Virus, oui mais lequel ?

Voici le rapport:
Merci pour la rapidité ... wow

Rapport GenProc 2.009 [1] effectué le 01.08.2008 à 17:14:16.65 - Windows XP

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.

# Etape 1/ Télécharge :

- Navilog1 (IL-MAFIOSO) http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe sur ton bureau. Double clique sur navilog1.exe pour lancer l'installation. Une fois l'installation terminée, le fix s'exécutera automatiquement (si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). Laisse-toi guider. Au menu principal, choisis 1 et valide.
Patiente jusqu'au message " Analyse Termine le .....". Appuie sur une touche comme demandé, le blocnote va s'ouvrir, poste-le maintenant et passe à la suite.

- MSNFix.zip (!aur3n7) http://sosvirus.changelog.fr/MSNFix.zip et décompresse-le sur le Bureau.


***** Copie la suite de la procédure dans un fichier texte et redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ (choisis ta session courante "Bernard") *****


# Etape 2/

* Double clique sur le raccourci Navilog1, choisis l'option 2 et valide, patiente jusqu'au message : *** Nettoyage Termine le ..... ***, le blocnote va s'ouvrir ; sauvegarde le rapport de manière à le retrouver, referme le blocnote. Ton bureau va réapparaitre

# Etape 3/

Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau.

# Etape 4/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 5/

Redémarre normalement et poste, dans la même réponse :
- Un nouveau rapport HijackThis, http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Le contenu du fichier cleannavi.txt qui se trouve dans Poste de travail C:\ ;
- Le contenu du rapport MSNfix situé sur le Bureau ;


Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

Merci Poussinou, mais une chose à la fois. J'ai commencé avec eZula qui a été plus rapide. Et je reviendrai ensuite vers toi si ça ne fonctionne pas.
Mais merci infiniment pour ton intervention

Ezula, voici le rapport GenProc\ Arguments:
~~ Arguments ~~

# Détections GenProc 2.009 01.08.2008 17:14:16.62 - C:\Documents and Settings\Bernard\Bureau\GenProc\outil

Navipromo:le 01.08.2008 à 17:14:17.90 HKCU\....\Lanconfig
MSNFix:le 01.08.2008 à 17:14:24.71 "C:\WINDOWS\System32\tmp.txt"

Pour ce qui est du rapport précédent de GenProc, je n'ai pas pu faire grand'chose:
- CCleaner: la case était déjà décochée
- Navilog: refuse de s'installer, ni en mode normal ni en mode sans échec
- MSNFix: voici le premier rapport:

MSNFix 1.714

C:\programmes telecharges\S‚curit‚ PC\MSNFix\MSNFix\MSNFix
Fix exécuté le 01.08.2008 - 17:36:32.62 By Bernard
mode normal

************************ Recherche les fichiers présents

... C:\WINDOWS\system32\tmp.txt

************************ Recherche les dossiers présents

Aucun dossier trouvé




************************ Suppression des fichiers

/!\ ... C:\WINDOWS\system32\tmp.txt



************************ Nettoyage du registre



Les fichiers encore présents seront supprimés au prochain redémarrage


************************ Suppression des fichiers

.. OK ... C:\WINDOWS\system32\tmp.txt



************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\WINDOWS\system32\winivstr.exe] 49C49729762CF479B92EAD3DD84AE0AD
[C:\WINDOWS\Cursors\CursorFX_public.exe] 6BD6EC91306C26C53C8D068A81540938
[C:\DOCUME~1\Bernard\LOCALS~1\Temp\Binaries1.zip] 0E03E9D5D629E40DB88273344CC043AD
[C:\DOCUME~1\Bernard\LOCALS~1\Temp\Binaries2.zip] B678DD811D786B55CD5FD92E4B6B33AD
[C:\DOCUME~1\Bernard\LOCALS~1\Temp\Binaries3.zip] EE778A555B9709CAC8666FCA5A413396

[color=#FF0000][b]==>/b/color SVP merci d'envoyer le fichier [b] C:\DOCUME~1\Bernard\Bureau\Upload_Me.zip /b sur http://upload.changelog.fr



Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 01.08.2008_174045.65.zip

************************ HKLM\...\Winlogon\Userinit

Userinit = C:\WINDOWS\system32\userinit.exe,


------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Voici le second rapport:
MSNFix 1.714

C:\programmes telecharges\S‚curit‚ PC\MSNFix\MSNFix\MSNFix
Fix exécuté le 01.08.2008 - 17:49:17.62 By Bernard
mode sans échec

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé


************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\WINDOWS\system32\winivstr.exe] 49C49729762CF479B92EAD3DD84AE0AD
[C:\WINDOWS\Cursors\CursorFX_public.exe] 6BD6EC91306C26C53C8D068A81540938
[C:\DOCUME~1\Bernard\LOCALS~1\Temp\Binaries1.zip] 0E03E9D5D629E40DB88273344CC043AD
[C:\DOCUME~1\Bernard\LOCALS~1\Temp\Binaries2.zip] B678DD811D786B55CD5FD92E4B6B33AD
[C:\DOCUME~1\Bernard\LOCALS~1\Temp\Binaries3.zip] EE778A555B9709CAC8666FCA5A413396

[color=#FF0000][b]==>/b/color SVP merci d'envoyer le fichier [b] C:\DOCUME~1\Bernard\Bureau\Upload_Me.zip /b sur http://upload.changelog.fr



************************ HKLM\...\Winlogon\Userinit

Userinit = C:\WINDOWS\system32\userinit.exe,


------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Ensuite, j'ai lancé CCleaner et j'ai copié ce qu'il a effacé (3 pages en .doc), si tu en as besoin, je te les copie.
Actuellement, je suis en mode normal, ss échec je n'ai pas de liaison Internet.
Que dois-je faire ?

Non aucun message, lorsque je veux lancer l'executable il ne se passe strictement rien ...

Ce p...fichu virus semble tout bloquer, lorsque je clique sur l'exe de Hijack, il ne se passe rien ...
Alors quand tu dis "rien de méchant", moi je trouve ça inquiétant ...

Mon anti virus a été désactivé par le virus ...
Voici le rapport:

"Silent Runners.vbs", revision 58, https://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"TClockEx" = "C:\PROGRA~1\TClockEx\TCLOCKEX.EXE" ["Dale Nurden"]
"SweetIM" = "C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" ["MacroGaming LTD."]
"Copernic Desktop Search 2" = ""C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray" ["Copernic Inc."]
"DW6" = ""C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"" ["The Weather Channel Interactive, Inc."]
"braviax" = "C:\WINDOWS\system32\braviax.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
"Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."]
"JMB36X Configure" = "C:\WINDOWS\system32\JMRaidTool.exe boot" ["JMicron Technology Corp."]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"Share-to-Web Namespace Daemon" = "c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"type32" = ""C:\Program Files\Microsoft IntelliType Pro\type32.exe"" [MS]
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"IntelliPoint" = ""C:\Program Files\Microsoft IntelliPoint\ipoint.exe"" [MS]
"SiteAdvisor" = ""C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"" ["McAfee, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Inc."]
"braviax" = "C:\WINDOWS\system32\braviax.exe" [null data]
"XP SecurityCenter" = ""C:\Program Files\XPSecurityCenter\XPSecurityCenter.exe" /hide" [file not found]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM...CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statistiques d’Anti-Virus Internet"
-> {HKLM...CLSID} = "Statistiques d’Anti-Virus Internet"
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll" ["Kaspersky Lab"]
"{79BC0345-1015-11D2-A299-006008312725}" = "blue.shell"
-> {HKLM...CLSID} = "Studio.Project"
\InProcServer32\(Default) = "C:\Program Files\Pinnacle\Studio 11\programs\BlueShellExt.dll" [null data]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{2086A549-ED96-4DC9-BBE3-0538AB29ABEC}" = "PSP Thumbnail Handler Shell Extension"
-> {HKLM...CLSID} = "PSP Thumbnail Handler Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Corel\PSPThumb.dll" ["Bot Productions"]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Dossier de téléchargement Share-to-Web "
-> {HKLM...CLSID} = "Dossier de téléchargement Share-to-Web "
\InProcServer32\(Default) = "c:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}" = "BitDefender Antivirus v7"
-> {HKLM...CLSID} = "BitDefender Antivirus v7"
\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender Free Edition\bdshelxt.dll" ["SOFTWIN S.R.L."]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Mes dossiers de partage"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll" [MS]
"{28211FD1-0054-4621-A724-8FEC49E4ED7B}" = "AxCrypt Privacy Wrapper File"
-> {HKLM...CLSID} = "axcrypt.File"
\InProcServer32\(Default) = "C:\Program Files\Axon Data\AxCrypt\1.6.3\AxCrypt.dll" ["Axantum Software AB"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{97FA8AA2-EE77-4FF2-9449-424D8924EF21}" = "IntelliType Pro Zooming Control Panel Property Page"
-> {HKLM...CLSID} = "IntelliType Pro Zooming Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplzm.dll"" [MS]
"{111D8120-25EB-4E1C-A4DF-C9EE5FCA35CB}" = "IntelliType Pro Scrolling Control Panel Property Page"
-> {HKLM...CLSID} = "IntelliType Pro Scrolling Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplwhl.dll"" [MS]
"{ED6E87C6-8A83-43aa-8208-8DBC8247F4D2}" = "IntelliType Pro Key Settings Control Panel Property Page"
-> {HKLM...CLSID} = "IntelliType Pro Key Settings Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplkey.dll"" [MS]
"{A2569D1F-4E06-43EC-9825-0088B471BE47}" = "IntelliType Pro Wireless Control Panel Property Page"
-> {HKLM...CLSID} = "IntelliType Pro Wireless Control Panel Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliType Pro\itcplwir.dll"" [MS]
"{20082881-FC36-4E47-9A7A-644C95FF749F}" = "IntelliPoint Wireless Control Panel Property Page"
-> {HKLM...CLSID} = "Page de propriétés sans fil"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplwir.dll"" [MS]
"{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE}" = "IntelliPoint Wheel Control Panel Property Page"
-> {HKLM...CLSID} = "Page des propriétés de la roulette"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplwhl.dll"" [MS]
"{653DCCC2-13DB-45B2-A389-427885776CFE}" = "IntelliPoint Activities Control Panel Property Page"
-> {HKLM...CLSID} = "Page des propriétés des activités"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplact.dll"" [MS]
"{124597D8-850A-41AE-849C-017A4FA99CA2}" = "IntelliPoint Buttons Control Panel Property Page"
-> {HKLM...CLSID} = "Page des propriétés des boutons"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplbtn.dll"" [MS]
"{0563DB41-F538-4B37-A92D-4659049B7766}" = "WLMD Message Handler"
-> {HKLM...CLSID} = "CLSID_WLMCMimeFilter"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Mail\mailcomm.dll" [MS]
"{00F33137-EE26-412F-8D71-F84E4C2C6625}" = (no title provided)
-> {HKLM...CLSID} = "Windows Live Photo Gallery Import Autoplay Shim"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll" [MS]
"{00F346CB-35A4-465B-8B8F-65A29DBAB1F6}" = "Windows Live Photo Gallery Viewer Drop Target Shim"
-> {HKLM...CLSID} = "Windows Live Photo Gallery Viewer Shim"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll" [MS]
"{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D}" = "Windows Live Photo Gallery Editor Drop Target Shim"
-> {HKLM...CLSID} = "Windows Live Photo Gallery Editor Shim"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll" [MS]
"{00F30F90-3E96-453B-AFCD-D71989ECC2C7}" = "Windows Live Photo Gallery Autoplay Drop Target Shim"
-> {HKLM...CLSID} = "Windows Live Photo Gallery Viewer Autoplay Shim"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll" [MS]
"{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}" = "SmartFTP Drop ShellIconOverlayHandler"
-> {HKLM...CLSID} = "SmartFTP Drop ShellIconOverlayHandler"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
"{40FDFA48-5F4E-4627-A78E-6A49A3D4492F}" = "SmartFTP ShellDropHandler"
-> {HKLM...CLSID} = "SmartFTP ShellDropHandler Class"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
"{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}" = "SmartFTP ContextMenu"
-> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
"{39DD67E0-73B6-4a11-AF55-49E1EBBF72BE}" = "SmartFTP Favorites Namespace"
-> {HKLM...CLSID} = "SmartFTP FavoritesShellFolder Class"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFavoritesShellExtension.dll" ["SmartSoft Ltd."]
"{82AA9188-44E0-40B9-B956-43A10C315B4F}" = "SmartFTP Shell Namespace Extension"
-> {HKLM...CLSID} = "RootShellFolder Class"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll" ["SmartSoft Ltd."]
"{2ED7FD81-CBA6-45E5-A49A-5E84889A94E2}" = "SmartFTP Drop Handler"
-> {HKLM...CLSID} = "ShellFolderDragDropHandler Class"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll" ["SmartSoft Ltd."]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> avldr\DLLName = "avldr.dll" [file not found]
<<!>> dimsntfy\DLLName = "C:\WINDOWS\System32\dimsntfy.dll" [MS]
<<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
axcrypt.File\(Default) = "{28211FD1-0054-4621-A724-8FEC49E4ED7B}"
-> {HKLM...CLSID} = "axcrypt.File"
\InProcServer32\(Default) = "C:\Program Files\Axon Data\AxCrypt\1.6.3\AxCrypt.dll" ["Axantum Software AB"]
BitDefender Antivirus v7\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {HKLM...CLSID} = "BitDefender Antivirus v7"
\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender Free Edition\bdshelxt.dll" ["SOFTWIN S.R.L."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\ShellEx.dll" ["Kaspersky Lab"]
PandoShellExt\(Default) = "{9C150845-2A2D-44CC-90B3-AA03480AA3D2}"
-> {HKLM...CLSID} = "PDShellExt Class"
\InProcServer32\(Default) = "C:\Program Files\Pando Networks\Pando\PandoShellExt.dll" ["Pando Networks"]
SmartFTP\(Default) = "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}"
-> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]
PandoShellExt\(Default) = "{9C150845-2A2D-44CC-90B3-AA03480AA3D2}"
-> {HKLM...CLSID} = "PDShellExt Class"
\InProcServer32\(Default) = "C:\Program Files\Pando Networks\Pando\PandoShellExt.dll" ["Pando Networks"]
SmartFTP\(Default) = "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}"
-> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
axcrypt.File\(Default) = "{28211FD1-0054-4621-A724-8FEC49E4ED7B}"
-> {HKLM...CLSID} = "axcrypt.File"
\InProcServer32\(Default) = "C:\Program Files\Axon Data\AxCrypt\1.6.3\AxCrypt.dll" ["Axantum Software AB"]
BitDefender Antivirus v7\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {HKLM...CLSID} = "BitDefender Antivirus v7"
\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender Free Edition\bdshelxt.dll" ["SOFTWIN S.R.L."]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

LightScribeOnArrivalAP\
"Provider" = "LightScribe Direct Disc Labeling"
"InvokeProgID" = "LightScribe.AutoPlayHandler"
"InvokeVerb" = "LabelLightScribeDisc"
HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "C:\Program Files\Fichiers communs\LightScribe\LsLauncher.exe" ["Hewlett-Packard Company"]

MSLivePhotoAcqHWEventHandler\
"Provider" = "@C:\Program Files\Windows Live\Photo Gallery\regres.dll,-10"
"ProgID" = "Microsoft.LivePhotoAcqHWEventHandler"
HKLM\SOFTWARE\Classes\Microsoft.LivePhotoAcqHWEventHandler\CLSID\(Default) = "{3BD0ACD1-71CA-4475-92CC-E0AA0AAF843F}"
-> {HKLM...CLSID} = (no title provided)
\LocalServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe" [MS]

MSLivePhotoAcquireDropHandler\
"Provider" = "@C:\Program Files\Windows Live\Photo Gallery\regres.dll,-10"
"InvokeProgID" = "Microsoft.LivePhotoAcqDTShim.1"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\Microsoft.LivePhotoAcqDTShim.1\shell\open\DropTarget\CLSID = "{00F33137-EE26-412F-8D71-F84E4C2C6625}"
-> {HKLM...CLSID} = "Windows Live Photo Gallery Import Autoplay Shim"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll" [MS]

MSLiveShowPicturesOnArrival\
"Provider" = "@C:\Program Files\Windows Live\Photo Gallery\regres.dll,-10"
"InvokeProgID" = "Microsoft.Photos.LiveAutoplayShim.1"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\Microsoft.Photos.LiveAutoplayShim.1\shell\open\DropTarget\CLSID = "{00F30F90-3E96-453B-AFCD-D71989ECC2C7}"
-> {HKLM...CLSID} = "Windows Live Photo Gallery Viewer Autoplay Shim"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll" [MS]

MSLiveVideoCameraArrivalCaptureWizard\
"Provider" = "@C:\Program Files\Windows Live\Photo Gallery\regres.dll,-10"
"ProgID" = "WLXAutoPlayMgr.WLXHWEventHandler"
"InitCmdLine" = "WLXVideoAcquireWizard"
HKLM\SOFTWARE\Classes\WLXAutoPlayMgr.WLXHWEventHandler\CLSID\(Default) = "{9B5C97F6-B3A5-4A6D-8B03-993EC7291A22}"
-> {HKLM...CLSID} = "WLXWEventHandler Class"
\LocalServer32\(Default) = ""C:\Program Files\Windows Live\Photo Gallery\WLXVideoCameraAutoPlayManager.exe"" [MS]

MSWPDShellNamespaceHandler\
"Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = " "
-> {HKLM...CLSID} = "WPDShextAutoplay"
\LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS]

NeroAutoPlay7VideoCapture\
"Provider" = "Nero Vision Essentials"
"ProgID" = "Shell.HWEventHandlerShellExecute"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

NeroAutoPlay8AudioToNeroDigital\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:SaveTracks %L" ["Nero AG"]

NeroAutoPlay8CDAudio\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "CDAudio_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:AudioCD" ["Nero AG"]

NeroAutoPlay8CopyCD\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:DiscCopy %L" ["Nero AG"]

NeroAutoPlay8DataDisc_CD\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "DataDisc_CD_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_CD_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:ISODisc /Media:CD %L" ["Nero AG"]

NeroAutoPlay8DataDisc_DVD\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "DataDisc_DVD_HandleDVDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_DVD_HandleDVDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:ISODisc /Media:DVD %L" ["Nero AG"]

NeroAutoPlay8LaunchNeroStartSmart\
"Provider" = "Nero StartSmart"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "LaunchNeroStartSmart_HandleDVDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\LaunchNeroStartSmart_HandleDVDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe /AutoPlay" ["Nero AG"]

NeroAutoPlay8PlayAudioCD\
"Provider" = "Nero ShowTime"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "PlayAudioCD_PlayMusicFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayAudioCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"]

NeroAutoPlay8PlayDVD\
"Provider" = "Nero ShowTime"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "PlayDVD_PlayVideoFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayDVD_PlayVideoFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"]

NeroAutoPlay8RipCD\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "RipCD_PlayCDAudioOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:SaveTracks %L" ["Nero AG"]

NeroAutoPlay8TranscodeVideo\
"Provider" = "Nero Recode"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "TranscodeVideo_PlayDVDMovieOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\TranscodeVideo_PlayDVDMovieOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero Recode\Recode.exe /New:CopyDVDVideo" ["Nero AG"]

NeroAutoPlay8VideoCapture\
"Provider" = "Nero Vision"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = ""C:\Program Files\Nero\Nero8\Nero Vision\NeroVision.exe" /New:VideoCapture"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

NeroAutoPlay8ViewPhotos\
"Provider" = "Nero PhotoSnap Viewer"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "ViewPhotos_ShowPicturesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\ViewPhotos_ShowPicturesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe /" ["Nero AG"]

PCLEVideoCameraArrival\
"Provider" = "Pinnacle Studio"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

Picasa2ImportPicturesOnArrival\
"Provider" = "Picasa2"
"InvokeProgID" = "picasa2.autoplay"
"InvokeVerb" = "import"
HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command\(Default) = "C:\Program Files\Picasa2\Picasa2.exe "%1"" ["Google Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{968631B6-4729-440D-9BF4-251F5593EC9A}"
-> {HKLM...CLSID} = "Copernic Desktop Search 2"
\InProcServer32\(Default) = "C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand203000030.dll" ["Copernic Inc."]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{0BF43445-2F28-4351-9252-17FE6E806AA0}" = "McAfee SiteAdvisor"
-> {HKLM...CLSID} = "McAfee SiteAdvisor"
\InProcServer32\(Default) = "C:\Program Files\SiteAdvisor\6261\SiteAdv.dll" ["McAfee, Inc."]
"{968631B6-4729-440D-9BF4-251F5593EC9A}" = (no title provided)
-> {HKLM...CLSID} = "Copernic Desktop Search 2"
\InProcServer32\(Default) = "C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand203000030.dll" ["Copernic Inc."]
"{D0943516-5076-4020-A3B5-AEFAF26AB263}" = "Veoh Video Finder"
-> {HKLM...CLSID} = "Veoh Browser Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll" ["Veoh Networks Inc"]
"{1E61ED7C-7CB8-49D6-B9E9-AB4C880C8414}" = (no title provided)
-> {HKLM...CLSID} = "MSN Toolbar"
\InProcServer32\(Default) = "C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll" [MS]

Explorer Bars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{968631B6-4729-440D-9BF4-251F5593EC9A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Copernic Desktop Search 2"
\InProcServer32\(Default) = "C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand203000030.dll" ["Copernic Inc."]
{9C3FCA1F-99E3-48F2-A7F4-DD3931B2F99A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Copernic Desktop Search 2"
\InProcServer32\(Default) = "C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand203000030.dll" ["Copernic Inc."]

HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statistiques d’Anti-Virus Internet"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll" ["Kaspersky Lab"]

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Rechercher"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Console Java (Sun)"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_05"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_05"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll" ["Sun Microsystems, Inc."]

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statistiques d’Anti-Virus Internet"

{219C3416-8CB2-491A-A3C7-D9FCDDC9D600}\
"ButtonText" = "Ajout Direct"
"MenuText" = "&Ajout Direct dans Windows Live Writer"
"CLSIDExtension" = "{5F7B1267-94A9-47F5-98DB-E99415F33AEC}"
-> {HKLM...CLSID} = "BlogThisToolbarButton Class"
\InProcServer32\(Default) = "C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search && Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["GRISOFT s.r.o."]
BitDefender Communicator, XCOMM, ""C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service" ["Softwin"]
Lavasoft Ad-Aware Service, aawservice, ""C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe"" ["Lavasoft"]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
Logitech Process Monitor, LVPrcSrv, "c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe" ["Logitech Inc."]
Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe"" [MS]
Nero BackItUp Scheduler 3, Nero BackItUp Scheduler 3, "C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe" ["Nero AG"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
PLFlash DeviceIoControl Service, PLFlash DeviceIoControl Service, "C:\WINDOWS\system32\IoctlSvc.exe" ["Prolific Technology Inc."]
ProtexisLicensing, ProtexisLicensing, "C:\WINDOWS\system32\PSIService.exe" [null data]
Service SiteAdvisor, SiteAdvisor Service, ""C:\Program Files\SiteAdvisor\6261\SAService.exe"" ["McAfee, Inc."]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
HP Master Monitor\Driver = "HPBMMON.DLL" ["Hewlett-Packard"]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
PDF995 Monitor\Driver = "pdf995mon.dll" [null data]


---------- (launch time: 2008-08-01 18:48:16)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 38 seconds, including 12 seconds for message boxes)

Merci pour ta patience.
Il ne se passe rien non plus lorsque je clique sur l'icône ni sur l'exe

J'ai fait ce que tu as indiqué, j'ai eu le message, répondu oui, rebooté le PC et ... toujours rien avec Combofix ...

J'espère que tu ne te désespères pas ...

wow ! Bien vu ! voici le rapport (toujours besoin du rapport Hijack ?) (et je viens de comprendre pourquoi mes tentatives de restauration échouent) :




ComboFix 08-07-31.06 - Bernard 2008-08-01 20:40:37.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2543 [GMT 2:00]
Endroit: C:\Documents and Settings\Bernard\Bureau\ABCD.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

[color=red]C:\WINDOWS\system32\dllcache\beep.sys[/color]
[color=red]C:\WINDOWS\system32\drivers\beep.sys[/color]
C:\WINDOWS\buritos.exe
C:\WINDOWS\elfv.exe
C:\WINDOWS\eqvwamkl.dll
C:\WINDOWS\grswptdl.exe
C:\WINDOWS\hosts
C:\WINDOWS\karina.dat
C:\WINDOWS\nfavxwdbvdf.dll
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\buritos.exe
C:\WINDOWS\system32\karina.dat
C:\WINDOWS\system32\kogoawqi.dat
C:\WINDOWS\system32\kogoawqi.exe
C:\WINDOWS\system32\kogoawqi_nav.dat
C:\WINDOWS\system32\kogoawqi_navps.dat
C:\WINDOWS\system32\winivstr.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-01 to 2008-08-01 ))))))))))))))))))))))))))))))))))))
.

2008-08-01 02:07 . 2008-08-01 02:07 19,417 --a------ C:\WINDOWS\system32\acurucax.exe
2008-08-01 02:07 . 2008-08-01 02:07 19,211 --a------ C:\Documents and Settings\All Users\Application Data\zacek.pif
2008-08-01 02:07 . 2008-08-01 02:07 18,792 --a------ C:\WINDOWS\asykimir._sy
2008-08-01 02:07 . 2008-08-01 02:07 18,711 --a------ C:\WINDOWS\aqav._dl
2008-08-01 02:07 . 2008-08-01 02:07 17,049 --a------ C:\WINDOWS\noruxy.ban
2008-08-01 02:07 . 2008-08-01 02:07 16,744 --a------ C:\Program Files\Fichiers communs\qyler.exe
2008-08-01 02:07 . 2008-08-01 02:07 16,701 --a------ C:\WINDOWS\ahezi.inf
2008-08-01 02:07 . 2008-08-01 02:07 16,100 --a------ C:\Documents and Settings\All Users\Application Data\dutizobitu.bat
2008-08-01 02:07 . 2008-08-01 02:07 15,936 --a------ C:\WINDOWS\xipub._sy
2008-08-01 02:07 . 2008-08-01 02:07 15,605 --a------ C:\Program Files\Fichiers communs\efag.pif
2008-08-01 02:07 . 2008-08-01 02:07 15,073 --a------ C:\Program Files\Fichiers communs\usut.exe
2008-08-01 02:07 . 2008-08-01 02:07 14,697 --a------ C:\WINDOWS\system32\ovogoju.com
2008-08-01 02:07 . 2008-08-01 02:07 13,966 --a------ C:\WINDOWS\system32\yqibizi.sys
2008-08-01 02:07 . 2008-08-01 02:07 13,850 --a------ C:\WINDOWS\keguvalan.vbs
2008-08-01 02:07 . 2008-08-01 02:07 10,777 --a------ C:\Documents and Settings\Bernard\Application Data\afupusytaw.bat
2008-08-01 02:07 . 2008-08-01 02:07 10,391 --a------ C:\WINDOWS\tezuhirify.bin
2008-08-01 00:50 . 2008-08-01 00:50 18,406 --a------ C:\Documents and Settings\Bernard\Application Data\eqipyryp.com
2008-07-31 21:56 . 2008-07-31 21:56 19,454 --a------ C:\Documents and Settings\All Users\Application Data\qonovi.vbs
2008-07-31 21:56 . 2008-07-31 21:56 14,918 --a------ C:\Documents and Settings\All Users\Application Data\gaxo.sys
2008-07-31 21:56 . 2008-07-31 21:56 14,568 --a------ C:\Documents and Settings\Bernard\Application Data\ugopil.exe
2008-07-31 21:56 . 2008-07-31 21:56 10,720 --a------ C:\Documents and Settings\Bernard\Application Data\vyhujopiw.com
2008-07-31 21:22 . 2008-07-31 21:36 11 --a------ C:\WINDOWS\3DShadow.INI
2008-07-31 21:18 . 2008-07-31 21:18 44,544 --------- C:\WINDOWS\AWuninstall.exe
2008-07-31 19:39 . 2008-07-31 23:00 <REP> d-------- C:\Program Files\The Mystery Of The Crystal Portal
2008-07-18 19:54 . 2008-07-31 16:04 <REP> d-------- C:\Program Files\Jewel Quest III
2008-07-16 18:00 . 2008-07-16 18:00 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-07-16 18:00 . 2004-02-22 10:11 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-07-16 18:00 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe
2008-07-16 18:00 . 2008-02-07 16:15 408,576 --a------ C:\WINDOWS\system32\Smab.dll
2008-07-16 18:00 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll
2008-07-16 18:00 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2008-07-16 18:00 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-07-16 18:00 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll
2008-07-16 18:00 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2008-07-16 18:00 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe
2008-07-16 18:00 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2008-07-16 17:56 . 2008-07-16 17:56 <REP> d-------- C:\Program Files\eRightSoft
2008-07-14 22:06 . 2008-07-15 18:56 <REP> d-------- C:\Documents and Settings\Bernard\iWizz
2008-07-14 22:05 . 2008-07-14 22:05 <REP> d-------- C:\Program Files\iWizz
2008-07-14 22:05 . 2008-07-14 22:05 <REP> d-------- C:\Documents and Settings\Bernard\.bitrock
2008-07-14 21:32 . 2008-07-18 19:41 <REP> d-------- C:\Program Files\Alices Magical Mahjong
2008-07-14 14:14 . 2008-06-29 23:41 258,048 --a------ C:\WINDOWS\system32\raw.pfl
2008-07-14 14:14 . 2008-06-29 23:40 65,536 --a------ C:\WINDOWS\system32\8bf.pfl
2008-07-14 14:06 . 2004-05-27 16:46 872,448 --a------ C:\WINDOWS\system32\libgfl211.dll
2008-07-14 14:06 . 2004-05-19 10:01 364,544 --a------ C:\WINDOWS\system32\Xfpx.dll
2008-07-14 14:06 . 2004-02-04 06:33 307,200 --a------ C:\WINDOWS\system32\libmng.dll
2008-07-14 14:06 . 2004-05-19 10:02 225,280 --a------ C:\WINDOWS\system32\Xjp2.dll
2008-07-14 14:06 . 2004-05-19 10:02 114,688 --a------ C:\WINDOWS\system32\Xjpegls.dll
2008-07-14 14:06 . 2004-05-19 10:01 81,920 --a------ C:\WINDOWS\system32\Xjbig.dll
2008-07-14 14:06 . 2004-05-19 10:02 49,152 --a------ C:\WINDOWS\system32\Xsusie.dll
2008-07-14 14:06 . 2004-05-19 10:01 49,152 --a------ C:\WINDOWS\system32\Xjng.dll
2008-07-14 14:05 . 2008-07-15 21:06 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-07-14 14:05 . 2008-07-14 14:05 <REP> d-------- C:\Program Files\PhotoFiltre
2008-07-11 14:40 . 2008-07-11 14:46 211 --a------ C:\WINDOWS\fmachine.ini
2008-07-09 01:25 . 2008-07-09 01:25 <REP> d-------- C:\WINDOWS\ulead.dat
2008-07-09 01:25 . 2008-07-11 15:12 89 --a------ C:\WINDOWS\ULead32.ini
2008-07-09 01:13 . 2008-07-09 01:25 78 --ah----- C:\WINDOWS\Au1tgr.ns
2008-07-09 01:12 . 2008-07-09 01:12 <REP> d-------- C:\WINDOWS\Noslip
2008-07-09 01:12 . 2008-07-09 01:12 <REP> d-------- C:\Program Files\Ulead ArtTexture.Plugin
2008-07-09 01:12 . 1995-10-21 10:37 35,328 --------- C:\WINDOWS\INETWH32.DLL
2008-07-09 01:12 . 1995-07-20 00:00 26,832 --------- C:\WINDOWS\CTL3DV2.DLL
2008-07-09 01:12 . 1995-10-16 16:55 9,136 --------- C:\WINDOWS\INETWH16.DLL
2008-07-09 01:12 . 1995-10-13 16:28 4,528 --------- C:\WINDOWS\SETBROWS.EXE
2008-07-09 01:09 . 1998-01-23 12:22 304,128 --a------ C:\WINDOWS\IsUninst.exe
2008-07-04 22:11 . 2008-07-04 22:11 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\Playrix Entertainment
2008-07-04 22:08 . 2008-07-11 21:00 <REP> d-------- C:\Program Files\Fishdom

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 18:48 10,133,536 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-01 18:47 154,319,904 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-01 18:44 961,412 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-01 18:44 2,076,992 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-01 00:07 17,363 ----a-w C:\Program Files\Fichiers communs\elylu.dl
2008-08-01 00:05 --------- d-----w C:\Program Files\CCleaner
2008-07-31 21:39 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-07-31 21:39 15,648 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-07-31 21:39 12,960 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2008-07-31 21:38 --------- d-----w C:\Program Files\Lavasoft
2008-07-31 21:33 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-31 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-31 21:06 --------- d-----w C:\Program Files\Dictionnaire
2008-07-31 19:56 19,499 ----a-w C:\WINDOWS\cuma.sys
2008-07-31 19:56 14,877 ----a-w C:\WINDOWS\elydaga.bin
2008-07-31 19:56 12,109 ----a-w C:\WINDOWS\itali.pif
2008-07-31 19:50 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-31 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-31 19:30 --------- d-----w C:\Documents and Settings\Bernard\Application Data\Corel
2008-07-31 15:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-31 11:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
2008-07-25 16:15 --------- d-----w C:\Documents and Settings\Bernard\Application Data\U3
2008-07-23 17:49 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-23 17:49 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-18 17:56 --------- d-----w C:\Documents and Settings\Bernard\Application Data\iWin
2008-07-14 17:27 --------- d-----w C:\Program Files\The Lost Treasures Of Alexandria
2008-07-11 08:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-08 22:38 --------- d-----w C:\Program Files\eMule
2008-07-02 13:34 --------- d-----w C:\Documents and Settings\Bernard\Application Data\MysteryStudio
2008-07-02 00:10 --------- d-----w C:\Program Files\Microsoft Baseline Security Analyzer 2
2008-07-01 23:59 --------- d--h--w C:\Documents and Settings\Bernard\Application Data\GTek
2008-07-01 23:59 --------- d--h--w C:\Documents and Settings\All Users\Application Data\GTek
2008-06-30 11:12 --------- d-----w C:\Documents and Settings\Bernard\Application Data\wsInspector
2008-06-29 21:14 --------- d-----w C:\Program Files\AnfyTeam
2008-06-24 14:34 --------- d-----w C:\Documents and Settings\Bernard\Application Data\SiteAdvisor
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-16 14:39 --------- d-----w C:\Program Files\The Weather Channel FW
2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 19:11 --------- d-----w C:\Program Files\Veoh Networks
2008-06-10 20:49 --------- d-----w C:\Program Files\DivX
2008-06-05 17:05 --------- d-----w C:\Program Files\Womens Murder Club Death In Scarlet
2008-06-02 21:43 --------- d-----w C:\Documents and Settings\Bernard\Application Data\Flood Light Games
2008-06-02 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Flood Light Games
2008-06-01 11:34 --------- d-----w C:\Program Files\AmazingMIDI
2008-05-21 12:18 442,880 ----a-w C:\WINDOWS\rapidui.exe
2008-03-07 16:39 34,189,319 ----a-w C:\Program Files\BigCityAdventureSydneyAustraliaSetup.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
"TClockEx"="C:\PROGRA~1\TClockEx\TCLOCKEX.EXE" [2000-03-09 02:15 90112]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 21:15 103712]
"Copernic Desktop Search 2"="C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" [2008-04-10 22:38 1583624]
"DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 16:18 785520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-06-29 04:07 352256]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26 7700480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26 86016]
"Share-to-Web Namespace Daemon"="c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 10:51 172032]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 16:52 849280]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2008-05-16 18:50 36640]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-04 21:58 286720]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-19 17:10 160768]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 09:34 16143872 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-04-19 13:26 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"VIDC.MJPG"= Pvmjpg30.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2006-06-16 09:30]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 20:45]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 20:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30faa206-321e-11dc-874e-0015af0b1bc8}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
Notify-avldr - avldr.dll


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Window Title = Microsoft Internet Explorer
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: &Add animation to IncrediMail Style Box - C:\Program Files\IncrediMail\bin\resources\WebMenuImg.htm
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{AC79AA80-39D2-4667-83E3-2B0C8DDA5941}: NameServer = 192.168.1.1


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-01 20:47:25
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6261\saHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-01 21:02:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-01 19:01:46

Pre-Run: 286,566,289,408 octets libres
Post-Run: 286,481,518,592 octets libres

254 --- E O F --- 2008-07-10 10:31:23

Voici le rapport, mais là, je dois m'arrêter, je ferai la suite demain (mille fois merci pour tout)


ComboFix 08-07-31.06 - Bernard 2008-08-01 22:53:39.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2433 [GMT 2:00]
Endroit: C:\Documents and Settings\Bernard\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Bernard\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\Documents and Settings\All Users\Application Data\dutizobitu.bat
C:\Documents and Settings\All Users\Application Data\gaxo.sys
C:\Documents and Settings\All Users\Application Data\qonovi.vbs
C:\Documents and Settings\All Users\Application Data\zacek.pif
C:\Documents and Settings\Bernard\Application Data\afupusytaw.bat
C:\Documents and Settings\Bernard\Application Data\eqipyryp.com
C:\Documents and Settings\Bernard\Application Data\ugopil.exe
C:\Documents and Settings\Bernard\Application Data\vyhujopiw.com
C:\Program Files\Fichiers communs\efag.pif
C:\Program Files\Fichiers communs\elylu.dl
C:\Program Files\Fichiers communs\qyler.exe
C:\Program Files\Fichiers communs\usut.exe
C:\WINDOWS\ahezi.inf
C:\WINDOWS\aqav._dl
C:\WINDOWS\asykimir._sy
C:\WINDOWS\elydaga.bin
C:\WINDOWS\itali.pif
C:\WINDOWS\keguvalan.vbs
C:\WINDOWS\noruxy.ban
C:\WINDOWS\system32\acurucax.exe
C:\WINDOWS\system32\ovogoju.com
C:\WINDOWS\system32\yqibizi.sys
C:\WINDOWS\tezuhirify.bin
C:\WINDOWS\xipub._sy
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\dutizobitu.bat
C:\Documents and Settings\All Users\Application Data\gaxo.sys
C:\Documents and Settings\All Users\Application Data\qonovi.vbs
C:\Documents and Settings\All Users\Application Data\zacek.pif
C:\Documents and Settings\Bernard\Application Data\afupusytaw.bat
C:\Documents and Settings\Bernard\Application Data\eqipyryp.com
C:\Documents and Settings\Bernard\Application Data\ugopil.exe
C:\Documents and Settings\Bernard\Application Data\vyhujopiw.com
C:\Program Files\Fichiers communs\efag.pif
C:\Program Files\Fichiers communs\elylu.dl
C:\Program Files\Fichiers communs\qyler.exe
C:\Program Files\Fichiers communs\usut.exe
C:\WINDOWS\ahezi.inf
C:\WINDOWS\aqav._dl
C:\WINDOWS\asykimir._sy
C:\WINDOWS\elydaga.bin
C:\WINDOWS\itali.pif
C:\WINDOWS\keguvalan.vbs
C:\WINDOWS\noruxy.ban
C:\WINDOWS\system32\acurucax.exe
C:\WINDOWS\system32\ovogoju.com
C:\WINDOWS\system32\yqibizi.sys
C:\WINDOWS\tezuhirify.bin
C:\WINDOWS\xipub._sy

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-01 to 2008-08-01 ))))))))))))))))))))))))))))))))))))
.

2008-07-31 21:22 . 2008-07-31 21:36 11 --a------ C:\WINDOWS\3DShadow.INI
2008-07-31 21:18 . 2008-07-31 21:18 44,544 --------- C:\WINDOWS\AWuninstall.exe
2008-07-31 19:39 . 2008-07-31 23:00 <REP> d-------- C:\Program Files\The Mystery Of The Crystal Portal
2008-07-18 19:54 . 2008-07-31 16:04 <REP> d-------- C:\Program Files\Jewel Quest III
2008-07-16 18:00 . 2008-07-16 18:00 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-07-16 18:00 . 2004-02-22 10:11 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-07-16 18:00 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe
2008-07-16 18:00 . 2008-02-07 16:15 408,576 --a------ C:\WINDOWS\system32\Smab.dll
2008-07-16 18:00 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll
2008-07-16 18:00 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2008-07-16 18:00 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-07-16 18:00 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll
2008-07-16 18:00 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2008-07-16 18:00 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe
2008-07-16 18:00 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2008-07-16 17:56 . 2008-07-16 17:56 <REP> d-------- C:\Program Files\eRightSoft
2008-07-14 22:06 . 2008-07-15 18:56 <REP> d-------- C:\Documents and Settings\Bernard\iWizz
2008-07-14 22:05 . 2008-07-14 22:05 <REP> d-------- C:\Program Files\iWizz
2008-07-14 22:05 . 2008-07-14 22:05 <REP> d-------- C:\Documents and Settings\Bernard\.bitrock
2008-07-14 21:32 . 2008-07-18 19:41 <REP> d-------- C:\Program Files\Alices Magical Mahjong
2008-07-14 14:14 . 2008-06-29 23:41 258,048 --a------ C:\WINDOWS\system32\raw.pfl
2008-07-14 14:14 . 2008-06-29 23:40 65,536 --a------ C:\WINDOWS\system32\8bf.pfl
2008-07-14 14:06 . 2004-05-27 16:46 872,448 --a------ C:\WINDOWS\system32\libgfl211.dll
2008-07-14 14:06 . 2004-05-19 10:01 364,544 --a------ C:\WINDOWS\system32\Xfpx.dll
2008-07-14 14:06 . 2004-02-04 06:33 307,200 --a------ C:\WINDOWS\system32\libmng.dll
2008-07-14 14:06 . 2004-05-19 10:02 225,280 --a------ C:\WINDOWS\system32\Xjp2.dll
2008-07-14 14:06 . 2004-05-19 10:02 114,688 --a------ C:\WINDOWS\system32\Xjpegls.dll
2008-07-14 14:06 . 2004-05-19 10:01 81,920 --a------ C:\WINDOWS\system32\Xjbig.dll
2008-07-14 14:06 . 2004-05-19 10:02 49,152 --a------ C:\WINDOWS\system32\Xsusie.dll
2008-07-14 14:06 . 2004-05-19 10:01 49,152 --a------ C:\WINDOWS\system32\Xjng.dll
2008-07-14 14:05 . 2008-07-15 21:06 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-07-14 14:05 . 2008-07-14 14:05 <REP> d-------- C:\Program Files\PhotoFiltre
2008-07-11 14:40 . 2008-07-11 14:46 211 --a------ C:\WINDOWS\fmachine.ini
2008-07-09 01:25 . 2008-07-09 01:25 <REP> d-------- C:\WINDOWS\ulead.dat
2008-07-09 01:25 . 2008-07-11 15:12 89 --a------ C:\WINDOWS\ULead32.ini
2008-07-09 01:13 . 2008-07-09 01:25 78 --ah----- C:\WINDOWS\Au1tgr.ns
2008-07-09 01:12 . 2008-07-09 01:12 <REP> d-------- C:\WINDOWS\Noslip
2008-07-09 01:12 . 2008-07-09 01:12 <REP> d-------- C:\Program Files\Ulead ArtTexture.Plugin
2008-07-09 01:12 . 1995-10-21 10:37 35,328 --------- C:\WINDOWS\INETWH32.DLL
2008-07-09 01:12 . 1995-07-20 00:00 26,832 --------- C:\WINDOWS\CTL3DV2.DLL
2008-07-09 01:12 . 1995-10-16 16:55 9,136 --------- C:\WINDOWS\INETWH16.DLL
2008-07-09 01:12 . 1995-10-13 16:28 4,528 --------- C:\WINDOWS\SETBROWS.EXE
2008-07-09 01:09 . 1998-01-23 12:22 304,128 --a------ C:\WINDOWS\IsUninst.exe
2008-07-04 22:11 . 2008-07-04 22:11 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\Playrix Entertainment
2008-07-04 22:08 . 2008-07-11 21:00 <REP> d-------- C:\Program Files\Fishdom

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 21:00 10,143,264 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-01 20:59 154,497,312 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-01 20:58 962,348 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-01 20:58 2,079,512 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-01 20:25 --------- d-----w C:\Documents and Settings\Bernard\Application Data\Corel
2008-08-01 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-01 00:05 --------- d-----w C:\Program Files\CCleaner
2008-07-31 21:39 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-07-31 21:39 15,648 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-07-31 21:39 12,960 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2008-07-31 21:38 --------- d-----w C:\Program Files\Lavasoft
2008-07-31 21:33 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-31 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-31 21:06 --------- d-----w C:\Program Files\Dictionnaire
2008-07-31 19:56 19,499 ----a-w C:\WINDOWS\cuma.sys
2008-07-31 19:50 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-31 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-31 11:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
2008-07-25 16:15 --------- d-----w C:\Documents and Settings\Bernard\Application Data\U3
2008-07-23 17:49 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-23 17:49 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-18 17:56 --------- d-----w C:\Documents and Settings\Bernard\Application Data\iWin
2008-07-14 17:27 --------- d-----w C:\Program Files\The Lost Treasures Of Alexandria
2008-07-11 08:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-08 22:38 --------- d-----w C:\Program Files\eMule
2008-07-02 13:34 --------- d-----w C:\Documents and Settings\Bernard\Application Data\MysteryStudio
2008-07-02 00:10 --------- d-----w C:\Program Files\Microsoft Baseline Security Analyzer 2
2008-07-01 23:59 --------- d--h--w C:\Documents and Settings\Bernard\Application Data\GTek
2008-07-01 23:59 --------- d--h--w C:\Documents and Settings\All Users\Application Data\GTek
2008-06-30 11:12 --------- d-----w C:\Documents and Settings\Bernard\Application Data\wsInspector
2008-06-29 21:14 --------- d-----w C:\Program Files\AnfyTeam
2008-06-24 14:34 --------- d-----w C:\Documents and Settings\Bernard\Application Data\SiteAdvisor
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-16 14:39 --------- d-----w C:\Program Files\The Weather Channel FW
2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 19:11 --------- d-----w C:\Program Files\Veoh Networks
2008-06-10 20:49 --------- d-----w C:\Program Files\DivX
2008-06-05 17:05 --------- d-----w C:\Program Files\Womens Murder Club Death In Scarlet
2008-06-02 21:43 --------- d-----w C:\Documents and Settings\Bernard\Application Data\Flood Light Games
2008-06-02 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Flood Light Games
2008-06-01 11:34 --------- d-----w C:\Program Files\AmazingMIDI
2008-05-21 12:18 442,880 ----a-w C:\WINDOWS\rapidui.exe
2008-03-07 16:39 34,189,319 ----a-w C:\Program Files\BigCityAdventureSydneyAustraliaSetup.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
"TClockEx"="C:\PROGRA~1\TClockEx\TCLOCKEX.EXE" [2000-03-09 02:15 90112]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 21:15 103712]
"Copernic Desktop Search 2"="C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" [2008-04-10 22:38 1583624]
"DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 16:18 785520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-06-29 04:07 352256]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26 7700480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26 86016]
"Share-to-Web Namespace Daemon"="c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 10:51 172032]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 16:52 849280]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2008-05-16 18:50 36640]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-04 21:58 286720]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-19 17:10 160768]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-26 16:53 218376]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 09:34 16143872 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-04-19 13:26 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"VIDC.MJPG"= Pvmjpg30.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImLc.exe"=

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2006-06-16 09:30]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 20:45]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 20:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30faa206-321e-11dc-874e-0015af0b1bc8}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-01 23:00:03
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

C:\WINDOWS\explorer.exe [2000] 0x8A32E268

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-01 23:13:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-01 21:12:24
ComboFix2.txt 2008-08-01 19:02:57

Pre-Run: 286,291,468,288 octets libres
Post-Run: 286,373,666,816 octets libres

242 --- E O F --- 2008-07-10 10:31:23

Hello. Je suis là. Le scan tourne depuis plus d'une heure et demi et il continue. Pas tout à fait à la moitié....

Ouch ! plus de 3h de scan ... voici le rapport:

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3318 (20080801)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=64fe7a2edc9ee84c9a69f1635cee062a
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2008-08-02 03:39:22
# local_time=2008-08-02 05:39:22 (+0100, Europe de l'Ouest)
# country="Switzerland"
# osver=5.1.2600 NT Service Pack 3
# scanned=1210037
# found=22
# scan_time=11558
C:\Documents and Settings\Bernard\Mes documents\Mes fichiers PSP\FILTRES - Pluggins\eyecandy5nature\Alien-Skin-Eye-Candy-5.1.Impact.rar probably a variant of Win32/TrojanDropper.Agent trojan (deleted) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Mes fichiers PSP\FILTRES - Pluggins\eyecandy5nature\Alien-Skin-Eye-Candy-5.1.Impact.rar »RAR »Alien.Skin.Eye.Candy.v5.1.Impact.Keygen.exe probably a variant of Win32/TrojanDropper.Agent trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Mes fichiers PSP\FILTRES - Pluggins\eyecandy5nature\Alien-Skin-Eye-Candy-5.1.Impact\Alien.Skin.Eye.Candy.v5.1.Impact.Keygen.exe probably a variant of Win32/TrojanDropper.Agent trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0.rar probably a variant of Win32/TrojanDropper.Agent trojan (deleted) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0.rar »RAR »RapidshareUnlimited 2.0.exe probably a variant of Win32/TrojanDropper.Agent trojan (error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0.rar »RAR »RapidshareUnlimited 2.0.exe »RAR »RapidshareUnlimited_2.0_Setup_(Crack_Hour_Limitation).exe probably a variant of Win32/TrojanDropper.Agent trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0.rar »RAR »RapidshareUnlimited_2.0_Setup_(Crack_Hour_Limitation).exe probably a variant of Win32/TrojanDropper.Agent trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0.zip probably a variant of Win32/TrojanDropper.Agent trojan (deleted) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0.zip »ZIP »Rapidshare Unlimited 2.0/Rapidshare Unlimited 2.0 Setup (Crack Hour Limitation).exe probably a variant of Win32/TrojanDropper.Agent trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0\RapidshareUnlimited 2.0.exe probably a variant of Win32/TrojanDropper.Agent trojan (deleted) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0\RapidshareUnlimited 2.0.exe »RAR »RapidshareUnlimited_2.0_Setup_(Crack_Hour_Limitation).exe probably a variant of Win32/TrojanDropper.Agent trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0\RapidshareUnlimited_2.0_Setup_(Crack_Hour_Limitation).exe probably a variant of Win32/TrojanDropper.Agent trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\Bernard\Mes documents\Rapidshare\Rapidshare_Unlimited_2.0\Rapidshare Unlimited 2.0\Rapidshare Unlimited 2.0 Setup (Crack Hour Limitation).exe probably a variant of Win32/TrojanDropper.Agent trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Program Files\Pando Networks\Pando\oovooInst.exe probably a variant of Win32/Agent trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\programmes telecharges\Sécurité PC\Sécurité 2\Upload_Me\Upload_Me.zip probably a variant of Win32/Genetik trojan (deleted) 00000000000000000000000000000000
C:\programmes telecharges\Sécurité PC\Sécurité 2\Upload_Me\Upload_Me.zip »ZIP »DOCUME~1/Bernard/Bureau/Upload_Me/winivstr.exe probably a variant of Win32/Genetik trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\programmes telecharges\Sécurité PC\Sécurité 2\Upload_Me\DOCUME~1\Bernard\Bureau\Upload_Me\winivstr.exe probably a variant of Win32/Genetik trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\karina.dat.vir Win32/TrojanDownloader.Agent.OBD trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\karina.dat.vir Win32/TrojanDownloader.Agent.OBD trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\winivstr.exe.vir probably a variant of Win32/Genetik trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\dllcache\beep.sys.vir Win32/Adware.UltimateDefender application (unable to clean - deleted) 00000000000000000000000000000000
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\beep.sys.vir Win32/Adware.UltimateDefender application (unable to clean - deleted) 00000000000000000000000000000000

Là, j'arrête ... la suite demain dimanche, si tu es là !!! (Merciiiiiiiiiiiiiiiiiiiiii)

Hello, bon dimanche !
Voici le résultat:





Complete scanning result of "cuma.sys", processed in VirusTotal at 08/03/2008 12:57:06 (CET).

[ file data ]
* name..: cuma.sys
* size..: 19499
* md5...: 645b0e20f341deb8ac365a9c6fb442ba
* sha1..: f7ed1e1597d2078d38dc72728c34b1c10affc6e5
* peid..: -

[ scan result ]
AhnLab-V3 2008.7.29.1/20080802 found nothing
AntiVir 7.8.1.15/20080801 found nothing
Authentium 5.1.0.4/20080803 found nothing
Avast 4.8.1195.0/20080802 found nothing
AVG 8.0.0.156/20080802 found nothing
BitDefender 7.2/20080803 found nothing
CAT-QuickHeal 9.50/20080802 found nothing
ClamAV 0.93.1/20080803 found nothing
DrWeb 4.44.0.09170/20080803 found nothing
eSafe 7.0.17.0/20080803 found nothing
eTrust-Vet 31.6.6002/20080802 found nothing
Ewido 4.0/20080803 found nothing
F-Prot 4.4.4.56/20080803 found nothing
F-Secure 7.60.13501.0/20080803 found nothing
Fortinet 3.14.0.0/20080803 found nothing
GData 2.0.7306.1023/20080803 found nothing
Ikarus T3.1.1.34.0/20080803 found nothing
K7AntiVirus 7.10.402/20080802 found nothing
Kaspersky 7.0.0.125/20080803 found nothing
McAfee 5352/20080801 found nothing
Microsoft 1.3807/20080803 found nothing
NOD32v2 3321/20080803 found nothing
Norman 5.80.02/20080801 found nothing
Panda 9.0.0.4/20080803 found nothing
PCTools 4.4.2.0/20080802 found nothing
Prevx1 V2/20080803 found nothing
Rising 20.55.62.00/20080803 found nothing
Sophos 4.31.0/20080803 found nothing
Sunbelt 3.1.1537.1/20080801 found nothing
Symantec 10/20080803 found nothing
TheHacker 6.2.96.392/20080802 found nothing
TrendMicro 8.700.0.1004/20080801 found nothing
VBA32 3.12.8.2/20080802 found nothing
ViRobot 2008.8.1.1321/20080801 found nothing
VirusBuster 4.5.11.0/20080802 found nothing
Webwasher-Gateway 6.6.2/20080803 found nothing

Je te remercie infiniment pour ta patience et ta gentillesse.