envahi de virus : Lookme-gen, Trojano-2873, etc...

Bonjour à tous,

Avast me signale les virus Lookme-gen, Trojano-2873, Gaobot-286, Purityscan, etc... et mon pc n'arrete pas de planter.

Voilà le rapport HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 20:28:33, on 25/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\dfndrff_e37.exe
C:\kybrdff_e37.exe
C:\nwnmff_e37.exe
C:\WINDOWS\System32\fntur.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Arnaud.NO\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {3A947772-3B29-41DB-A436-4B5CAAECE2F6} - C:\WINDOWS\System32\mljifdd.dll
O2 - BHO: (no name) - {77713F03-E303-4F0C-93D6-0D9722D2FD63} - C:\WINDOWS\System32\ddcya.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IY\_OR] C:\WINDOWS\System32\wgedyokgmtpwq.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e37.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e37.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e37.exe
O4 - HKLM\..\Run: [Windows LoL Layer] fntur.exe
O4 - HKLM\..\RunServices: [Windows LoL Layer] fntur.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Windows LoL Layer] fntur.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O20 - Winlogon Notify: ddcya - C:\WINDOWS\System32\ddcya.dll
O20 - Winlogon Notify: mljifdd - C:\WINDOWS\SYSTEM32\mljifdd.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\lvls0937e.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Que puis je faire pour guérir ma machine? (j'y connaît pas grand chose)

Merci d'avance!

Re

Alors là vraiment, t'es un vrai chef!
Mon PC va beaucoup mieux!

Voilà les rapports :

VundoFix :


VundoFix V6.2.6

Checking Java version...

Sun Java not detected
Scan started at 22:09:27 25/10/2006

Listing files found while scanning....

C:\WINDOWS\system32\jdbwpleq.dll
C:\WINDOWS\system32\mdihuqud.dll
C:\WINDOWS\system32\mljifdd.dll
C:\WINDOWS\System32\ddcya.dll
C:\WINDOWS\System32\aycdd.ini
C:\WINDOWS\System32\aycdd.bak2

Beginning removal...

Attempting to delete C:\WINDOWS\system32\jdbwpleq.dll
C:\WINDOWS\system32\jdbwpleq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mdihuqud.dll
C:\WINDOWS\system32\mdihuqud.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljifdd.dll
C:\WINDOWS\system32\mljifdd.dll Could not be deleted.

Attempting to delete C:\WINDOWS\System32\ddcya.dll
C:\WINDOWS\System32\ddcya.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\aycdd.ini
C:\WINDOWS\System32\aycdd.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\aycdd.bak2
C:\WINDOWS\System32\aycdd.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\mljifdd.dll
C:\WINDOWS\system32\mljifdd.dll Has been deleted!

Performing Repairs to the registry.
Done!

Look2Me :


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 25/10/2006 22:47:54

Infected! C:\WINDOWS\system32\lvls0937e.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009419.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009420.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009421.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009422.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009423.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009424.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009425.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009426.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009427.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009428.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009429.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009430.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0011296.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011328.dll
Infected! C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011341.dll
Infected! C:\WINDOWS\system32\dnlq0135e.dll
Infected! C:\WINDOWS\system32\ir82l5lo1.dll
Infected! C:\WINDOWS\system32\k6pmlg7116.dll
Infected! C:\WINDOWS\system32\ktpml7711.dll
Infected! C:\WINDOWS\system32\lvls0937e.dll
Infected! C:\WINDOWS\system32\miiwave.dll
Infected! C:\WINDOWS\system32\n62ulgf9162.dll
Infected! C:\WINDOWS\System32\guard.tmp

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\lvls0937e.dll
C:\WINDOWS\system32\lvls0937e.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009419.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009419.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009420.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009420.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009421.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009421.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009422.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009422.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009423.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009423.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009424.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009424.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009425.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009425.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009426.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009426.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009427.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009427.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009428.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009428.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009429.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009429.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009430.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009430.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0011296.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0011296.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011328.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011328.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011341.dll
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011341.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\dnlq0135e.dll
C:\WINDOWS\system32\dnlq0135e.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\ir82l5lo1.dll
C:\WINDOWS\system32\ir82l5lo1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\k6pmlg7116.dll
C:\WINDOWS\system32\k6pmlg7116.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\ktpml7711.dll
C:\WINDOWS\system32\ktpml7711.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\lvls0937e.dll
C:\WINDOWS\system32\lvls0937e.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\miiwave.dll
C:\WINDOWS\system32\miiwave.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\n62ulgf9162.dll
C:\WINDOWS\system32\n62ulgf9162.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\System32\guard.tmp
C:\WINDOWS\System32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Installer

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{9E3F9423-B38A-4209-A3C2-71A19B548A54}"
HKCR\Clsid\{9E3F9423-B38A-4209-A3C2-71A19B548A54}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{4CF35067-C48A-4EBF-8E69-737C46E35868}"
HKCR\Clsid\{4CF35067-C48A-4EBF-8E69-737C46E35868}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{21228178-2C71-4B85-B1B9-7E73DAC0155D}"
HKCR\Clsid\{21228178-2C71-4B85-B1B9-7E73DAC0155D}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{250B3633-01D2-4CDD-BD7E-590E4D65C310}"
HKCR\Clsid\{250B3633-01D2-4CDD-BD7E-590E4D65C310}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{8EC8A169-79C4-404D-8F42-E3ABD089AFA7}"
HKCR\Clsid\{8EC8A169-79C4-404D-8F42-E3ABD089AFA7}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{C19AB6A1-71CA-4BA3-A35B-F37CD4511534}"
HKCR\Clsid\{C19AB6A1-71CA-4BA3-A35B-F37CD4511534}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5F02C84B-0B1F-4CA3-AE4F-67C83E55B14B}"
HKCR\Clsid\{5F02C84B-0B1F-4CA3-AE4F-67C83E55B14B}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3D2EFF2D-0D5E-476A-8A96-B200BB72580F}"
HKCR\Clsid\{3D2EFF2D-0D5E-476A-8A96-B200BB72580F}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{E73C75E5-BC5B-416D-B68B-39437442482F}"
HKCR\Clsid\{E73C75E5-BC5B-416D-B68B-39437442482F}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{2E532186-9D83-4029-A509-9FB0E6723088}"
HKCR\Clsid\{2E532186-9D83-4029-A509-9FB0E6723088}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{837FC8C1-8F0B-4D9E-B635-1599AE034578}"
HKCR\Clsid\{837FC8C1-8F0B-4D9E-B635-1599AE034578}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrateurs - Succeeded



ComboFix :

Arnaud - 06-10-25 22:54:30,15 Service Pack 1
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Arnaud.NO\Bureau"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\teller2.chk
C:\dfndrff_e35.exe
C:\dfndrff_e36.exe
C:\dfndrff_e37.exe
C:\drsmartload.exe
C:\deskbar_e34.exe
C:\deskbar_e37.exe
C:\kybrdff_e35.exe
C:\kybrdff_e36.exe
C:\kybrdff_e37.exe
C:\nwnmff_e35.exe
C:\nwnmff_e36.exe
C:\nwnmff_e37.exe
C:\Program Files\Fichiers communs\Yazzle1125OinUninstaller.exe
C:\Program Files\Deskbar

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\SMBOLS~1
C:\QooBox\Purity\WINDOWS\SMBOLS~1\s?mbols


((((((((((((((((((((((((((((((( Files Created from 2006-09-25 to 2006-10-25 ))))))))))))))))))))))))))))))))))


2006-10-25 22:28 24,960 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2006-10-25 20:12 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2006-10-25 08:23 16,384 --a------ C:\mc44a37.exe
2006-10-25 01:01 947,472 --a------ C:\WINDOWS\system32\msjava.dll
2006-10-25 01:01 46,352 --a------ C:\WINDOWS\setdebug.exe
2006-10-25 01:01 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2006-10-25 01:01 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2006-10-25 01:01 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2006-10-25 01:01 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2006-10-25 01:01 171,280 --a------ C:\WINDOWS\system32\jit.dll
2006-10-25 01:01 154,384 --a------ C:\WINDOWS\system32\msawt.dll
2006-10-25 01:01 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2006-10-25 01:01 113 --a------ C:\WINDOWS\system32\zonedon.reg
2006-10-25 01:01 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2006-10-25 01:00 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2006-10-25 01:00 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2006-10-25 01:00 404,752 --a------ C:\WINDOWS\system32\javart.dll
2006-10-25 01:00 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2006-10-25 01:00 172,304 --a------ C:\WINDOWS\system32\jview.exe
2006-10-25 01:00 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2006-10-25 00:49 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-24 22:03 1,006,592 --a------ C:\WINDOWS\system32\esent.dll
2006-10-24 13:10 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2006-10-24 13:10 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2006-10-24 13:10 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2006-10-24 13:10 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-10-24 13:10 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2006-10-24 13:10 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2006-10-24 08:39 16,384 --a------ C:\mc44a36.exe
2006-10-24 08:39 16,384 --a------ C:\mc44a35.exe
2006-10-24 08:25 67,604 --a------ C:\WINDOWS\system32\wtppuxvj.exe
2006-10-23 23:39 24,576 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2006-10-23 23:35 33,280 --a------ C:\dier.exe
2006-10-23 23:25 181,580 --a------ C:\WINDOWS\YazzleBundle-1125.exe
2006-10-23 23:24 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2006-10-23 22:51 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll
2006-10-23 22:51 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2006-10-23 22:51 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2006-10-23 22:51 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-10-23 21:29 3,508 --ah----- C:\WINDOWS\system32\kalmu.exe
2006-10-23 21:29 28,672 --ah----- C:\WINDOWS\system32\hpgxw.exe
2006-10-23 21:01 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-10-23 20:56 467,224 --a------ C:\WINDOWS\system32\wuapi.dll
2006-10-23 20:56 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-10-23 20:56 195,352 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-10-23 20:56 175,896 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-10-23 20:56 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-10-23 20:56 128,792 --a------ C:\WINDOWS\system32\wucltui.dll
2006-10-23 20:29 891,711 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2006-10-23 20:29 57,728 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2006-10-23 20:29 3,494,303 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-10-23 20:29 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2006-10-23 20:28 9,856 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2006-10-23 20:28 70,144 --a------ C:\WINDOWS\system32\usbui.dll
2006-10-23 20:28 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2006-10-23 20:28 23,070 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2006-10-23 20:28 19,456 --ah----- C:\WINDOWS\system32\gxuhrvf.exe
2006-10-23 20:28 18,432 --ah----- C:\WINDOWS\system32\yoqjsm.exe
2006-10-23 20:26 86,044 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-10-23 20:26 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-10-23 20:26 73,216 --a------ C:\WINDOWS\system32\storprop.dll
2006-10-23 20:26 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-10-23 20:26 67,584 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-10-23 20:26 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-10-23 20:26 6,656 --a------ C:\WINDOWS\system32\batt.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-10-23 20:26 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-10-23 20:26 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-10-23 20:26 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-10-23 20:26 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-10-23 20:26 15,872 --a------ C:\WINDOWS\TASKMAN.EXE
2006-10-23 20:26 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-10-23 20:26 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-10-23 20:26 10,496 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2006-10-23 19:47 87,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2006-10-23 19:47 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2006-10-23 19:47 666,240 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-10-23 19:47 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2006-10-23 19:47 36,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2006-10-23 19:47 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2006-10-23 19:47 24,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2006-10-23 19:47 16,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2006-10-23 19:47 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2006-10-23 19:37 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-10-23 19:36 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-10-23 19:36 73,728 --a------ C:\WINDOWS\system32\ils.dll
2006-10-23 19:36 72,192 --a------ C:\WINDOWS\system32\acctres.dll
2006-10-23 19:36 69,632 --a------ C:\WINDOWS\system32\icwdial.dll
2006-10-23 19:36 69,376 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-10-23 19:36 63,488 --a------ C:\WINDOWS\system32\srclient.dll
2006-10-23 19:36 61,440 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-10-23 19:36 50,688 --a------ C:\WINDOWS\system32\INETRES.DLL
2006-10-23 19:36 40,960 --a------ C:\WINDOWS\system32\safrslv.dll
2006-10-23 19:36 39,424 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-10-23 19:36 360,960 --a------ C:\WINDOWS\system32\qmgr.dll
2006-10-23 19:36 33,792 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-10-23 19:36 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-10-23 19:36 28,672 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-10-23 19:36 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-10-23 19:36 26,624 --a------ C:\WINDOWS\system32\safrdm.dll
2006-10-23 19:36 229,376 --a------ C:\WINDOWS\system32\srrstr.dll
2006-10-23 19:36 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-10-23 19:36 159,232 --a------ C:\WINDOWS\system32\srsvc.dll
2006-10-23 19:36 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-10-23 19:36 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-10-23 19:35 91,136 --a------ C:\WINDOWS\system32\MSOERT2.DLL
2006-10-23 19:35 9,728 --a------ C:\WINDOWS\system32\mstinit.exe
2006-10-23 19:35 65,536 --a------ C:\WINDOWS\system32\msconf.dll
2006-10-23 19:35 596,480 --a------ C:\WINDOWS\system32\INETCOMM.DLL
2006-10-23 19:35 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-10-23 19:35 256,512 --a------ C:\WINDOWS\system32\mstask.dll
2006-10-23 19:35 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-10-23 19:35 229,376 --a------ C:\WINDOWS\system32\MSOEACCT.DLL
2006-10-23 19:35 161,280 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-10-23 19:34 974,336 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-10-23 19:34 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-10-23 19:34 9,216 --a------ C:\WINDOWS\system32\icaapi.dll
2006-10-23 19:34 89,600 --a------ C:\WINDOWS\system32\comrepl.dll
2006-10-23 19:34 88,576 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-10-23 19:34 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-10-23 19:34 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2006-10-23 19:34 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-10-23 19:34 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-10-23 19:34 634,880 --a------ C:\WINDOWS\system32\getuname.dll
2006-10-23 19:34 61,952 --a------ C:\WINDOWS\system32\rdshost.exe
2006-10-23 19:34 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-10-23 19:34 598,016 --a------ C:\WINDOWS\system32\mstscax.dll
2006-10-23 19:34 57,856 --a------ C:\WINDOWS\system32\remotepg.dll
2006-10-23 19:34 57,856 --a------ C:\WINDOWS\system32\licwmi.dll
2006-10-23 19:34 57,344 --a------ C:\WINDOWS\system32\sol.exe
2006-10-23 19:34 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2006-10-23 19:34 54,784 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-10-23 19:34 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-10-23 19:34 534,528 --a------ C:\WINDOWS\system32\spider.exe
2006-10-23 19:34 53,248 --a------ C:\WINDOWS\system32\servdeps.dll
2006-10-23 19:34 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-10-23 19:34 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-10-23 19:34 499,200 --a------ C:\WINDOWS\system32\comuid.dll
2006-10-23 19:34 497,152 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-10-23 19:34 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-10-23 19:34 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-10-23 19:34 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-10-23 19:34 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-10-23 19:34 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-10-23 19:34 393,216 --a------ C:\WINDOWS\system32\mstsc.exe
2006-10-23 19:34 38,024 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-10-23 19:34 368,640 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-10-23 19:34 35,840 --a------ C:\WINDOWS\system32\winchat.exe
2006-10-23 19:34 344,576 --a------ C:\WINDOWS\system32\mspaint.exe
2006-10-23 19:34 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-10-23 19:34 33,280 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-10-23 19:34 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-10-23 19:34 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-10-23 19:34 232,960 --a------ C:\WINDOWS\system32\avtapi.dll
2006-10-23 19:34 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-10-23 19:34 22,528 --a------ C:\WINDOWS\system32\msg.exe
2006-10-23 19:34 202,752 --a------ C:\WINDOWS\system32\termsrv.dll
2006-10-23 19:34 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-10-23 19:34 20,232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-10-23 19:34 19,456 --a------ C:\WINDOWS\system32\qprocess.exe
2006-10-23 19:34 185,344 --a------ C:\WINDOWS\system32\accwiz.exe
2006-10-23 19:34 182,400 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-10-23 19:34 180,736 --a------ C:\WINDOWS\system32\cmprops.dll
2006-10-23 19:34 17,408 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-10-23 19:34 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-10-23 19:34 16,896 --a------ C:\WINDOWS\system32\tskill.exe
2006-10-23 19:34 16,896 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-10-23 19:34 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-10-23 19:34 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-10-23 19:34 150,528 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-10-23 19:34 15,872 --a------ C:\WINDOWS\system32\logoff.exe
2006-10-23 19:34 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-10-23 19:34 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2006-10-23 19:34 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2006-10-23 19:34 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-10-23 19:34 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-10-23 19:34 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-10-23 19:34 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-10-23 19:34 135,680 --a------ C:\WINDOWS\system32\rdchost.dll
2006-10-23 19:34 130,560 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-10-23 19:34 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2006-10-23 19:34 125,952 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-10-23 19:34 125,720 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-10-23 19:34 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-10-23 19:34 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-10-23 19:34 118,272 --a------ C:\WINDOWS\system32\mplay32.exe
2006-10-23 19:34 115,976 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-10-23 19:34 115,200 --a------ C:\WINDOWS\system32\calc.exe
2006-10-23 19:34 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-10-23 19:34 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-10-23 19:34 11,144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-10-23 19:34 100,352 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-10-23 19:34 10,240 --a------ C:\WINDOWS\system32\reset.exe
2006-10-23 19:34 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-10-23 19:34 1,263 --a------ C:\WINDOWS\system32\usrlogon.cmd


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-25 22:54 -------- d-------- C:\Program Files\Fichiers communs
2006-10-25 22:52 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-25 20:55 -------- d-------- C:\Program Files\MSN Messenger
2006-10-25 20:55 -------- d-------- C:\Program Files\Fichiers communs\Microsoft Shared
2006-10-25 20:39 -------- d-------- C:\Documents and Settings\Arnaud.NO\Application Data\Macromedia
2006-10-25 01:13 -------- d-------- C:\Program Files\Windows Media Player
2006-10-25 00:49 -------- d-------- C:\Program Files\Grisoft
2006-10-25 00:45 -------- d-------- C:\Program Files\CCleaner
2006-10-25 00:41 -------- d---s---- C:\Documents and Settings\Arnaud.NO\Application Data\Microsoft
2006-10-25 00:40 -------- d-------- C:\Program Files\Outlook Express
2006-10-25 00:40 -------- d-------- C:\Program Files\Fichiers communs\System
2006-10-25 00:33 -------- d-------- C:\Program Files\Messenger
2006-10-24 13:12 -------- d-------- C:\Documents and Settings\Arnaud.NO\Application Data\Ahead
2006-10-24 13:10 -------- d-------- C:\Program Files\Fichiers communs\Ahead
2006-10-24 13:10 -------- d-------- C:\Program Files\Ahead
2006-10-24 08:45 -------- d-------- C:\Program Files\GrabIt
2006-10-23 23:28 -------- d-------- C:\Documents and Settings\Arnaud.NO\Application Data\Talkback
2006-10-23 22:49 -------- d-------- C:\Program Files\Sysclean Package
2006-10-23 21:51 8192 --a------ C:\WINDOWS\system32\winhlp32.exe
2006-10-23 21:51 77824 --a------ C:\WINDOWS\system32\wmpstub.exe
2006-10-23 21:51 4096 --a------ C:\WINDOWS\system32\winver.exe
2006-10-23 21:51 32256 --a------ C:\WINDOWS\system32\wupdmgr.exe
2006-10-23 21:51 31232 --a------ C:\WINDOWS\system32\wpabaln.exe
2006-10-23 21:51 29696 --a------ C:\WINDOWS\system32\wpnpinst.exe
2006-10-23 21:51 28160 --a------ C:\WINDOWS\system32\xcopy.exe
2006-10-23 21:51 271360 --a------ C:\WINDOWS\winhlp32.exe
2006-10-23 21:51 25600 --a------ C:\WINDOWS\twunk_32.exe
2006-10-23 21:51 118784 --a------ C:\WINDOWS\system32\wscript.exe
2006-10-23 21:51 11776 --a------ C:\WINDOWS\system32\winmsd.exe
2006-10-23 21:50 97792 --a------ C:\WINDOWS\system32\scardsvr.exe
2006-10-23 21:50 9216 --a------ C:\WINDOWS\system32\subst.exe
2006-10-23 21:50 86528 --a------ C:\WINDOWS\system32\smlogsvc.exe
2006-10-23 21:50 8192 --a------ C:\WINDOWS\system32\scrnsave.scr
2006-10-23 21:50 77824 --a------ C:\WINDOWS\system32\usrmlnka.exe
2006-10-23 21:50 75776 --a------ C:\WINDOWS\system32\tlntsess.exe
2006-10-23 21:50 75264 --a------ C:\WINDOWS\system32\rtcshare.exe
2006-10-23 21:50 74240 --a------ C:\WINDOWS\system32\tasklist.exe
2006-10-23 21:50 74240 --a------ C:\WINDOWS\system32\taskkill.exe
2006-10-23 21:50 72704 --a------ C:\WINDOWS\system32\sdbinst.exe
2006-10-23 21:50 7168 --a------ C:\WINDOWS\system32\recover.exe
2006-10-23 21:50 70656 --a------ C:\WINDOWS\system32\systeminfo.exe
2006-10-23 21:50 70656 --a------ C:\WINDOWS\system32\shrpubw.exe
2006-10-23 21:50 69632 --a------ C:\WINDOWS\system32\usrshuta.exe
2006-10-23 21:50 69632 --a------ C:\WINDOWS\system32\tlntsvr.exe
2006-10-23 21:50 671744 --a------ C:\WINDOWS\system32\ss3dfo.scr
2006-10-23 21:50 67072 --a------ C:\WINDOWS\system32\sigverif.exe
2006-10-23 21:50 643072 --a------ C:\WINDOWS\system32\sstext3d.scr
2006-10-23 21:50 62976 --a------ C:\WINDOWS\system32\rsopprov.exe
2006-10-23 21:50 61952 --a------ C:\WINDOWS\system32\wextract.exe
2006-10-23 21:50 61440 --a------ C:\WINDOWS\system32\usrprbda.exe
2006-10-23 21:50 59904 --a------ C:\WINDOWS\system32\tlntadmn.exe
2006-10-23 21:50 569344 --a------ C:\WINDOWS\system32\sspipes.scr
2006-10-23 21:50 54784 --a------ C:\WINDOWS\system32\rasphone.exe
2006-10-23 21:50 53248 --a------ C:\WINDOWS\system32\rsm.exe
2006-10-23 21:50 51712 --a------ C:\WINDOWS\system32\w32tm.exe
2006-10-23 21:50 51200 --a------ C:\WINDOWS\system32\syncapp.exe
2006-10-23 21:50 51200 --a------ C:\WINDOWS\system32\spoolsv.exe
2006-10-23 21:50 51200 --a------ C:\WINDOWS\system32\reg.exe
2006-10-23 21:50 49664 --a------ C:\WINDOWS\system32\rsmui.exe
2006-10-23 21:50 47616 --a------ C:\WINDOWS\system32\utilman.exe
2006-10-23 21:50 4608 --a------ C:\WINDOWS\system32\regwiz.exe
2006-10-23 21:50 43008 --a------ C:\WINDOWS\system32\ssmypics.scr
2006-10-23 21:50 419840 --a------ C:\WINDOWS\system32\wiaacmgr.exe
2006-10-23 21:50 4096 --a------ C:\WINDOWS\system32\unlodctr.exe
2006-10-23 21:50 37888 --a------ C:\WINDOWS\system32\syskey.exe
2006-10-23 21:50 37376 --a------ C:\WINDOWS\system32\typeperf.exe
2006-10-23 21:50 364544 --a------ C:\WINDOWS\system32\ssflwbox.scr
2006-10-23 21:50 3584 --a------ C:\WINDOWS\system32\regedt32.exe
2006-10-23 21:50 346624 --a------ C:\WINDOWS\system32\tourstart.exe
2006-10-23 21:50 34304 --a------ C:\WINDOWS\system32\vssadmin.exe
2006-10-23 21:50 34304 --a------ C:\WINDOWS\system32\rcimlby.exe
2006-10-23 21:50 33792 --a------ C:\WINDOWS\system32\relog.exe
2006-10-23 21:50 33280 --a------ C:\WINDOWS\system32\shmgrate.exe
2006-10-23 21:50 32256 --a------ C:\WINDOWS\system32\tracert6.exe
2006-10-23 21:50 31232 --a------ C:\WINDOWS\system32\sc.exe
2006-10-23 21:50 3072 --a------ C:\WINDOWS\system32\systray.exe
2006-10-23 21:50 30208 --a------ C:\WINDOWS\system32\sethc.exe
2006-10-23 21:50 281088 --a------ C:\WINDOWS\system32\vssvc.exe
2006-10-23 21:50 25600 --a------ C:\WINDOWS\system32\routemon.exe
2006-10-23 21:50 25088 --a------ C:\WINDOWS\system32\sort.exe
2006-10-23 21:50 24576 --a------ C:\WINDOWS\system32\rsmsink.exe
2006-10-23 21:50 24064 --a------ C:\WINDOWS\system32\skeys.exe
2006-10-23 21:50 232448 --a------ C:\WINDOWS\system32\tracerpt.exe
2006-10-23 21:50 22528 --a------ C:\WINDOWS\system32\userinit.exe
2006-10-23 21:50 21504 --a------ C:\WINDOWS\system32\route.exe
2006-10-23 21:50 21504 --a------ C:\WINDOWS\system32\rcp.exe
2006-10-23 21:50 20992 --a------ C:\WINDOWS\system32\stimon.exe
2006-10-23 21:50 20992 --a------ C:\WINDOWS\system32\setup.exe
2006-10-23 21:50 19968 --a------ C:\WINDOWS\system32\savedump.exe
2006-10-23 21:50 19456 --a------ C:\WINDOWS\system32\tcpsvcs.exe
2006-10-23 21:50 19456 --a------ C:\WINDOWS\system32\ssmarque.scr
2006-10-23 21:50 18944 --a------ C:\WINDOWS\system32\ssbezier.scr
2006-10-23 21:50 18944 --a------ C:\WINDOWS\system32\shutdown.exe
2006-10-23 21:50 17920 --a------ C:\WINDOWS\system32\tftp.exe
2006-10-23 21:50 17920 --a------ C:\WINDOWS\system32\secedit.exe
2006-10-23 21:50 17408 --a------ C:\WINDOWS\system32\ssmyst.scr
2006-10-23 21:50 17408 --a------ C:\WINDOWS\system32\runas.exe
2006-10-23 21:50 16384 --a------ C:\WINDOWS\system32\ups.exe
2006-10-23 21:50 15872 --a------ C:\WINDOWS\system32\taskman.exe
2006-10-23 21:50 14848 --a------ C:\WINDOWS\system32\upnpcont.exe
2006-10-23 21:50 14336 --a------ C:\WINDOWS\system32\rsh.exe
2006-10-23 21:50 136192 --a------ C:\WINDOWS\system32\taskmgr.exe
2006-10-23 21:50 13312 --a------ C:\WINDOWS\system32\tcmsetup.exe
2006-10-23 21:50 13312 --a------ C:\WINDOWS\system32\ssstars.scr
2006-10-23 21:50 132608 --a------ C:\WINDOWS\system32\rsvp.exe
2006-10-23 21:50 12800 --a------ C:\WINDOWS\system32\runonce.exe
2006-10-23 21:50 12800 --a------ C:\WINDOWS\system32\rexec.exe
2006-10-23 21:50 12800 --a------ C:\WINDOWS\system32\replace.exe
2006-10-23 21:50 122368 --a------ C:\WINDOWS\system32\schtasks.exe
2006-10-23 21:50 11776 --a------ C:\WINDOWS\system32\tracert.exe
2006-10-23 21:50 11776 --a------ C:\WINDOWS\system32\rasdial.exe
2006-10-23 21:50 11776 --a------ C:\WINDOWS\system32\rasautou.exe
2006-10-23 21:50 10752 --a------ C:\WINDOWS\system32\spiisupd.exe
2006-10-23 21:50 104960 --a------ C:\WINDOWS\system32\sysocmgr.exe
2006-10-23 21:50 103936 --a------ C:\WINDOWS\system32\rsnotify.exe
2006-10-23 21:50 102912 --a------ C:\WINDOWS\system32\verifier.exe
2006-10-23 21:50 10240 --a------ C:\WINDOWS\system32\sfc.exe
2006-10-23 21:50 10240 --a------ C:\WINDOWS\system32\regsvr32.exe
2006-10-23 21:49 99840 --a------ C:\WINDOWS\system32\iexpress.exe
2006-10-23 21:49 97792 --a------ C:\WINDOWS\system32\mqtgsvc.exe
2006-10-23 21:49 9728 --a------ C:\WINDOWS\system32\label.exe
2006-10-23 21:49 9216 --a------ C:\WINDOWS\system32\print.exe
2006-10-23 21:49 9216 --a------ C:\WINDOWS\system32\lpr.exe
2006-10-23 21:49 9216 --a------ C:\WINDOWS\system32\find.exe
2006-10-23 21:49 9216 --a------ C:\WINDOWS\system32\eventvwr.exe
2006-10-23 21:49 8704 --a------ C:\WINDOWS\system32\hostname.exe
2006-10-23 21:49 8192 --a------ C:\WINDOWS\system32\mountvol.exe
2006-10-23 21:49 81408 --a------ C:\WINDOWS\system32\eventtriggers.exe
2006-10-23 21:49 794624 --a------ C:\WINDOWS\system32\dxdiag.exe
2006-10-23 21:49 79360 --a------ C:\WINDOWS\system32\makecab.exe
2006-10-23 21:49 78848 --a------ C:\WINDOWS\system32\msiexec.exe
2006-10-23 21:49 775168 --a------ C:\WINDOWS\system32\mmc.exe
2006-10-23 21:49 74240 --a------ C:\WINDOWS\system32\nslookup.exe
2006-10-23 21:49 7168 --a------ C:\WINDOWS\system32\forcedos.exe
2006-10-23 21:49 68096 --a------ C:\WINDOWS\system32\magnify.exe
2006-10-23 21:49 68096 --a------ C:\WINDOWS\system32\locator.exe
2006-10-23 21:49 67584 --a------ C:\WINDOWS\system32\notepad.exe
2006-10-23 21:49 6656 --a------ C:\WINDOWS\system32\msswchx.exe
2006-10-23 21:49 65536 --a------ C:\WINDOWS\system32\openfiles.exe
2006-10-23 21:49 61952 --a------ C:\WINDOWS\system32\fsutil.exe
2006-10-23 21:49 6144 --a------ C:\WINDOWS\system32\lpq.exe
2006-10-23 21:49 59392 --a------ C:\WINDOWS\system32\gpupdate.exe
2006-10-23 21:49 57856 --a------ C:\WINDOWS\system32\logman.exe
2006-10-23 21:49 57344 --a------ C:\WINDOWS\system32\getmac.exe
2006-10-23 21:49 54784 --a------ C:\WINDOWS\system32\packager.exe
2006-10-23 21:49 54272 --a------ C:\WINDOWS\system32\ipconfig.exe
2006-10-23 21:49 53248 --a------ C:\WINDOWS\system32\odbcconf.exe
2006-10-23 21:49 52736 --a------ C:\WINDOWS\system32\narrator.exe
2006-10-23 21:49 52736 --a------ C:\WINDOWS\system32\migpwd.exe
2006-10-23 21:49 5120 --a------ C:\WINDOWS\system32\lodctr.exe
2006-10-23 21:49 505344 --a------ C:\WINDOWS\system32\logonui.exe
2006-10-23 21:49 50176 --a------ C:\WINDOWS\system32\eventcreate.exe
2006-10-23 21:49 46080 --a------ C:\WINDOWS\system32\ipsec6.exe
2006-10-23 21:49 4608 --a------ C:\WINDOWS\system32\mqsvc.exe
2006-10-23 21:49 45568 --a------ C:\WINDOWS\system32\proquota.exe
2006-10-23 21:49 44032 --a------ C:\WINDOWS\system32\ftp.exe
2006-10-23 21:49 41984 --a------ C:\WINDOWS\system32\osuninst.exe
2006-10-23 21:49 40960 --a------ C:\WINDOWS\system32\extrac32.exe
2006-10-23 21:49 4096 --a------ C:\WINDOWS\system32\nddeapir.exe
2006-10-23 21:49 396800 --a------ C:\WINDOWS\system32\ntvdm.exe
2006-10-23 21:49 39424 --a------ C:\WINDOWS\system32\net.exe
2006-10-23 21:49 39424 --a------ C:\WINDOWS\system32\esentutl.exe
2006-10-23 21:49 37888 --a------ C:\WINDOWS\system32\grpconv.exe
2006-10-23 21:49 34304 --a------ C:\WINDOWS\system32\ping6.exe
2006-10-23 21:49 329728 --a------ C:\WINDOWS\system32\netsetup.exe
2006-10-23 21:49 32768 --a------ C:\WINDOWS\system32\odbcad32.exe
2006-10-23 21:49 31744 --a------ C:\WINDOWS\system32\ntsd.exe
2006-10-23 21:49 31744 --a------ C:\WINDOWS\system32\netstat.exe
2006-10-23 21:49 3072 --a------ C:\WINDOWS\system32\fixmapi.exe
2006-10-23 21:49 30208 --a------ C:\WINDOWS\system32\lights.exe
2006-10-23 21:49 28672 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-10-23 21:49 27136 --a------ C:\WINDOWS\system32\findstr.exe
2006-10-23 21:49 26624 --a------ C:\WINDOWS\system32\lnkstub.exe
2006-10-23 21:49 24576 --a------ C:\WINDOWS\system32\logagent.exe
2006-10-23 21:49 24064 --a------ C:\WINDOWS\system32\mshta.exe
2006-10-23 21:49 23040 --a------ C:\WINDOWS\system32\proxycfg.exe
2006-10-23 21:49 23040 --a------ C:\WINDOWS\system32\ipxroute.exe
2006-10-23 21:49 22528 --a------ C:\WINDOWS\system32\pathping.exe
2006-10-23 21:49 22016 --a------ C:\WINDOWS\system32\mpnotify.exe
2006-10-23 21:49 21504 --a------ C:\WINDOWS\system32\nbtstat.exe
2006-10-23 21:49 213504 --a------ C:\WINDOWS\system32\osk.exe
2006-10-23 21:49 208896 --a------ C:\WINDOWS\system32\progman.exe
2006-10-23 21:49 19968 --a------ C:\WINDOWS\system32\fontview.exe
2006-10-23 21:49 180736 --a------ C:\WINDOWS\system32\eudcedit.exe
2006-10-23 21:49 17920 --a------ C:\WINDOWS\system32\ping.exe
2006-10-23 21:49 17408 --a------ C:\WINDOWS\system32\mqbkup.exe
2006-10-23 21:49 16896 --a------ C:\WINDOWS\system32\expand.exe
2006-10-23 21:49 16384 --a------ C:\WINDOWS\system32\help.exe
2006-10-23 21:49 15360 --a------ C:\WINDOWS\system32\pentnt.exe
2006-10-23 21:49 14848 --a------ C:\WINDOWS\system32\fc.exe
2006-10-23 21:49 14336 --a------ C:\WINDOWS\system32\perfmon.exe
2006-10-23 21:49 14336 --a------ C:\WINDOWS\system32\mrinfo.exe
2006-10-23 21:49 136192 --a------ C:\WINDOWS\system32\mobsync.exe
2006-10-23 21:49 129024 --a------ C:\WINDOWS\system32\nwscript.exe
2006-10-23 21:49 123904 --a------ C:\WINDOWS\system32\imapi.exe
2006-10-23 21:49 116736 --a------ C:\WINDOWS\system32\gpresult.exe
2006-10-23 21:49 1166336 --a------ C:\WINDOWS\system32\ntbackup.exe
2006-10-23 21:49 115200 --a------ C:\WINDOWS\system32\net1.exe
2006-10-23 21:49 109056 --a------ C:\WINDOWS\system32\netdde.exe
2006-10-23 21:49 10240 --a------ C:\WINDOWS\system32\finger.exe
2006-10-23 21:48 9216 --a------ C:\WINDOWS\system32\dumprep.exe
2006-10-23 21:48 60928 --a------ C:\WINDOWS\system32\driverquery.exe
2006-10-23 21:48 59392 --a------ C:\WINDOWS\system32\dvdplay.exe
2006-10-23 21:48 58368 --a------ C:\WINDOWS\system32\dpvsetup.exe
2006-10-23 21:48 47104 --a------ C:\WINDOWS\system32\drwtsn32.exe
2006-10-23 21:48 4608 --a------ C:\WINDOWS\system32\dllhst3g.exe
2006-10-23 21:48 26112 --a------ C:\WINDOWS\system32\dplaysvr.exe
2006-10-23 21:48 205312 --a------ C:\WINDOWS\system32\dmadmin.exe
2006-10-23 21:48 18944 --a------ C:\WINDOWS\system32\dpnsvr.exe
2006-10-23 21:48 180224 --a------ C:\WINDOWS\system32\dwwin.exe
2006-10-23 21:48 15872 --a------ C:\WINDOWS\system32\dvdupgrd.exe
2006-10-23 21:48 14336 --a------ C:\WINDOWS\system32\dmremote.exe
2006-10-23 21:48 10752 --a------ C:\WINDOWS\system32\doskey.exe
2006-10-23 21:45 8192 --a------ C:\WINDOWS\system32\control.exe
2006-10-23 21:45 8192 --a------ C:\WINDOWS\system32\cidaemon.exe
2006-10-23 21:45 79360 --a------ C:\WINDOWS\system32\diantz.exe
2006-10-23 21:45 7680 --a------ C:\WINDOWS\system32\ckcnv.exe
2006-10-23 21:45 76288 --a------ C:\WINDOWS\system32\dfrgfat.exe
2006-10-23 21:45 70656 --a------ C:\WINDOWS\system32\defrag.exe
2006-10-23 21:45 62976 --a------ C:\WINDOWS\system32\cleanmgr.exe
2006-10-23 21:45 56832 --a------ C:\WINDOWS\system32\cmstp.exe
2006-10-23 21:45 5120 --a------ C:\WINDOWS\system32\cisvc.exe
2006-10-23 21:45 5120 --a------ C:\WINDOWS\system32\bootvrfy.exe
2006-10-23 21:45 4608 --a------ C:\WINDOWS\system32\bootok.exe
2006-10-23 21:45 45568 --a------ C:\WINDOWS\system32\cipher.exe
2006-10-23 21:45 45056 --a------ C:\WINDOWS\system32\cliconfg.exe
2006-10-23 21:45 41472 --a------ C:\WINDOWS\system32\cmdl32.exe
2006-10-23 21:45 388096 --a------ C:\WINDOWS\system32\cmd.exe
2006-10-23 21:45 35840 --a------ C:\WINDOWS\system32\cmmon32.exe
2006-10-23 21:45 30720 --a------ C:\WINDOWS\system32\clipsrv.exe
2006-10-23 21:45 28672 --a------ C:\WINDOWS\system32\ddeshare.exe
2006-10-23 21:45 24576 --a------ C:\WINDOWS\system32\conime.exe
2006-10-23 21:45 19456 --a------ C:\WINDOWS\system32\diskperf.exe
2006-10-23 21:45 19456 --a------ C:\WINDOWS\system32\cacls.exe
2006-10-23 21:45 18432 --a------ C:\WINDOWS\system32\compact.exe
2006-10-23 21:45 15872 --a------ C:\WINDOWS\system32\comp.exe
2006-10-23 21:45 152064 --a------ C:\WINDOWS\system32\bootcfg.exe
2006-10-23 21:45 150016 --a------ C:\WINDOWS\system32\diskpart.exe
2006-10-23 21:45 13824 --a------ C:\WINDOWS\system32\convert.exe
2006-10-23 21:45 13312 --a------ C:\WINDOWS\system32\ctfmon.exe
2006-10-23 21:45 11776 --a------ C:\WINDOWS\system32\chkdsk.exe
2006-10-23 21:45 11264 --a------ C:\WINDOWS\system32\chkntfs.exe
2006-10-23 21:45 102400 --a------ C:\WINDOWS\system32\cscript.exe
2006-10-23 21:44 91648 --a------ C:\WINDOWS\system32\ahui.exe
2006-10-23 21:44 41984 --a------ C:\WINDOWS\system32\alg.exe
2006-10-23 21:44 4096 --a------ C:\WINDOWS\system32\actmovie.exe
2006-10-23 21:44 37888 --a------ C:\WINDOWS\system32\asr_ldm.exe
2006-10-23 21:44 29696 --a------ C:\WINDOWS\system32\asr_pfu.exe
2006-10-23 21:44 27648 --a------ C:\WINDOWS\system32\asr_fmt.exe
2006-10-23 21:44 22528 --a------ C:\WINDOWS\system32\at.exe
2006-10-23 21:44 19968 --a------ C:\WINDOWS\system32\arp.exe
2006-10-23 21:44 140800 --a------ C:\WINDOWS\regedit.exe
2006-10-23 21:44 11264 --a------ C:\WINDOWS\system32\attrib.exe
2006-10-23 21:44 10240 --a------ C:\WINDOWS\system32\atmadm.exe
2006-10-23 21:42 -------- d-------- C:\Program Files\Windows NT
2006-10-23 21:42 -------- d-------- C:\Program Files\Realtek AC97
2006-10-23 21:42 -------- d-------- C:\Program Files\QuickTime
2006-10-23 21:42 -------- d-------- C:\Program Files\NetMeeting
2006-10-23 21:42 -------- d-------- C:\Program Files\Movie Maker
2006-10-23 20:56 -------- d--h----- C:\Program Files\WindowsUpdate
2006-10-23 20:36 -------- d-------- C:\Program Files\Internet Explorer
2006-10-23 20:35 -------- d-------- C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla
2006-10-23 20:26 62 --ahs---- C:\Documents and Settings\Arnaud.NO\Application Data\desktop.ini
2006-10-23 19:43 -------- d-------- C:\Documents and Settings\Arnaud.NO\Application Data\Identities
2006-10-23 13:10 -------- d-------- C:\Program Files\Sunbelt Software
2006-10-23 12:44 -------- d-------- C:\Program Files\Alwil Software
2006-10-23 11:56 -------- d-------- C:\Program Files\VSToolbar
2006-10-03 21:11 -------- d-------- C:\Program Files\Fichiers communs\Macromedia Shared
2006-10-03 21:11 -------- d-------- C:\Program Files\Fichiers communs\Macromedia
2006-10-03 21:10 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-03 21:09 -------- d-------- C:\Program Files\Fichiers communs\InstallShield
2006-09-24 23:33 -------- d-------- C:\Program Files\EPSON
2006-09-24 23:27 -------- d-------- C:\Program Files\Agfa
2006-09-24 23:22 -------- d-------- C:\Program Files\Adobe
2006-09-24 23:20 -------- d-------- C:\Program Files\Fichiers communs\Adobe
2006-09-24 23:19 -------- d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2006-08-25 17:54 561664 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-25 11:14 613888 --a------ C:\WINDOWS\system32\xpsp2res.dll
2006-08-03 21:36 0 -rahs---- C:\MSDOS.SYS
2006-08-03 21:36 0 -rahs---- C:\IO.SYS
2006-08-03 21:36 0 --a------ C:\CONFIG.SYS
2006-08-03 21:36 0 --a------ C:\AUTOEXEC.BAT
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"Windows LoL Layer"="fntur.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"IY\\_OR"="C:\\WINDOWS\\System32\\wgedyokgmtpwq.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"Windows LoL Layer"="fntur.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Windows LoL Layer"="fntur.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,42,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Urrr"="\"C:\\WINDOWS\\system32\\config\\SYSTEM~1\\MESDOC~1\\YMBOLS~1\\msdtc.exe\" -vt yazb"
"Windows LoL Layer"="fntur.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Urrr"="\"C:\\WINDOWS\\system32\\config\\SYSTEM~1\\MESDOC~1\\YMBOLS~1\\msdtc.exe\" -vt yazb"
"Windows LoL Layer"="fntur.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{3A947772-3B29-41DB-A436-4B5CAAECE2F6}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\At1.job

Completion time: 06-10-25 22:56:54.18
C:\ComboFix.txt ... 06-10-25 22:56


SDFix :


SDFix: Version 1.32
-------------------

Scan run on:
25/10/2006

Time:
23:01


Microsoft Windows XP [version 5.1.2600]

Running from: C:\Documents and Settings\Arnaud.NO\Bureau\SDFix

Stage One...

Checking Services...

Name:
-----


Path:
----




Repairing Registry...

Restoring Default Hosts File...

Stage One Complete

Rebooting...

Stage Two...

Checking For Malware:
--------------------

C:\DOCUME~1\ARNAUD.NO\LOCALS~1\TEMPOR~1\CONTENT.IE5\0TAF89MR\DRSMAR~1.EXE
C:\DOCUME~1\ARNAUD.NO\LOCALS~1\TEMPOR~1\CONTENT.IE5\WXYFSXYJ\LOADER~1.EXE
C:\MC44A35.EXE
C:\MC44A36.EXE
C:\MC44A37.EXE
C:\WINDOWS\Prefetch\DRSMARTLOAD.EXE-113D05CC.pf
C:\WINDOWS\system32\i

Backing Up and Removing any Files Found...

Final Check:

Services:
---------




Files:
------



Any files removed are saved to the SDFix\backups Folder

FINISHED


Merci beaucoup de m'aider.

Salut

Voilà le rapport de AVG AS :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 22:19:35 26/10/2006

+ Résultat de l'analyse:



C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011347.dll -> Adware.Look2Me : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011348.dll -> Adware.Look2Me : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011349.dll -> Adware.Look2Me : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011350.dll -> Adware.Look2Me : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011351.dll -> Adware.Look2Me : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009408.exe -> Backdoor.IRCBot.xn : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\__delete_on_reboot__e_x_p_l_o_r_e_r_._e_x_e_ -> Backdoor.IRCBot.xn : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009410.exe -> Backdoor.PoeBot.j : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009409.exe -> Dialer.PlayGames.l : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011424.exe -> Downloader.Adload.fu : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011425.exe -> Downloader.Adload.fu : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011426.exe -> Downloader.Adload.fu : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Arnaud.NO\Local Settings\Temporary Internet Files\Content.IE5\S5QBSHMJ\kybrdff_e[1].exe -> Downloader.Adload.fy : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011396.exe -> Downloader.Adload.fy : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Arnaud\Local Settings\Temporary Internet Files\Content.IE5\WLYB0DQR\loader[1].exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009401.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011391.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{9D9EDA48-F7C1-40E8-9904-FA8303D3F5F2}\RP24\A0006227.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{9D9EDA48-F7C1-40E8-9904-FA8303D3F5F2}\RP25\A0007262.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{9D9EDA48-F7C1-40E8-9904-FA8303D3F5F2}\RP25\A0007330.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{9D9EDA48-F7C1-40E8-9904-FA8303D3F5F2}\RP26\A0007405.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{9D9EDA48-F7C1-40E8-9904-FA8303D3F5F2}\RP26\A0008404.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{9D9EDA48-F7C1-40E8-9904-FA8303D3F5F2}\RP26\A0009492.exe -> Downloader.Adload.hg : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009411.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009412.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009413.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009414.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009415.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009416.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009417.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP43\A0009418.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{8E8CC394-7C7B-46F3-B473-58562DDB0B31}\RP44\A0011329.dll -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
C:\VundoFix Backups\mljifdd.dll.bad -> Hijacker.Small.mb : Nettoyé et sauvegardé (mise en quarantaine).
:mozilla.130:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.144:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.160:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.161:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.162:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.119:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.85:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.
:mozilla.86:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.
:mozilla.87:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.
:mozilla.88:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.
:mozilla.24:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.79:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.114:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.115:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.116:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.117:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.118:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.77:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Hotlog : Nettoyé.
:mozilla.106:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Nettoyé.
:mozilla.165:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.166:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.100:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.101:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.92:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.93:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.94:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.95:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.96:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.97:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.98:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.99:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.121:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.122:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.123:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.124:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.125:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.16:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.17:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.18:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.78:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Arnaud.NO\Cookies\arnaud@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.20:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.73:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.74:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.75:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.76:C:\Documents and Settings\Arnaud.NO\Application Data\Mozilla\Firefox\Profiles\vk0v1v7z.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport

Est-ce que mon PC est encore infecté? (j'y comprend rien à ces rapports)

Rere

Voilà le rapport de SpySweeper :


01:35: Removal process completed. Elapsed time 00:00:11
01:35: Quarantining All Traces: purityscan
01:35: Quarantining All Traces: zquest
01:35: Quarantining All Traces: weborama cookie
01:35: Quarantining All Traces: bluestreak cookie
01:35: Quarantining All Traces: atlas dmt cookie
01:34: Quarantining All Traces: findthewebsiteyouneed hijack
01:34: Removal process initiated
01:34: Traces Found: 16
01:34: File Sweep Complete, Elapsed Time: 00:35:59
01:34: Sweep Canceled
01:19: Warning: Failed to access drive H:
01:09: a0007261.exe (ID = 449)
01:04: a0007387.exe (ID = 449)
01:03: a0006224.exe (ID = 449)
01:03: a0008390.exe (ID = 449)
01:03: Found Adware: purityscan
00:59: a0008517.exe (ID = 290920)
00:59: Found Adware: zquest
00:58: Starting File Sweep
00:58: Warning: Failed to access drive A:
00:58: Cookie Sweep Complete, Elapsed Time: 00:00:00
00:58: arnaud@weborama[2].txt (ID = 3658)
00:58: Found Spy Cookie: weborama cookie
00:58: arnaud@bluestreak[1].txt (ID = 2314)
00:58: Found Spy Cookie: bluestreak cookie
00:58: arnaud@atdmt[2].txt (ID = 2253)
00:58: Found Spy Cookie: atlas dmt cookie
00:58: Starting Cookie Sweep
00:58: Registry Sweep Complete, Elapsed Time:00:00:16
00:58: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\search\searchassistant explorer\main\ || Default_Search_URL (ID = 1554015)
00:58: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\search\searchassistant explorer\main\ || default_search_url (ID = 555437)
00:58: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || start page (ID = 125239)
00:58: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || search page (ID = 125238)
00:58: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || search bar (ID = 125237)
00:58: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || default_search_url (ID = 125236)
00:58: HKLM\software\microsoft\internet explorer\search\ || searchassistant (ID = 125242)
00:58: HKLM\software\microsoft\internet explorer\main\ || search page (ID = 125241)
00:58: Found Adware: findthewebsiteyouneed hijack
00:58: Starting Registry Sweep
00:58: Memory Sweep Complete, Elapsed Time: 00:00:49
00:57: Starting Memory Sweep
00:57: Sweep initiated using definitions version 734
00:57: Spy Sweeper 5.0.7.1608 started
00:57: | Start of Session, vendredi 27 octobre 2006 |
********
00:56: Traces Found: 0
00:56: Sweep Canceled
00:56: Sweep initiated using definitions version 734
00:56: Spy Sweeper 5.0.7.1608 started
00:56: | Start of Session, vendredi 27 octobre 2006 |
********
00:56: | End of Session, vendredi 27 octobre 2006 |
00:56: Traces Found: 16
00:56: Full Sweep has completed. Elapsed time 01:18:45
00:55: File Sweep Complete, Elapsed Time: 01:17:32
Espace insuffisant pour traiter cette commande
00:55: Warning: Unable to sweep compressed file: System Error. Code: 8.
Espace insuffisant pour traiter cette commande
00:55: Warning: Unable to sweep compressed file: System Error. Code: 8.
00:40: Warning: Stream read error
23:58: Warning: Failed to access drive H:
23:48: a0007261.exe (ID = 449)
23:43: a0007387.exe (ID = 449)
23:43: a0006224.exe (ID = 449)
23:42: a0008390.exe (ID = 449)
23:42: Found Adware: purityscan
23:39: a0008517.exe (ID = 290920)
23:39: Found Adware: zquest
23:38: Starting File Sweep
23:38: Warning: Failed to access drive A:
23:38: Cookie Sweep Complete, Elapsed Time: 00:00:00
23:38: arnaud@weborama[2].txt (ID = 3658)
23:38: Found Spy Cookie: weborama cookie
23:38: arnaud@bluestreak[1].txt (ID = 2314)
23:38: Found Spy Cookie: bluestreak cookie
23:38: arnaud@atdmt[2].txt (ID = 2253)
23:38: Found Spy Cookie: atlas dmt cookie
23:38: Starting Cookie Sweep
23:38: Registry Sweep Complete, Elapsed Time:00:00:08
23:38: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\search\searchassistant explorer\main\ || Default_Search_URL (ID = 1554015)
23:38: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\search\searchassistant explorer\main\ || default_search_url (ID = 555437)
23:38: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || start page (ID = 125239)
23:38: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || search page (ID = 125238)
23:38: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || search bar (ID = 125237)
23:38: HKU\S-1-5-21-854245398-1592454029-682003330-1003\software\microsoft\internet explorer\main\ || default_search_url (ID = 125236)
23:38: HKLM\software\microsoft\internet explorer\search\ || searchassistant (ID = 125242)
23:38: HKLM\software\microsoft\internet explorer\main\ || search page (ID = 125241)
23:38: Found Adware: findthewebsiteyouneed hijack
23:38: Starting Registry Sweep
23:38: Memory Sweep Complete, Elapsed Time: 00:00:31
23:37: Starting Memory Sweep
23:37: Sweep initiated using definitions version 734
23:37: Spy Sweeper 5.0.7.1608 started
23:37: | Start of Session, jeudi 26 octobre 2006 |
********
23:37: | End of Session, jeudi 26 octobre 2006 |
23:36: Program Version 5.0.7.1608 Using Spyware Definitions 734
23:29: Messenger service has been disabled.
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
23:28: Shield States
23:28: Spyware Definitions: 734
23:28: Spy Sweeper 5.0.7.1608 started
23:28: Spy Sweeper 5.0.7.1608 started
23:28: | Start of Session, jeudi 26 octobre 2006 |
********

Désolé j'ai oublié.

Voilà le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 20:05:08, on 27/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Arnaud.NO\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IY\_OR] C:\WINDOWS\System32\wgedyokgmtpwq.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


Merci!

Salut,

heu, je trouve pas le fichier wgedyokgmtpwq.exe, pourtant j'ai affiché les dossiers cachés, extensions et fichiers protégés.
Que dois-je faire?

Merci!

Salut, voilà le dernier rapport HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 20:53:03, on 29/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\GrabIt\GrabIt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Arnaud.NO\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


Je n'ai plus d'alertes d'Avast mais mon PC tourne encore un peu au ralenti.
A ton avis ca peut être du à un virus persistent?
En tout cas merci beaucoup pour ton aide!