Bjr, j'ai eu le mème problème, le mieux c'est le reformatage, penser a faire régulièrement des resto système et au moindre problème tu restaure.

Salut numerix,


Télécharge HijackThis (outils de dignostic) ici :

-> Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau
-> http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
-> ftp://ftp.commentcamarche.com/download/HJTInstall.exe

-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

-> Clique sur Install ensuite sur I Accept

-> Clique sur Do a scan system and save log file

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                   Bonne écoute 
                   @ + T' Chiki.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:27:02, on 29/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{908D4FDB-2532-4BD0-A396-97F9077E1EE4}: NameServer = 41.221.20.4 193.251.169.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
End of file - 6720 bytes

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe




-> Double clique sur combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                   Bonne écoute 
                   @ + T' Chiki.

Voila le log de combofix:
et merci chiquitine29

ComboFix 08-09-28.01 - Administrateur 2008-10-01 9:26:42.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1256.213.1036.18.237 [GMT 1:00]
Lancé depuis: C:\Documents and Settings\Administrateur.ORDI-XPSP2\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !!/b/color
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrateur.ORDI-XPSP2\err.log
C:\Documents and Settings\Administrateur.ORDI-XPSP2\ResErrors.log
C:\Program Files\Instant Messenger Names
C:\WINDOWS\system32\dao350.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WASFSD
-------\Service_NPF


((((((((((((((((((((((((((((( Fichiers cr??s du 2008-09-01 au 2008-10-01 ))))))))))))))))))))))))))))))))))))
.

2042-09-09 11:25 . 2008-04-13 18:33 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2042-09-09 11:25 . 2008-04-13 18:33 21,504 --a------ C:\WINDOWS\system32\DllCache\hidserv.dll
2042-09-09 11:25 . 2008-04-13 18:05 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2042-09-09 11:25 . 2008-04-13 18:05 14,720 --a------ C:\WINDOWS\system32\DllCache\kbdhid.sys
2042-09-09 11:25 . 2008-04-13 10:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2042-09-09 11:25 . 2008-04-13 10:45 10,368 --a------ C:\WINDOWS\system32\DllCache\hidusb.sys
2042-09-09 11:24 . 2008-04-13 10:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2042-09-09 11:24 . 2008-04-13 10:45 32,128 --a------ C:\WINDOWS\system32\DllCache\usbccgp.sys
2008-10-01 01:50 . 2008-10-01 01:50 <REP> d-------- C:\Program Files\IEPro
2008-10-01 01:50 . 2008-10-01 01:51 <REP> d-------- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\IEPro
2008-10-01 00:28 . 2000-10-31 12:00 307,200 --a------ C:\WINDOWS\vidcap32.Exe
2008-10-01 00:28 . 2003-07-11 11:12 159,799 --a------ C:\WINDOWS\system32\VM31bPrp.Ax
2008-10-01 00:28 . 2002-08-22 16:34 147,456 --a------ C:\WINDOWS\VMCap.exe
2008-10-01 00:28 . 2004-03-22 16:22 90,559 --a------ C:\WINDOWS\system32\drivers\usbVM31b.sys
2008-10-01 00:28 . 2003-05-15 17:17 61,440 --a------ C:\WINDOWS\system32\VM31bSTI.dll
2008-10-01 00:28 . 2002-08-22 17:02 53,248 --a------ C:\WINDOWS\StillCap.exe
2008-10-01 00:28 . 2003-08-07 15:19 49,152 --a------ C:\WINDOWS\amcap.exe
2008-10-01 00:28 . 2003-01-21 15:19 40,960 --a------ C:\WINDOWS\Vm_sti.exe
2008-09-27 14:03 . 2008-09-27 14:03 <REP> d-------- C:\Graphics
2008-09-26 23:51 . 2008-04-13 19:33 116,736 --a------ C:\WINDOWS\system32\DllCache\xrxwiadr.dll
2008-09-26 23:51 . 2008-04-13 19:33 18,944 --a------ C:\WINDOWS\system32\DllCache\xrxscnui.dll
2008-09-26 23:50 . 2008-04-13 18:57 32,128 --a------ C:\WINDOWS\system32\DllCache\wceusbsh.sys
2008-09-26 23:50 . 2008-04-13 11:36 8,832 --a------ C:\WINDOWS\system32\DllCache\wmiacpi.sys
2008-09-26 23:50 . 2008-04-13 19:33 8,192 --a------ C:\WINDOWS\system32\DllCache\wshirda.dll
2008-09-26 23:49 . 2008-04-13 11:40 149,376 --a------ C:\WINDOWS\system32\DllCache\tffsport.sys
2008-09-26 23:49 . 2008-04-13 19:34 82,944 --a------ C:\WINDOWS\system32\DllCache\tp4mon.exe
2008-09-26 23:49 . 2008-04-13 11:45 60,032 --a------ C:\WINDOWS\system32\DllCache\usbaudio.sys
2008-09-26 23:49 . 2008-04-13 11:45 26,112 --a------ C:\WINDOWS\system32\DllCache\usbser.sys
2008-09-26 23:49 . 2008-04-13 11:47 25,856 --a------ C:\WINDOWS\system32\DllCache\usbprint.sys
2008-09-26 23:49 . 2008-04-13 11:45 17,152 --a------ C:\WINDOWS\system32\DllCache\usbohci.sys
2008-09-26 23:49 . 2008-04-13 11:45 15,104 --a------ C:\WINDOWS\system32\DllCache\usbscan.sys
2008-09-26 23:49 . 2008-04-13 11:40 5,376 --a------ C:\WINDOWS\system32\DllCache\viaide.sys
2008-09-26 23:48 . 2008-04-13 11:36 16,000 --a------ C:\WINDOWS\system32\DllCache\smbbatt.sys
2008-09-26 23:48 . 2008-04-13 11:40 7,552 --a------ C:\WINDOWS\system32\DllCache\sonyait.sys
2008-09-26 23:48 . 2008-04-13 11:36 6,912 --a------ C:\WINDOWS\system32\DllCache\smbclass.sys
2008-09-26 23:46 . 2008-04-13 19:07 2,025,984 --a------ C:\WINDOWS\system32\DllCache\ntkrpamp.exe
2008-09-26 23:46 . 2008-04-13 19:32 259,328 --a------ C:\WINDOWS\system32\DllCache\perm3dd.dll
2008-09-26 23:46 . 2008-04-13 19:32 211,584 --a------ C:\WINDOWS\system32\DllCache\perm2dll.dll
2008-09-26 23:46 . 2008-04-13 11:46 61,696 --a------ C:\WINDOWS\system32\DllCache\ohci1394.sys
2008-09-26 23:46 . 2008-04-13 11:54 28,672 --a------ C:\WINDOWS\system32\DllCache\nscirda.sys
2008-09-26 23:46 . 2008-04-13 11:44 28,032 --a------ C:\WINDOWS\system32\DllCache\perm3.sys
2008-09-26 23:46 . 2008-04-13 11:44 27,904 --a------ C:\WINDOWS\system32\DllCache\perm2.sys
2008-09-26 23:45 . 2008-04-13 19:34 56,832 --a------ C:\WINDOWS\system32\DllCache\msdvbnp.ax
2008-09-26 23:45 . 2008-04-13 11:46 51,200 --a------ C:\WINDOWS\system32\DllCache\msdv.sys
2008-09-26 23:45 . 2008-04-13 11:46 49,024 --a------ C:\WINDOWS\system32\DllCache\mstape.sys
2008-09-26 23:45 . 2008-04-13 11:41 26,112 --a------ C:\WINDOWS\system32\DllCache\memstpci.sys
2008-09-26 23:45 . 2008-04-13 11:54 22,016 --a------ C:\WINDOWS\system32\DllCache\msircomm.sys
2008-09-26 23:45 . 2008-04-13 11:46 15,232 --a------ C:\WINDOWS\system32\DllCache\mpe.sys
2008-09-26 23:44 . 2008-04-13 19:33 254,464 --a------ C:\WINDOWS\system32\DllCache\kdsusd.dll
2008-09-26 23:44 . 2008-04-13 19:34 153,088 --a------ C:\WINDOWS\system32\DllCache\irftp.exe
2008-09-26 23:44 . 2008-04-13 11:54 88,192 --a------ C:\WINDOWS\system32\DllCache\irda.sys
2008-09-26 23:44 . 2008-04-13 19:33 49,152 --a------ C:\WINDOWS\system32\DllCache\kdsui.dll
2008-09-26 23:44 . 2008-04-13 11:40 34,688 --a------ C:\WINDOWS\system32\DllCache\lbrtfdc.sys
2008-09-26 23:44 . 2008-04-13 19:33 29,184 --a------ C:\WINDOWS\system32\DllCache\irmon.dll
2008-09-26 23:44 . 2008-04-13 11:40 7,040 --a------ C:\WINDOWS\system32\DllCache\ltotape.sys
2008-09-26 23:43 . 2008-04-13 19:33 702,845 --a------ C:\WINDOWS\system32\DllCache\i81xdnt5.dll
2008-09-26 23:43 . 2008-04-13 11:41 18,560 --a------ C:\WINDOWS\system32\DllCache\i2omp.sys
2008-09-26 23:43 . 2008-04-13 11:41 8,576 --a------ C:\WINDOWS\system32\DllCache\i2omgmt.sys
2008-09-26 23:42 . 2008-04-13 11:45 59,136 --a------ C:\WINDOWS\system32\DllCache\gckernel.sys
2008-09-26 23:42 . 2008-04-13 18:59 28,544 --a------ C:\WINDOWS\system32\DllCache\grserial.sys
2008-09-26 23:42 . 2008-04-13 11:36 20,352 --a------ C:\WINDOWS\system32\DllCache\hidbatt.sys
2008-09-26 23:41 . 2008-04-13 11:39 206,976 --a------ C:\WINDOWS\system32\DllCache\dot4.sys
2008-09-26 23:41 . 2008-04-13 19:34 20,992 --a------ C:\WINDOWS\system32\DllCache\dshowext.ax
2008-09-26 23:41 . 2008-04-13 11:40 8,320 --a------ C:\WINDOWS\system32\DllCache\dlttape.sys
2008-09-26 23:40 . 2008-04-13 19:33 252,416 --a------ C:\WINDOWS\system32\DllCache\ctmasetp.dll
2008-09-26 23:40 . 2008-04-13 19:33 121,856 --a------ C:\WINDOWS\system32\DllCache\camext30.dll
2008-09-26 23:40 . 2008-04-13 11:36 13,952 --a------ C:\WINDOWS\system32\DllCache\cmbatt.sys
2008-09-26 23:40 . 2008-04-13 11:36 10,240 --a------ C:\WINDOWS\system32\DllCache\compbatt.sys
2008-09-26 23:40 . 2008-04-13 11:41 8,192 --a------ C:\WINDOWS\system32\DllCache\changer.sys
2008-09-26 23:39 . 2008-04-13 19:34 18,432 --a------ C:\WINDOWS\system32\DllCache\bdaplgin.ax
2008-09-26 23:39 . 2008-04-13 11:46 11,776 --a------ C:\WINDOWS\system32\DllCache\bdasup.sys
2008-09-26 23:38 . 2008-04-13 11:46 38,912 --a------ C:\WINDOWS\system32\DllCache\avc.sys
2008-09-26 23:38 . 2008-04-13 11:36 14,208 --a------ C:\WINDOWS\system32\DllCache\battc.sys
2008-09-26 23:38 . 2008-04-13 11:46 13,696 --a------ C:\WINDOWS\system32\DllCache\avcstrm.sys
2008-09-26 23:37 . 2008-04-13 19:07 2,147,328 --a------ C:\WINDOWS\system32\DllCache\ntkrnlmp.exe
2008-09-26 23:37 . 2008-04-13 11:46 53,376 --a------ C:\WINDOWS\system32\DllCache\1394bus.sys
2008-09-26 23:37 . 2008-04-13 11:46 48,128 --a------ C:\WINDOWS\system32\DllCache\61883.sys
2008-09-26 23:37 . 2008-04-13 11:40 12,288 --a------ C:\WINDOWS\system32\DllCache\4mmdat.sys
2008-09-26 23:26 . 2004-02-13 13:33 122,880 --a------ C:\WINDOWS\autoclk.exe
2008-09-26 23:26 . 2008-09-26 23:29 154 --a------ C:\WINDOWS\adidsl.ini
2008-09-26 23:25 . 2008-09-26 23:25 <REP> d-------- C:\Program Files\Huawei Technologies
2008-09-23 06:07 . 2008-09-23 06:07 <REP> d-------- C:\Program Files\uTorrent
2008-09-23 06:07 . 2008-09-26 02:40 <REP> d-------- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\uTorrent
2008-09-21 05:33 . 2008-09-21 06:06 <REP> d-------- C:\Program Files\KKE+
2008-09-21 05:33 . 1998-06-24 00:00 103,744 --a------ C:\WINDOWS\system32\mscomm32.ocx
2008-09-21 02:13 . 2008-09-21 02:15 <REP> d-------- C:\SDFix
2008-09-20 22:16 . 2008-09-20 22:27 <REP> d-------- C:\Program Files\RegCure
2008-09-20 06:08 . 2008-09-20 06:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-20 06:08 . 2008-09-20 06:08 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-09-20 06:08 . 2008-09-20 06:08 <REP> d-------- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Malwarebytes
2008-09-20 06:08 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-20 06:08 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-17 02:08 . 2006-05-25 14:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2008-09-17 02:08 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-09-17 02:08 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-09-17 02:08 . 2006-06-19 12:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2008-09-17 01:21 . 2008-09-17 01:21 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-09-16 04:07 . 2008-09-16 04:07 <REP> d-------- C:\Program Files\Trend Micro
2008-09-15 21:48 . 2008-09-17 16:05 <REP> d-------- C:\Program Files\oovooToolbar
2008-09-15 18:00 . 2006-12-28 11:01 19,569 --a------ C:\WINDOWS\[u]0/u00001_.tmp
2008-09-13 00:36 . 2008-09-13 00:36 <REP> d-------- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\HiYo
2008-09-06 23:46 . 2008-09-06 23:46 <REP> d-------- C:\Program Files\WordBiz

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-01 08:34 61,635,872 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-01 08:34 1,215,008 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-01 08:33 831,752 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-01 08:33 119,108 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-01 07:03 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-10-01 00:45 --------- d-----w C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Skype
2008-09-30 23:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-30 23:28 --------- d-----w C:\Program Files\Vimicro
2008-09-30 21:58 --------- d-----w C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\skypePM
2008-09-30 03:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Babylon
2008-09-28 22:36 --------- d-----w C:\Program Files\eMule
2008-09-27 01:33 --------- d-----w C:\Program Files\MacBoX_v.4
2008-09-27 01:08 --------- d-----w C:\Program Files\No-IP
2008-09-26 22:26 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-09-20 08:58 --------- d-----w C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Desktopicon
2008-09-19 03:51 --------- d-----w C:\Program Files\TpsbinExtract
2008-09-17 15:09 --------- d-----w C:\Program Files\Eset
2008-09-17 15:06 --------- d-----w C:\Program Files\FlashGet
2008-09-17 03:03 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-08-29 00:02 --------- d-----w C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\GlarySoft
2008-08-28 23:57 --------- d-----w C:\Program Files\Glary Utilities
2008-08-27 13:35 --------- d-----w C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\RayV
2008-08-26 02:53 --------- d-----w C:\Program Files\HexEdit
2008-08-26 02:53 --------- d-----w C:\Program Files\Fichiers communs\BCGSoft
2008-08-17 17:42 --------- d-----w C:\Program Files\AMT
2008-08-16 00:53 --------- d-----w C:\Program Files\CorvoBoys GBTool
2008-08-15 21:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\{31AF25DF-EFEB-4C20-8C2A-0ED5C4C1C794}
2008-08-12 12:36 --------- d-----w C:\Program Files\ODSLoader
2008-08-11 23:30 --------- d-----w C:\Program Files\ODSEdit
2008-08-09 16:17 --------- d-----w C:\Program Files\BTCreator
2008-08-09 09:30 --------- d-----w C:\Program Files\EMUKreator
2008-08-07 17:55 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-31 08:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 08:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 08:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\DllCache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\DllCache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\DllCache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\DllCache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\DllCache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\DllCache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\DllCache\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-12 06:18 467,984 ----a-w C:\WINDOWS\system32\d3dx10_39.dll
2008-07-12 06:18 3,851,784 ----a-w C:\WINDOWS\system32\D3DX9_39.dll
2008-07-12 06:18 1,493,528 ----a-w C:\WINDOWS\system32\D3DCompiler_39.dll
2008-01-09 17:44 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
2007-08-23 16:56 14 ----a-w C:\Documents and Settings\Administrateur.ORDI-XPSP2\getfile.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ?l?ments vides & les ?l?ments initiaux l?gitimes ne sont pas list?s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-04-30 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearDocsOnExit"= 64 (0x40)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ClearDocsOnExit"= 64 (0x40)
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^Administrateur.ORDI-XPSP2^Menu Démarrer^Programmes^Démarrage^Ela-Salaty.lnk]
backup=C:\WINDOWS\pss\Ela-Salaty.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrateur.ORDI-XPSP2^Menu Démarrer^Programmes^Démarrage^No-IP DUC.lnk]
backup=C:\WINDOWS\pss\No-IP DUC.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Hyperappel du Petit Larousse 2008.lnk]
backup=C:\WINDOWS\pss\Hyperappel du Petit Larousse 2008.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Prevx Home.lnk]
backup=C:\WINDOWS\pss\Prevx Home.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CameraFixer
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DC6cw
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner 2006
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RayV
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo Messengger

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 2008-02-08 17:36 227856 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
--a------ 2007-10-18 21:08 2841824 C:\Program Files\Babylon\Babylon-Pro\Babylon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-10-28 15:25 94208 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 18:34 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 14:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spontania Video Collaboration]
--a------ 2007-08-31 12:47 589932 C:\Program Files\Spontania Video Collaboration\SpontaniaVideoCollaboration.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-04-30 00:10 185896 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-03-01 06:10 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 15:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 16:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2003-01-01 00:49 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\French\\setup.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\IEPro\\MiniDM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7561:TCP"= 7561:TCP:*:Disabled:tcp
"7571:UDP"= 7571:UDP:*:Disabled:udp
"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443
"443:UDP"= 443:UDP:ooVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys [2007-08-07 33052]
R1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R2 Apple Mobile Device;Apple Mobile Device;C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 ioperm;ioperm support for Cygwin driver;C:\cygwin\bin\ioperm.sys [2005-11-22 12800]
R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
R3 CA561;ICatch (VI) PC Camera;C:\WINDOWS\system32\Drivers\SPCA561.SYS [2003-09-04 119798]
R3 E100B;Intel(R) PRO Network Connection Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft;C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 mxnic;Pilote Macronix MX987xx Family Fast Ethernet NT;C:\WINDOWS\system32\DRIVERS\mxnic.sys [2001-08-17 19968]
S2 ADILOADER;General Purpose USB Driver (adildr.sys);C:\WINDOWS\system32\Drivers\adildr.sys [2003-07-17 46167]
S3 DCamUSBIntel;USB Video Camera;C:\WINDOWS\system32\Drivers\TP6800.sys [ ]
S3 hidgame;Activateur de port HID à manette de jeu Microsoft;C:\WINDOWS\system32\DRIVERS\hidgame.sys [2001-08-17 8576]
S3 NdisIP;Connection TV/vidéo Microsoft;C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 Plx9054;Plx9054;C:\WINDOWS\system32\drivers\Plx9054.sys [2001-06-19 13724]
S3 SATDEM;SATDEM;C:\WINDOWS\system32\satdem.sys [2002-01-23 12268]
S3 SLIP;Détrameur décalage BDA;C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 ZSMC0305;VIMICRO USB PC Camera 301D;C:\WINDOWS\system32\Drivers\usbVM305.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{473acdb7-6512-11dc-b7de-000d61120dcf}]
\Shell\AutoRun\command - wscript.exe .\.vbs
\Shell\open\command - wscript.exe .\.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b2f2537-83a2-11dc-8c6c-000d61120dcf}]
\Shell\Auto\command - KM.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL KM.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e6ecd39-2706-11dc-841d-000d61120dcf}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83083aa8-1d14-11d7-8408-d503b94b7c39}]
\Shell\Auto\command - fun.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83083aa9-1d14-11d7-8408-d503b94b7c39}]
\Shell\Auto\command - fun.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{945772db-8954-11dd-bf5d-000d61120dcf}]
\Shell\Auto\command - auto.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
\Shell\explore\Command - xfoolavp.com
\Shell\open\Command - xfoolavp.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd8631e5-48d4-11dd-9f1e-000d61120dcf}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL systems.com
\Shell\read\command - explorer.exe
\Shell\start\command - systems.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efcfc8fd-f7d3-11db-a50c-000d61120dcf}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe
.
Contenu du dossier 'T?ches planifi?es'
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file)
MSConfigStartUp-ooVoo - (no file)


.
------- Examen suppl?mentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Mozilla\Firefox\Profiles\[u]0/u9nb3x7z.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1434207&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.forum-microsoft.org/topic86557.html
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-01 09:34:51
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cach?s ...

Recherche d'?l?ments en d?marrage automatique cach?s ...

Recherche de fichiers cach?s ...

Scan termin? avec succ?s
Fichiers cach?s: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\DSLMON.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Heure de fin: 2008-10-01 9:42:01 - La machine a red?marr?
ComboFix-quarantined-files.txt 2008-10-01 08:41:53

Avant-CF: 1ے776ے267ے264 octets libres
Après-CF: 1,706,291,200 octets libres

395 --- E O F --- 2008-08-25 01:57:24

Télécharge RavAntivirus d'Evosla sur ton bureau : http://www.evosla.com/compteur.php?soft=rav_antivirus
- Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir avant de lancer ce FIX
- Clique droit sur le fichier .ZIP, puis "Extraire vers" Bureau.
- Doucle-clique sur "RAV.exe" pour lancer le fix.
- Laisse le programme agir (10 min) : il scanne automatiquement tout les lecteurs (disques fixes et amovibles)

- Ensuite : retire tes disques amovibles et redémarre le PC.


ENSUITE :


> Télécharge Flash_Disinfector (de sUBs) sur ton bureau : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
- Double clique dessus puis laisse toi guider.


Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.
http://images.malwareremoval.com/random/RSIT.exe
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit .

A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                   Bonne écoute 
                   @ + T' Chiki.

Voila le compte rendu de hijackthis et merci
Logfile of random's system information tool 1.04 (written by random/random)
Run by Administrateur at 2008-10-01 13:03:10
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 2 GB (6%) free of 26 GB
Total RAM: 511 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03:16, on 01/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur.ORDI-XPSP2\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ie7pro.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{908D4FDB-2532-4BD0-A396-97F9077E1EE4}: NameServer = 41.221.20.4 193.251.169.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
End of file - 7044 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GlaryInitialize.job
C:\WINDOWS\tasks\RegCure Program Check.job
C:\WINDOWS\tasks\RegCure.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}]
IE7Pro BHO - C:\Program Files\IEPro\iepro.dll [2008-09-24 756840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll [2007-12-18 817936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-04-30 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2007-12-12 222448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-18 163840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! ¤u¨م¦C - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll [2007-12-18 817936]
{E0E899AB-F487-11D5-8D29-0050BA6940E3}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2008-04-30 185896]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2008-02-08 227856]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2008-02-08 227856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe [2007-10-18 2841824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe [2005-10-28 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CameraFixer]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DC6cw]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner 2006]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RayV]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2008-05-30 21718312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2003-01-01 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spontania Video Collaboration]
C:\Program Files\Spontania Video Collaboration\SpontaniaVideoCollaboration.exe [2007-08-31 589932]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2008-04-30 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe [2008-03-01 15872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USS]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo Messengger]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur.ORDI-XPSP2^Menu Démarrer^Programmes^Démarrage^Ela-Salaty.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur.ORDI-XPSP2^Menu Démarrer^Programmes^Démarrage^No-IP DUC.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Hyperappel du Petit Larousse 2008.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
C:\PROGRA~1\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Prevx Home.lnk]
[]

C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage
DSLMON.lnk - C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-02-08 219664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ClearDocsOnExit"=64
"MemCheckBoxInRunDlg"=1
"NoSMBalloonTip"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"NoAutoUpdate"=1
"NoDrives"=0
"NofolderOptions"=0
"NoFind"=0
"NoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"NoFolderOptions"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\WINDOWS\system32\dxdiag.exe"="C:\WINDOWS\system32\dxdiag.exe:*:Enabled:Outil de diagnostic Microsoft DirectX"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Disabled:eMule"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\IEPro\MiniDM.exe"="C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{473acdb7-6512-11dc-b7de-000d61120dcf}]
shell\AutoRun\command - wscript.exe .\.vbs
shell\open\command - wscript.exe .\.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b2f2537-83a2-11dc-8c6c-000d61120dcf}]
shell\Auto\command - KM.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL KM.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e6ecd39-2706-11dc-841d-000d61120dcf}]
shell\AutoRun\command - RavMon.exe
shell\explore\command - RavMon.exe -e
shell\open\command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83083aa8-1d14-11d7-8408-d503b94b7c39}]
shell\Auto\command - fun.xls.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83083aa9-1d14-11d7-8408-d503b94b7c39}]
shell\Auto\command - fun.xls.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{945772db-8954-11dd-bf5d-000d61120dcf}]
shell\Auto\command - auto.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
shell\explore\command - xfoolavp.com
shell\open\command - xfoolavp.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd8631e5-48d4-11dd-9f1e-000d61120dcf}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL systems.com
shell\read\command - explorer.exe
shell\start\command - systems.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efcfc8fd-f7d3-11db-a50c-000d61120dcf}]
shell\AutoRun\command - RavMon.exe
shell\explore\command - RavMon.exe -e
shell\open\command - RavMon.exe


======File associations======

.scr - config - "%1" %*

======List of files/folders created in the last 1 months======

2042-09-09 11:25:13 ----A---- C:\WINDOWS\system32\hidserv.dll
2008-10-01 13:03:10 ----D---- C:\rsit
2008-10-01 12:37:09 ----SHD---- C:\RECYCLER
2008-10-01 09:42:15 ----D---- C:\WINDOWS\temp
2008-10-01 09:42:02 ----A---- C:\ComboFix.txt
2008-10-01 09:25:33 ----D---- C:\WINDOWS\erdnt
2008-10-01 09:23:39 ----D---- C:\QooBox
2008-10-01 09:23:29 ----A---- C:\WINDOWS\zip.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\VFind.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\SWSC.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\swreg.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\sed.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\Nircmd.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\grep.exe
2008-10-01 09:23:29 ----A---- C:\WINDOWS\fdsv.exe
2008-10-01 09:23:28 ----A---- C:\WINDOWS\swxcacls.exe
2008-10-01 08:06:06 ----A---- C:\Bug.txt
2008-10-01 01:50:44 ----D---- C:\Program Files\IEPro
2008-10-01 01:50:24 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\IEPro
2008-10-01 00:28:54 ----A---- C:\WINDOWS\amcap.exe
2008-10-01 00:28:52 ----A---- C:\WINDOWS\Vm_sti.exe
2008-10-01 00:28:52 ----A---- C:\WINDOWS\system32\VM31bSTI.dll
2008-10-01 00:28:51 ----A---- C:\WINDOWS\vidcap32.Exe
2008-10-01 00:28:51 ----A---- C:\WINDOWS\StillCap.exe
2008-10-01 00:28:50 ----A---- C:\WINDOWS\VMCap.exe
2008-09-27 14:03:34 ----D---- C:\Graphics
2008-09-26 23:26:23 ----A---- C:\WINDOWS\adidsl.ini
2008-09-26 23:26:00 ----A---- C:\WINDOWS\autoclk.exe
2008-09-26 23:25:56 ----A---- C:\WINDOWS\system32\AdADIx32.dll
2008-09-26 23:25:56 ----A---- C:\WINDOWS\system32\ADADIX16.DLL
2008-09-26 23:25:55 ----A---- C:\WINDOWS\system32\unaddrv.exe
2008-09-26 23:25:55 ----A---- C:\WINDOWS\system32\AdADIx2K.dll
2008-09-26 23:25:51 ----D---- C:\Program Files\Huawei Technologies
2008-09-23 06:07:15 ----D---- C:\Program Files\uTorrent
2008-09-23 06:07:12 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\uTorrent
2008-09-21 05:33:34 ----D---- C:\Program Files\KKE+
2008-09-21 02:13:28 ----D---- C:\SDFix
2008-09-20 22:16:14 ----D---- C:\Program Files\RegCure
2008-09-20 06:23:07 ----A---- C:\WINDOWS\system32\mxbk.txt
2008-09-20 06:08:36 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Malwarebytes
2008-09-20 06:08:26 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-09-20 06:08:25 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-20 04:56:15 ----HDC---- C:\WINDOWS\ie7
2008-09-17 02:08:43 ----A---- C:\WINDOWS\system32\ztvunrar36.dll
2008-09-17 02:08:43 ----A---- C:\WINDOWS\system32\ztvcabinet.dll
2008-09-17 02:08:43 ----A---- C:\WINDOWS\system32\UNRAR3.dll
2008-09-17 02:08:43 ----A---- C:\WINDOWS\system32\unacev2.dll
2008-09-17 01:21:44 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-09-16 04:07:04 ----D---- C:\Program Files\Trend Micro
2008-09-15 21:48:11 ----D---- C:\Program Files\oovooToolbar
2008-09-15 18:09:43 ----D---- C:\WINDOWS\Prefetch
2008-09-15 18:00:30 ----A---- C:\WINDOWS\000001_.tmp
2008-09-13 00:36:27 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\HiYo
2008-09-06 23:46:17 ----D---- C:\Program Files\WordBiz

======List of files/folders modified in the last 1 months======

2008-10-01 12:58:05 ----D---- C:\Program Files\Mozilla Firefox
2008-10-01 12:56:59 ----D---- C:\WINDOWS\system32\CatRoot2
2008-10-01 12:56:23 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-10-01 12:54:13 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-01 09:42:18 ----D---- C:\WINDOWS\system32
2008-10-01 09:42:17 ----HD---- C:\WINDOWS\system32\drivers
2008-10-01 09:42:15 ----D---- C:\WINDOWS
2008-10-01 09:34:49 ----A---- C:\WINDOWS\system.ini
2008-10-01 09:32:30 ----D---- C:\WINDOWS\system32\config
2008-10-01 09:30:00 ----D---- C:\WINDOWS\AppPatch
2008-10-01 09:30:00 ----D---- C:\Program Files\Fichiers communs
2008-10-01 09:27:15 ----D---- C:\Program Files
2008-10-01 01:46:55 ----A---- C:\WINDOWS\NeroDigital.ini
2008-10-01 01:45:33 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Skype
2008-10-01 00:31:19 ----D---- C:\WINDOWS\system32\DllCache
2008-10-01 00:30:01 ----HD---- C:\WINDOWS\inf
2008-10-01 00:28:49 ----D---- C:\WINDOWS\CatRoot
2008-10-01 00:28:48 ----D---- C:\WINDOWS\twain_32
2008-10-01 00:28:48 ----D---- C:\Program Files\Vimicro
2008-10-01 00:28:47 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-30 22:58:57 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\skypePM
2008-09-30 04:37:27 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Babylon
2008-09-28 23:36:44 ----D---- C:\Program Files\eMule
2008-09-27 11:43:16 ----A---- C:\WINDOWS\cdplayer.ini
2008-09-27 02:33:51 ----D---- C:\Program Files\MacBoX_v.4
2008-09-27 02:08:32 ----D---- C:\Program Files\No-IP
2008-09-26 21:27:45 ----D---- C:\WINDOWS\Help
2008-09-22 17:51:56 ----D---- C:\WINDOWS\Minidump
2008-09-20 22:16:20 ----SD---- C:\WINDOWS\Tasks
2008-09-20 09:58:15 ----D---- C:\Documents and Settings\Administrateur.ORDI-XPSP2\Application Data\Desktopicon
2008-09-20 05:15:20 ----D---- C:\WINDOWS\Debug
2008-09-20 05:04:05 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-09-20 05:02:31 ----D---- C:\Program Files\Internet Explorer
2008-09-20 04:58:27 ----D---- C:\WINDOWS\WBEM
2008-09-20 04:58:27 ----D---- C:\WINDOWS\system32\fr-fr
2008-09-20 04:58:16 ----D---- C:\WINDOWS\Media
2008-09-20 04:55:56 ----D---- C:\WINDOWS\system32\CatRoot
2008-09-19 04:51:36 ----D---- C:\Program Files\TpsbinExtract
2008-09-17 16:09:19 ----SHD---- C:\Config.Msi
2008-09-17 16:09:17 ----D---- C:\Program Files\Eset
2008-09-17 16:09:05 ----SHD---- C:\WINDOWS\Installer
2008-09-17 16:06:44 ----D---- C:\Program Files\FlashGet
2008-09-17 15:50:25 ----SH---- C:\boot.ini
2008-09-17 15:50:25 ----A---- C:\WINDOWS\win.ini
2008-09-17 14:34:51 ----D---- C:\WINDOWS\pss
2008-09-17 04:03:50 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-09-15 18:07:59 ----D---- C:\WINDOWS\security
2008-09-15 18:05:31 ----D---- C:\Program Files\Messenger
2008-09-15 18:01:35 ----D---- C:\WINDOWS\system32\oobe
2008-09-15 18:00:27 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-09-15 17:59:25 ----D---- C:\WINDOWS\ehome
2008-09-15 02:25:47 ----D---- C:\WINDOWS\system32\wbem
2008-09-15 02:25:46 ----D---- C:\WINDOWS\Registration
2008-09-14 22:20:08 ----D---- C:\WINDOWS\network diagnostic
2008-09-11 02:10:18 ----D---- C:\Program Files\WinZip
2008-09-11 02:10:18 ----D---- C:\Program Files\WinRAR
2008-09-02 15:26:17 ----A---- C:\WINDOWS\patcher.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 klif;Klif; \??\C:\WINDOWS\system32\drivers\klif.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2007-08-07 33052]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R2 ioperm;ioperm support for Cygwin driver; \??\C:\cygwin\bin\ioperm.sys []
R3 adiusbae;USB ADSL LAN Adapter; C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 CA561;ICatch (VI) PC Camera; C:\WINDOWS\System32\Drivers\SPCA561.SYS [2003-09-04 119798]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 mxnic;Pilote Macronix MX987xx Family Fast Ethernet NT; C:\WINDOWS\system32\DRIVERS\mxnic.sys [2001-08-17 19968]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
S2 ADILOADER;General Purpose USB Driver (adildr.sys); C:\WINDOWS\System32\Drivers\adildr.sys [2003-07-17 46167]
S2 ASCTRM;ASCTRM; C:\WINDOWS\system32\drivers\ASCTRM.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 DCamUSBIntel;USB Video Camera; C:\WINDOWS\System32\Drivers\TP6800.sys []
S3 hidgame;Activateur de port HID à manette de jeu Microsoft; C:\WINDOWS\system32\DRIVERS\hidgame.sys [2001-08-17 8576]
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 Plx9054;Plx9054; C:\WINDOWS\system32\drivers\Plx9054.sys [2001-06-19 13724]
S3 SATDEM;SATDEM; C:\WINDOWS\system32\satdem.sys [2002-01-23 12268]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 ZSMC0305;VIMICRO USB PC Camera 301D; C:\WINDOWS\System32\Drivers\usbVM305.sys []
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 AVP;Kaspersky Internet Security 7.0; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2008-02-08 227856]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-01-01 323584]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-01-01 89600]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]

-----------------EOF-----------------

Telecharge FindyKill sur ton bureau :

--> Lance l installation avec les parametres par default

--> Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir


--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 1 (Recherche)

--> Post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque


A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                   Bonne écoute 
                   @ + T' Chiki.