2ROM.TXT
2007-06-29 10:59 6,369 --sh--w C:\WINDOWS\SYSTEM32\acbeg.bak1
2007-07-05 15:21 6,634 --sh--w C:\WINDOWS\SYSTEM32\acbeg.bak2
2007-08-04 09:10 756,874 --sh--w C:\WINDOWS\SYSTEM32\pqtwa.bak1
2007-08-05 09:10 745,047 --sh--w C:\WINDOWS\SYSTEM32\pqtwa.bak2
2007-07-26 20:06 739,803 --sh--w C:\WINDOWS\SYSTEM32\ybadd.bak2
.

((((((((((((((((((((((((((((( snapshot@2008-03-05_18.54.43.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-05 14:57:49 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-03-05 19:47:30 29,926 ----a-r C:\WINDOWS\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2005-05-09 19:08:40 33,792 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\cledx.sys
+ 2005-05-09 19:08:40 33,792 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\[u]0/u012\DriverFiles\cledx.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" [2007-04-26 23:10 313352]
"E-MU USB Audio Control Panel"="H:\Program Files\Creative Professional\E-MU USB Audio\E-MU USB Audio\EmuUsbAudioCP.exe" [2006-11-17 20:26 274432]
"AVG Control Center"="C:\Program Files\Grisoft\AVG7\avgcc.exe" [2007-12-21 05:00 579072]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-05-11 02:46 200069]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-23 04:04 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqp]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebca]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebcaxy]
gebcaxy.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PCTVOICE"=pctspk.exe
"UpdReg"=C:\WINDOWS\UpdReg.EXE
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe
"Microsoft Works Portfolio"=C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"H:\\fichiers telecharger\\eMule0.47c\\emule.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20299:TCP"= 20299:TCP:BitComet 20299 TCP
"20299:UDP"= 20299:UDP:BitComet 20299 UDP
"16104:TCP"= 16104:TCP:BitComet 16104 TCP
"16104:UDP"= 16104:UDP:BitComet 16104 UDP
"8080:TCP"= 8080:TCP:freeplayer

R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2000-01-08 08:22]
R2 emaudsv;E-MU Audio Service;C:\WINDOWS\system32\emaudsv.exe [2006-11-20 10:29]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10]
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
R3 emusba10;E-MU USB-Audio 1.0 Driver;C:\WINDOWS\system32\DRIVERS\emusba10.sys [2006-11-20 10:29]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\WINDOWS\system32\DRIVERS\fbxusb32.sys [2004-10-20 16:23]
S3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - USNJSVC
*Newly Created Service* - WLSETUPSVC
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-29 17:57:35 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2004-03-10 11:17:51 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2004-03-13 21:45:11 C:\WINDOWS\Tasks\Rappel d'abonnement 2 auprès de l'ISP.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2004-03-16 21:30:11 C:\WINDOWS\Tasks\Rappel d'abonnement 3 auprès de l'ISP.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2008-03-05 21:52:16 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-05 22:55:09
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-05 22:56:46
ComboFix-quarantined-files.txt 2008-03-05 21:56:05
.
2008-02-14 02:03:54 --- E O F ---




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:57:33, on 05/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\emaudsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
H:\Program Files\Creative Professional\E-MU USB Audio\E-MU USB Audio\EmuUsbAudioCP.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\SYNCRO~1\POS\H2O\cledx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr3.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [E-MU USB Audio Control Panel] "H:\Program Files\Creative Professional\E-MU USB Audio\E-MU USB Audio\EmuUsbAudioCP.exe"
O4 - HKCU\..\Run: [AVG Control Center] C:\Program Files\Grisoft\AVG7\avgcc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://charon777.free.fr/plugins/hardwaredetection.cab
O20 - Winlogon Notify: awtqp - C:\WINDOWS\
O20 - Winlogon Notify: gebca - C:\WINDOWS\
O20 - Winlogon Notify: gebcaxy - gebcaxy.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: E-MU Audio Service (emaudsv) - E-MU Systems - C:\WINDOWS\system32\emaudsv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
End of file - 7991 bytes