Page de pub qui apparaît

merci :
voici le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00:43, on 22/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\Administrateur\Mes documents\fichiers word\MSOFFICE\WINWORD\Documents\Maintenance Informatique\Hijackthis v2.0.2\HiJackThis\eden.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ass-tgv-rhin-rhone.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DVA Storm - {21D27745-1B1A-4A5B-BEFB-7381FAEB5227} - C:\WINNT\lgmxvpatklf.dll (file missing)
O2 - BHO: (no name) - {62B3131B-12D9-410E-AD0F-4CDB02591011} - C:\WINNT\system32\yaywtQii.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Explorer - {7348D74C-731B-DECE-9F8A-A37D8214708E} - C:\WINNT\system32\wlcstp32.dll
O2 - BHO: RDL Rolex - {9B042CC5-F5D3-48CD-99C1-DFF6F401F7C6} - C:\WINNT\dkxrstqsxd.dll (file missing)
O2 - BHO: (no name) - {F3AEF888-A3E2-44EB-BD85-F0C85BA7673F} - C:\WINNT\system32\fccaYrss.dll
O2 - BHO: (no name) - {F59F3C8E-5A34-4DF7-919E-AF6613170C8A} - C:\WINNT\system32\ssqQkKbC.dll
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [104272c5] rundll32.exe "C:\WINNT\system32\ttkedjwp.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [XP Antivirus] C:\Program Files\XP Antivirus\xpa.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Internet Help Svc] IHSVC.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunServices: [Internet Help Svc] IHSVC.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunServices: [Internet Help Svc] IHSVC.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [Internet Help Svc] IHSVC.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [Internet Help Svc] IHSVC.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {B8634A6E-38D5-4AAE-8708-3F3DB92FF9D0} (NTR Activex 1.0.8) - http://194.250.53.4/inquiero/mod/setup/ntractivex108.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://acces-direct.net/15671/Choc-fetish.exe
O20 - Winlogon Notify: fccaYrss - C:\WINNT\SYSTEM32\fccaYrss.dll
O21 - SSODL: omlbpkaw - {0F88C4DC-F34E-40CE-A663-B4CA0DB89FD9} - C:\WINNT\omlbpkaw.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Iomega Activity Disk2 - Unknown owner - C:\WINNT\
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

voici le rapport Navilog1

Search Navipromo version 3.5.4 commencé le 22/04/2008 à 11:10:13,32

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Administrateur"

Mise à jour le 15.04.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans "C:\WINNT" ***

C:\WINNT\mslagent trouvé !


*** Recherche dossiers dans "C:\Program Files" ***



*** Recherche dossiers dans "C:\DOCUME~1\ALLUSE~1\APPLIC~1" ***




*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\applic~1" ***



*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" ***



*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINNT\system32" *

* Recherche dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\tgv\locals~1\applic~1" *



*** Recherche fichiers ***




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINNT\system32" :


* Dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" :


* Dans "C:\DOCUME~1\tgv\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

C:\WINNT\system32\CbKkQqss.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINNT\system32\iiQtwyay.ini2 trouvé ! infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 22/04/2008 à 11:21:40,48 ***

voici le rapport du dernier Smitfraud fix :

SmitFraudFix v2.300

Rapport fait à 12:15:25.04, 2008-04-22
Executé à partir de C:\Documents and Settings\Administrateur\Mes documents\fichiers word\MSOFFICE\WINWORD\Documents\Maintenance Informatique\SmitfraudFix V2.300\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINNT\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!



»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Symantec Network Security Miniport
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F733C380-F28E-471A-A28B-B6BBE8B50CE9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F733C380-F28E-471A-A28B-B6BBE8B50CE9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{F733C380-F28E-471A-A28B-B6BBE8B50CE9}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

pour info, je n'ai pas eu le rapport de Combofix

voici le dernier rapport hijackthis comme demandé ds dernier mail

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:49, on 2008-04-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\Administrateur\Mes documents\fichiers word\MSOFFICE\WINWORD\Documents\Maintenance Informatique\Hijackthis v2.0.2\HiJackThis\eden.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Internet Help Svc] IHSVC.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Internet Help Svc] IHSVC.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Internet Help Svc] IHSVC.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Iomega Activity Disk2 - Unknown owner - C:\WINNT\
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

voici le rapport de Combofix :

ComboFix 08-04-20.5 - Administrateur 2008-04-22 14:17:46.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.345 [GMT 2:00]Endroit: C:\Documents and Settings\Administrateur\Bureau\KillBagle.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Administrateur\Bureaublackbird.jpg
C:\Documents and Settings\Administrateur\BureauEditorFKWP1.5.exe
C:\Documents and Settings\Administrateur\BureauEditorFKWP2.0.exe
C:\Documents and Settings\Administrateur\Bureaufilemanagerclient.exe
C:\Documents and Settings\Administrateur\Bureaufkwp1.5.exe
C:\Documents and Settings\Administrateur\Bureaufkwp2.0.exe
C:\Documents and Settings\Administrateur\Bureaufwebd.exe
C:\Documents and Settings\Administrateur\BureauFWebdEditor.exe
C:\Documents and Settings\Administrateur\BureauTrojan.Win32.BlackBird.exe
C:\Documents and Settings\Administrateur\Bureauvirii
C:\Documents and Settings\Administrateur\Menu Démarrer\XP Antivirus 2008
C:\Program Files\Inet Delivery
C:\Program Files\Inet Delivery\inetdl.exe
C:\Program Files\Inet Delivery\intdel.exe
C:\Program Files\XP Antivirus
C:\WINNT\a.bat
C:\WINNT\base64.tmp
C:\WINNT\bdn.com
C:\WINNT\cookies.ini
C:\WINNT\FVProtect.exe
C:\WINNT\iTunesMusic.exe
C:\WINNT\mslagent
C:\WINNT\mslagent\2_mslagent.dll
C:\WINNT\mslagent\mslagent.exe
C:\WINNT\mslagent\uninstall.exe
C:\WINNT\mssecu.exe
C:\WINNT\system32\CbKkQqss.ini
C:\WINNT\system32\CbKkQqss.ini2
C:\WINNT\system32\fccaYrss.dll
C:\WINNT\system32\iiQtwyay.ini
C:\WINNT\system32\iiQtwyay.ini2
C:\WINNT\system32\mcrh.tmp
C:\WINNT\system32\pwjdektt.ini
C:\WINNT\system32\ssqQkKbC.dll
C:\WINNT\system32\ttkedjwp.dll
C:\WINNT\system32akttzn.exe
C:\WINNT\system32anticipator.dll
C:\WINNT\system32awtoolb.dll
C:\WINNT\system32bdn.com
C:\WINNT\system32bsva-egihsg52.exe
C:\WINNT\system32dpcproxy.exe
C:\WINNT\system32emesx.dll
C:\WINNT\system32h@tkeysh@@k.dll
C:\WINNT\system32hoproxy.dll
C:\WINNT\system32hxiwlgpm.dat
C:\WINNT\system32hxiwlgpm.exe
C:\WINNT\system32medup012.dll
C:\WINNT\system32medup020.dll
C:\WINNT\system32msgp.exe
C:\WINNT\system32msnbho.dll
C:\WINNT\system32mssecu.exe
C:\WINNT\system32msvchost.exe
C:\WINNT\system32mtr2.exe
C:\WINNT\system32mwin32.exe
C:\WINNT\system32netode.exe
C:\WINNT\system32newsd32.exe
C:\WINNT\system32ps1.exe
C:\WINNT\system32psof1.exe
C:\WINNT\system32psoft1.exe
C:\WINNT\system32regc64.dll
C:\WINNT\system32regm64.dll
C:\WINNT\system32Rundl1.exe
C:\WINNT\system32smp
C:\WINNT\system32smp\msrc.exe
C:\WINNT\system32sncntr.exe
C:\WINNT\system32ssurf022.dll
C:\WINNT\system32ssvchost.com
C:\WINNT\system32ssvchost.exe
C:\WINNT\system32sysreq.exe
C:\WINNT\system32taack.dat
C:\WINNT\system32taack.exe
C:\WINNT\system32temp#01.exe
C:\WINNT\system32thun.dll
C:\WINNT\system32thun32.dll
C:\WINNT\system32VBIEWER.OCX
C:\WINNT\system32vbsys2.dll
C:\WINNT\system32vcatchpi.dll
C:\WINNT\system32winlogonpc.exe
C:\WINNT\system32winsystem.exe
C:\WINNT\system32WINWGPX.EXE
C:\WINNT\userconfig9x.dll
C:\WINNT\Web\def.htm
C:\WINNT\Web\default.htt
C:\WINNT\winsystem.exe
C:\WINNT\zip1.tmp
C:\WINNT\zip2.tmp
C:\WINNT\zip3.tmp
C:\WINNT\zipped.tmp

.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-22 to 2008-04-22 ))))))))))))))))))))))))))))))))))))
.

2008-04-22 11:06 . 2008-04-22 11:22 <REP> d-------- C:\Program Files\Navilog1
2008-04-21 08:39 . 2008-04-22 08:42 2,747,050 ---hs---- C:\WINNT\system32\ftoqcvxu.ini
2008-04-18 10:21 . 2008-04-21 08:39 1,540,677 ---hs---- C:\WINNT\system32\lrdskuxh.ini
2008-04-18 08:38 . 2008-04-18 08:39 1,530,641 ---hs---- C:\WINNT\system32\rdckourn.ini
2008-04-17 08:35 . 2008-04-18 08:37 1,530,581 ---hs---- C:\WINNT\system32\jwudrsnp.ini
2008-04-16 08:33 . 2008-04-16 09:32 1,602,993 ---hs---- C:\WINNT\system32\qsfcyfyo.ini
2008-04-16 08:31 . 2008-04-16 08:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TmpRecentIcons
2008-04-15 19:33 . 2008-04-17 09:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\vktkjejk
2008-04-15 19:33 . 2008-04-15 17:14 94,208 --a------ C:\WINNT\npqtsrak.exe
2008-04-15 19:33 . 2008-04-15 17:14 81,920 --a------ C:\WINNT\rtqmekwg.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-22 10:15 1,844 ----a-w C:\WINNT\system32\tmp.reg
2008-04-22 10:00 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-04-21 16:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\VadeRetro
2008-03-25 07:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-20 08:09 1,845,376 ----a-w C:\WINNT\system32\win32k.sys
2008-03-12 10:02 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-07 13:53 691,545 ----a-w C:\WINNT\unins000.exe
2008-03-07 09:10 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-07 07:42 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\OfficeUpdate12
2008-03-06 20:32 706 ----a-w C:\WINNT\system32\drivers\COH_Mon.inf
2008-03-06 20:32 23,904 ----a-w C:\WINNT\system32\drivers\COH_Mon.sys
2008-03-06 20:32 10,537 ----a-w C:\WINNT\system32\drivers\coh_mon.cat
2008-03-06 15:41 --------- d-----w C:\Program Files\Panda Security
2008-03-06 13:37 --------- d-----w C:\Program Files\Hijackthis Version Française
2008-03-06 08:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-03 16:47 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\ntr
2008-03-01 12:58 826,368 ----a-w C:\WINNT\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINNT\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINNT\system32\dnsrslvr.dll
2008-02-18 10:39 524,288 ----a-w C:\WINNT\opuc.dll
2008-02-08 15:20 60,800 ----a-w C:\WINNT\system32\S32EVNT1.DLL
2008-02-04 17:23 693,792 ----a-w C:\WINNT\system32\OGACheckControl.DLL
2006-10-30 15:41 784 ----a-w C:\Documents and Settings\Administrateur\Application Data\mpauth.dat
2005-10-27 08:24 271 --sh--w C:\Program Files\desktop.ini
2005-10-27 08:24 22,115 ---h--w C:\Program Files\folder.htt
1999-04-06 12:27 99,840 ------w C:\Program Files\Fichiers communs\IRAABOUT.DLL
1998-12-09 02:53 70,144 ------w C:\Program Files\Fichiers communs\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ------w C:\Program Files\Fichiers communs\IRALPTTR.DLL
1998-12-09 02:53 31,744 ------w C:\Program Files\Fichiers communs\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ------w C:\Program Files\Fichiers communs\IRAREG.DLL
1998-12-09 02:53 17,920 ------w C:\Program Files\Fichiers communs\IRASRIAL.DLL
.

------- Sigcheck -------

2005-03-02 20:20 578048 c34920eb988ce98910bd6b0417f334eb C:\WINNT\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 17:50 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINNT\$hf_mig$\KB925902\SP2QFE\user32.dll
2001-09-28 14:00 562176 0116f8b66043084912d4ceb1c3abf1e2 C:\WINNT\$NtServicePackUninstall$\user32.dll
2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a C:\WINNT\$NtUninstallKB890859$\user32.dll
2005-03-02 20:10 578048 0df75fb73f705b011630159a43d7c354 C:\WINNT\$NtUninstallKB925902$\user32.dll
2003-06-19 12:05 403728 ddf50f96013d03882a4c76d3c0f5b2ce C:\WINNT\$NtUpdateRollupPackUninstall$\user32.dll
2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a C:\WINNT\ServicePackFiles\i386\user32.dll
2007-03-06 13:18 381712 0380070f1a55fab0f03c8fc0adb9c6f0 C:\WINNT\SoftwareDistribution\Download\e3e6798b83eb16436f6203e6158539bb\user32.dll
2007-03-08 17:37 578560 753354f594809a9b96f73999b435a533 C:\WINNT\system32\user32.dll
2007-03-08 17:37 578560 753354f594809a9b96f73999b435a533 C:\WINNT\system32\dllcache\user32.dll

2005-03-02 20:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINNT\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 18:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINNT\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2001-09-28 14:00 1900416 7a09a7b275351329b4eec542bcf70d3a C:\WINNT\$NtServicePackUninstall$\ntkrnlpa.exe
2004-08-19 16:04 2058880 f252fae094c54572ece38a039f2103c4 C:\WINNT\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-02 20:07 2058880 73fa9c95d235844a36968c7852c7dbdd C:\WINNT\$NtUninstallKB931784$\ntkrnlpa.exe
2003-06-19 12:05 1697600 2ca714859f9b00e0b040aca419c94306 C:\WINNT\$NtUpdateRollupPackUninstall$\ntkrnlpa.exe
2007-02-28 18:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINNT\Driver Cache\i386\ntkrnlpa.exe
2004-08-19 16:04 2058880 f252fae094c54572ece38a039f2103c4 C:\WINNT\ServicePackFiles\i386\ntkrnlpa.exe
2007-03-06 06:03 1717056 12e5366b7d7eac583309cdada766b2e9 C:\WINNT\SoftwareDistribution\Download\8bdf2ca419d020065b70a2a4db72dfb8\ntkrnlpa.exe
2007-02-28 18:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINNT\system32\ntkrnlpa.exe
2007-02-28 18:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINNT\system32\dllcache\ntkrnlpa.exe

2005-03-02 20:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINNT\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 18:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINNT\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2001-09-28 14:00 1985920 fcda48a4ab042ba954dbaa4bac40c9b5 C:\WINNT\$NtServicePackUninstall$\ntoskrnl.exe
2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINNT\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-02 20:08 2181376 63729dd0f2aae36cc52b89c05505146c C:\WINNT\$NtUninstallKB931784$\ntoskrnl.exe
2003-06-19 12:05 1722576 7e71bc11f716d1a6489c64755f4809f0 C:\WINNT\$NtUpdateRollupPackUninstall$\ntoskrnl.exe
2007-02-28 18:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINNT\Driver Cache\i386\ntoskrnl.exe
2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINNT\ServicePackFiles\i386\ntoskrnl.exe
2007-03-06 06:03 1694400 a7ac10f8cea3d5d48e8a38f09462c448 C:\WINNT\SoftwareDistribution\Download\8bdf2ca419d020065b70a2a4db72dfb8\ntoskrnl.exe
2007-02-28 18:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINNT\system32\ntoskrnl.exe
2007-02-28 18:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINNT\system32\dllcache\ntoskrnl.exe
.
((((((((((((((((((((((((((((( snapshot@2008-04-22_12.10.49.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-22 07:48:19 41,918 ----a-w C:\WINNT\system32\perfc009.dat
+ 2008-04-22 10:05:38 41,918 ----a-w C:\WINNT\system32\perfc009.dat
- 2008-04-22 07:48:19 50,718 ----a-w C:\WINNT\system32\perfc00C.dat
+ 2008-04-22 10:05:38 50,718 ----a-w C:\WINNT\system32\perfc00C.dat
- 2008-04-22 07:48:19 317,000 ----a-w C:\WINNT\system32\perfh009.dat
+ 2008-04-22 10:05:38 317,000 ----a-w C:\WINNT\system32\perfh009.dat
- 2008-04-22 07:48:19 375,202 ----a-w C:\WINNT\system32\perfh00C.dat
+ 2008-04-22 10:05:38 375,202 ----a-w C:\WINNT\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-02-08 17:24 116088 --a------ C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"Iomega Automatic Backup Pro"="C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" [2005-07-01 10:12 18968576]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
"Synchronization Manager"="mobsync.exe" [2004-08-19 16:09 144384 C:\WINNT\system32\mobsync.exe]
"Drag'n'Drop_Autolaunch"="C:\Program Files\Iomega HotBurn\Autolaunch.exe" [2002-08-21 14:31 126976]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2008-01-31 14:15 51048]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 22:53 714608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Internet Help Svc"="IHSVC.EXE" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-19 15:52 44544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINNT\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINNT\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Symantec Fax Starter Edition Port.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Symantec Fax Starter Edition Port.lnk
backup=C:\WINNT\pss\Symantec Fax Starter Edition Port.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
c:\progra~1\scansoft\paperp~1\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--------- 2005-11-29 13:28 77824 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT]
C:\Program Files\Wanadoo\Shell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\Wanadoo\GestMaj.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
C:\PROGRA~1\Wanadoo\Watch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zzzHPSETUP]
D:\Setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINNT\system32\DRIVERS\IABFilt.sys [2005-07-01 10:15]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R3 qic157;qic157;C:\WINNT\system32\DRIVERS\qic157.sys [2004-08-03 23:00]
S3 COH_Mon;COH_Mon;C:\WINNT\system32\Drivers\COH_Mon.sys [2008-03-06 22:32]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-08 15:05:40 C:\WINNT\Tasks\Norton AntiVirus - Effectuer une analyse complète du système - Administrateur.job"
- C:\Program Files\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 14:22:03
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Iomega Automatic Backup Pro = "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s?????????????????????????????????????????????????????????????????

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
Temps d'accomplissement: 2008-04-22 14:26:24
ComboFix-quarantined-files.txt 2008-04-22 12:25:59

Pre-Run: 5,380,554,752 octets libres
Post-Run: 5,385,949,184 octets libres

282 --- E O F --- 2008-04-09 16:06:50