[Résolu] Diverses infections

Bonjour,
Avast, spybot, ad-aware indique que mon pc est verolé depuis plusieurs jours mais n'arrive pas a y remédié
J'ai cherché quelques solutions mais sans un reel succes c'est pourquoi je m'en remets a vous !
Merci d'avance :

Log HijackThis :

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\Avast4\ashDisp.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Ad-Aware 2007\Ad-Aware2007.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [4c01461b] rundll32.exe "C:\WINDOWS\system32\baokdmhd.dll",b
O4 - HKLM\..\Run: [BM4f327587] Rundll32.exe "C:\WINDOWS\system32\hnpdaucy.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5CD54B7-4FA1-46C1-9E85-35A2D106DC07}: NameServer = 212.27.54.252
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe

Tout d'abord un grand merci !
Voila le rapport de MalwareByte's Anti-Malware :

Malwarebytes' Anti-Malware 1.11
Version de la base de données: 662

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 148390
Temps écoulé: 32 minute(s), 54 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 16
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\mlJDSIaw.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\urqoLbCr.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fcbabda2-801e-4f51-b6e8-0122032fb16b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcbabda2-801e-4f51-b6e8-0122032fb16b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\aldd (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{fcbabda2-801e-4f51-b6e8-0122032fb16b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM4f327587 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkhysqh -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\jkkHYsQh.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hQsYHkkj.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hQsYHkkj.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\VundoFix Backups\hgGwTNGx.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\VundoFix Backups\mlJDSIaw.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlJDSIaw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\urqoLbCr.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\muydtrow.dll (Trojan.Agent) -> Delete on reboot.

Hop la, merci :

Voila le main :

Deckard's System Scanner v20071014.68
Run by Remi on 2008-04-20 23:50:44
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2008-04-20 21:50:47 UTC - RP1 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Remi.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:51:07, on 20/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\Avast4\ashDisp.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Remi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07F8A8CD-EAAF-4246-AF54-76B7C0E980C1} - C:\WINDOWS\system32\wvUliiIb.dll (file missing)
O2 - BHO: (no name) - {1652ED0D-3F01-40E2-8720-6E9E908FE144} - C:\WINDOWS\system32\urqoLbCr.dll
O2 - BHO: (no name) - {29F3B90B-CE69-4C96-8B4C-72498439105B} - C:\WINDOWS\system32\efcYqqpm.dll (file missing)
O2 - BHO: (no name) - {62B0ACF4-D98A-43D9-BC73-1F7D5366E68A} - (no file)
O2 - BHO: {6faa59d1-9fef-817b-9134-23f3e72981b6} - {6b18927e-3f32-4319-b718-fef91d95aaf6} - C:\WINDOWS\system32\ovgpcefq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C920D7C5-D37A-4FCF-BC31-CF84E21B85F8} - C:\WINDOWS\system32\jkkHYsQh.dll (file missing)
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BM4f327587] Rundll32.exe "C:\WINDOWS\system32\uodttxxo.dll",s
O4 - HKLM\..\Run: [4c01461b] rundll32.exe "C:\WINDOWS\system32\lhxufqbm.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5CD54B7-4FA1-46C1-9E85-35A2D106DC07}: NameServer = 212.27.54.252
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6954 bytes

-- File Associations -----------------------------------------------------------

[COLOR=red].reg - regfile - shell\open\command - regedit.exe "%1" %*[/COLOR]
[COLOR=red].scr - scrfile - shell\open\command - "%1" %*[/COLOR]


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 PLCMPR5 (PLCMPR5 NDIS Protocol Driver) - c:\windows\system32\plcmpr5.sys (file missing)
S3 PLCNDIS5 (PLCNDIS5 NDIS Protocol Driver) - c:\windows\system32\plcndis5.sys <Not Verified; Intellon, Inc.; PCAUSA Rawether for Windows>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\fichiers communs\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service (Service Bonjour) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 StarWindServiceAE (StarWind AE Service) - c:\program files\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID:
Description: Samsung YP-K3
Device ID: USB\VID_04E8&PID_5081\C12310F2000078980B96A890F0016F04
Manufacturer:
Name: Samsung YP-K3
PNP Device ID: USB\VID_04E8&PID_5081\C12310F2000078980B96A890F0016F04
Service:


-- Scheduled Tasks -------------------------------------------------------------

2008-04-15 17:15:44 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-03-20 and 2008-04-20 -----------------------------

2008-04-20 22:05:53 0 d---s---- C:\Documents and Settings\Famille\UserData
2008-04-20 21:02:02 94272 --a------ C:\WINDOWS\system32\ovgpcefq.dll
2008-04-20 21:02:01 88128 -----n--- C:\WINDOWS\system32\lhxufqbm.dll
2008-04-20 21:01:55 96320 --a------ C:\WINDOWS\system32\uodttxxo.dll
2008-04-20 19:04:31 0 dr-h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Recent
2008-04-20 18:28:06 94272 --a------ C:\WINDOWS\system32\oynivdba.dll
2008-04-20 18:22:47 96320 -----n--- C:\WINDOWS\system32\muydtrow.dll
2008-04-20 18:22:05 204799 --ahs---- C:\WINDOWS\system32\rCbLoqru.ini2
2008-04-20 18:22:03 274432 -----n--- C:\WINDOWS\system32\urqoLbCr.dll
2008-04-20 18:13:48 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Malwarebytes
2008-04-20 18:13:42 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-20 18:13:42 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-04-20 17:00:17 0 d-------- C:\Program Files\Trend Micro
2008-04-20 16:47:45 94272 --a------ C:\WINDOWS\system32\teqspgip.dll
2008-04-20 16:40:03 96320 --a------ C:\WINDOWS\system32\kakpmyhs.dll
2008-04-20 16:25:51 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Windows Genuine Advantage
2008-04-20 15:08:38 206019 --ahs---- C:\WINDOWS\system32\mpqqYcfe.ini2
2008-04-20 15:02:19 0 d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Voisinage réseau
2008-04-20 15:02:19 0 d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Voisinage d'impression
2008-04-20 15:02:19 0 dr-h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\SendTo
2008-04-20 15:02:19 0 d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Recent
2008-04-20 15:02:19 524288 --ah----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\NTUSER.DAT
2008-04-20 15:02:19 0 d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Modèles
2008-04-20 15:02:19 0 d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Mes documents
2008-04-20 15:02:19 0 dr------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Menu Démarrer
2008-04-20 15:02:19 0 d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Local Settings
2008-04-20 15:02:19 0 d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Favoris
2008-04-20 15:02:19 0 d---s---- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Cookies
2008-04-20 15:02:19 0 d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Bureau
2008-04-20 15:02:19 0 dr-h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Application Data
2008-04-20 15:02:19 0 d---s---- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Application Data\Microsoft
2008-04-20 13:10:31 206929 --ahs---- C:\WINDOWS\system32\bIiilUvw.ini2
2008-04-19 21:14:19 0 d-------- C:\VundoFix Backups
2008-04-18 21:51:25 207070 --ahs---- C:\WINDOWS\system32\RrsuDJlm.ini2
2008-04-18 21:46:18 38400 -----n--- C:\WINDOWS\system32\mlJDSIaw.dll
2008-04-18 17:48:44 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Ubisoft
2008-04-18 17:46:33 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Ubisoft
2008-04-18 16:58:32 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\InstallShield
2008-04-18 15:27:23 237057 --a------ C:\WINDOWS\system32\Office [Keygen].exe
2008-04-18 14:50:04 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe
2008-04-17 20:54:49 0 d---s---- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\UserData
2008-04-15 19:44:46 0 d-------- C:\Program Files\Alcohol 120
2008-04-15 19:34:15 0 d-------- C:\Documents and Settings\Famille\Application Data\Apple Computer
2008-04-15 19:33:30 0 d-------- C:\Documents and Settings\Famille\Application Data\Identities
2008-04-15 19:32:57 0 d--h----- C:\Documents and Settings\Famille\Voisinage réseau
2008-04-15 19:32:57 0 d--h----- C:\Documents and Settings\Famille\Voisinage d'impression
2008-04-15 19:32:57 0 dr-h----- C:\Documents and Settings\Famille\SendTo
2008-04-15 19:32:57 0 dr-h----- C:\Documents and Settings\Famille\Recent
2008-04-15 19:32:57 0 d--h----- C:\Documents and Settings\Famille\Modèles
2008-04-15 19:32:57 0 dr------- C:\Documents and Settings\Famille\Mes documents
2008-04-15 19:32:57 0 dr------- C:\Documents and Settings\Famille\Menu Démarrer
2008-04-15 19:32:57 0 d--h----- C:\Documents and Settings\Famille\Local Settings
2008-04-15 19:32:57 0 dr------- C:\Documents and Settings\Famille\Favoris
2008-04-15 19:32:57 0 d---s---- C:\Documents and Settings\Famille\Cookies
2008-04-15 19:32:57 0 d-------- C:\Documents and Settings\Famille\Bureau
2008-04-15 19:32:57 0 dr-h----- C:\Documents and Settings\Famille\Application Data
2008-04-15 19:32:57 0 d---s---- C:\Documents and Settings\Famille\Application Data\Microsoft
2008-04-15 19:32:56 786432 --ah----- C:\Documents and Settings\Famille\NTUSER.DAT
2008-04-15 18:54:11 0 d-------- C:\Documents and Settings\Remi.XPSP2-BDBC385B7\Mes documents
2008-04-15 18:53:59 0 d-------- C:\Documents and Settings\Remi.XPSP2-BDBC385B7\Application Data
2008-04-15 18:53:59 0 d-------- C:\Documents and Settings\Remi.XPSP2-BDBC385B7\Application Data\Azureus
2008-04-15 18:08:36 716272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-15 18:00:02 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\WinRAR
2008-04-15 17:55:43 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\OpenOffice.org2
2008-04-15 17:50:09 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage réseau
2008-04-15 17:50:09 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage d'impression
2008-04-15 17:50:09 0 dr-h----- C:\Documents and Settings\Default User.WINDOWS\SendTo
2008-04-15 17:50:09 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\Recent
2008-04-15 17:50:09 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\Modèles
2008-04-15 17:50:09 0 d-------- C:\Documents and Settings\Default User.WINDOWS\Mes documents
2008-04-15 17:50:09 0 dr------- C:\Documents and Settings\Default User.WINDOWS\Menu Démarrer
2008-04-15 17:50:09 0 dr-h----- C:\Documents and Settings\Default User.WINDOWS\Local Settings
2008-04-15 17:50:09 0 d-------- C:\Documents and Settings\Default User.WINDOWS\Favoris
2008-04-15 17:50:09 0 d---s---- C:\Documents and Settings\Default User.WINDOWS\Cookies
2008-04-15 17:50:09 0 d-------- C:\Documents and Settings\Default User.WINDOWS\Bureau
2008-04-15 17:50:09 0 d--h----- C:\Documents and Settings\All Users.WINDOWS\Modèles
2008-04-15 17:50:09 0 dr------- C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer
2008-04-15 17:50:09 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Favoris
2008-04-15 17:50:09 0 dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-04-15 17:50:09 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Bureau
2008-04-15 17:48:49 0 d-------- C:\Program Files\OpenOffice.org 2.4
2008-04-15 17:48:14 0 dr-h----- C:\Documents and Settings\Default User.WINDOWS\Application Data
2008-04-15 17:48:14 0 d---s---- C:\Documents and Settings\Default User.WINDOWS\Application Data\Microsoft
2008-04-15 17:48:14 0 dr-h----- C:\Documents and Settings\All Users.WINDOWS\Application Data
2008-04-15 17:48:14 0 d---s---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
2008-04-15 17:46:49 0 d-------- C:\WINDOWS\RegisteredPackages
2008-04-15 17:18:31 73728 -ra------ C:\WINDOWS\system32\CNMCP47.exe <Not Verified; CANON INC.; Canon BJ Raster Printer Driver Installer>
2008-04-15 17:16:23 0 d-------- C:\Program Files\Bonjour
2008-04-15 17:16:00 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-04-15 17:15:32 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-04-15 17:12:39 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-04-15 17:08:14 0 d-------- C:\Program Files\Ad-Aware 2007
2008-04-15 17:08:14 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-04-15 17:05:02 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-04-15 17:04:32 53248 -----n--- C:\WINDOWS\system32\wdmioctl.dll <Not Verified; Analog Devices Inc.; Analog Devices Inc. wdmioctl>
2008-04-15 17:04:32 1285632 -----n--- C:\WINDOWS\system32\SMMedia.dll <Not Verified; Analog Devices; SoundMAX Integrated Digital Audio>
2008-04-15 17:04:30 49152 --a------ C:\WINDOWS\system32\DSndUp.exe <Not Verified; Analog Devices Inc.; adi DSndUp>
2008-04-15 17:04:30 45056 -----n--- C:\WINDOWS\system32\CleanUp.exe <Not Verified; adi; adi CleanUp>
2008-04-15 17:02:43 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Google
2008-04-15 16:59:22 0 d-------- C:\Program Files\Attansic
2008-04-15 16:56:58 363520 --a------ C:\WINDOWS\system32\PsisDecd.dll
2008-04-15 16:49:46 0 d-------- C:\WINDOWS\ASUSInstAll
2008-04-15 16:49:05 0 d-------- C:\WINDOWS\system32\drivers\fonts
2008-04-15 16:49:04 0 d-------- C:\WINDOWS\system32\drivers\msagent
2008-04-15 16:45:27 5824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-04-15 16:39:29 0 d-------- C:\Program Files\Fichiers communs\ATI Technologies
2008-04-15 16:33:56 520192 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
2008-04-15 16:30:19 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallShield
2008-04-15 16:30:17 17280 -ra------ C:\WINDOWS\system32\PLCNDIS5.SYS <Not Verified; Intellon, Inc.; PCAUSA Rawether for Windows>
2008-04-15 16:30:17 94208 --a------ C:\WINDOWS\system32\PLCLIB.dll <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); Rawether for Windows>
2008-04-15 16:04:40 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Identities
2008-04-15 16:04:31 0 d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Voisinage réseau
2008-04-15 16:04:31 0 d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Voisinage d'impression
2008-04-15 16:04:31 0 dr-h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\SendTo
2008-04-15 16:04:31 2097152 --ah----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\NTUSER.DAT
2008-04-15 16:04:31 0 d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Modèles
2008-04-15 16:04:31 0 dr------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Mes documents
2008-04-15 16:04:31 0 dr------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Menu Démarrer
2008-04-15 16:04:31 0 d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Local Settings
2008-04-15 16:04:31 0 dr------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Favoris
2008-04-15 16:04:31 0 d---s---- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Cookies
2008-04-15 16:04:31 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau
2008-04-15 16:04:31 0 dr-h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data
2008-04-15 16:01:51 0 d-------- C:\Documents and Settings\Admin\Application Data\Identities
2008-04-15 16:01:33 0 d--h----- C:\Documents and Settings\Admin\Voisinage réseau
2008-04-15 16:01:33 0 d--h----- C:\Documents and Settings\Admin\Voisinage d'impression
2008-04-15 16:01:33 0 dr-h----- C:\Documents and Settings\Admin\SendTo
2008-04-15 16:01:33 0 dr-h----- C:\Documents and Settings\Admin\Recent
2008-04-15 16:01:33 524288 --ah----- C:\Documents and Settings\Admin\NTUSER.DAT
2008-04-15 16:01:33 0 d--h----- C:\Documents and Settings\Admin\Modèles
2008-04-15 16:01:33 0 dr------- C:\Documents and Settings\Admin\Mes documents
2008-04-15 16:01:33 0 dr------- C:\Documents and Settings\Admin\Menu Démarrer
2008-04-15 16:01:33 0 d--h----- C:\Documents and Settings\Admin\Local Settings
2008-04-15 16:01:33 0 dr------- C:\Documents and Settings\Admin\Favoris
2008-04-15 16:01:33 0 d---s---- C:\Documents and Settings\Admin\Cookies
2008-04-15 16:01:33 0 d-------- C:\Documents and Settings\Admin\Bureau
2008-04-15 16:01:33 0 dr-h----- C:\Documents and Settings\Admin\Application Data
2008-04-15 16:01:33 0 d---s---- C:\Documents and Settings\Admin\Application Data\Microsoft
2008-04-15 16:01:31 0 d--h----- C:\Documents and Settings\LocalService.AUTORITE NT.000\Local Settings
2008-04-15 16:01:31 0 d---s---- C:\Documents and Settings\LocalService.AUTORITE NT.000\Cookies
2008-04-15 16:01:31 0 d-------- C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data
2008-04-15 16:01:31 0 d---s---- C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\Microsoft
2008-04-15 16:01:30 253952 --ah----- C:\Documents and Settings\LocalService.AUTORITE NT.000\NTUSER.DAT
2008-04-15 16:01:20 0 d--h----- C:\Documents and Settings\NetworkService.AUTORITE NT.000\Local Settings
2008-04-15 16:01:20 0 d---s---- C:\Documents and Settings\NetworkService.AUTORITE NT.000\Cookies
2008-04-15 16:01:20 0 d-------- C:\Documents and Settings\NetworkService.AUTORITE NT.000\Application Data
2008-04-15 16:01:20 0 d---s---- C:\Documents and Settings\NetworkService.AUTORITE NT.000\Application Data\Microsoft
2008-04-15 16:01:19 253952 --ah----- C:\Documents and Settings\NetworkService.AUTORITE NT.000\NTUSER.DAT
2008-04-15 15:58:59 0 d-------- C:\Program Files\msn gaming zone
2008-04-15 15:58:52 253952 ---h----- C:\Documents and Settings\Default User.WINDOWS\NTUSER.DAT
2008-04-15 15:57:42 0 d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM
2008-04-15 15:55:38 21892 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-04-15 15:55:04 97792 --a------ C:\WINDOWS\system32\comrepl.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:57 139528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-15 15:54:53 60416 --a------ C:\WINDOWS\system32\colbact.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:53 110080 --a------ C:\WINDOWS\system32\clbcatex.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:53 625152 --a------ C:\WINDOWS\system32\catsrvut.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:52 540160 --a------ C:\WINDOWS\system32\comuid.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:52 1267200 --a------ C:\WINDOWS\system32\comsvcs.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:52 225792 --a------ C:\WINDOWS\system32\catsrv.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 15:54:51 498688 --a------ C:\WINDOWS\system32\clbcatq.dll <Not Verified; Microsoft Corporation; COM Services>
2008-04-15 14:31:43 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Uniblue
2008-04-15 14:31:38 0 d-------- C:\Program Files\RegistryBooster 2


-- Find3M Report ---------------------------------------------------------------

2008-04-20 16:32:58 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Azureus
2008-04-19 13:20:51 0 d-------- C:\Program Files\eMule
2008-04-18 21:10:40 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Microgaming
2008-04-18 16:58:53 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-18 15:26:36 463153 --a------ C:\WINDOWS\system32\setup.exe <Not Verified; Microsoft Corporation; Microsoft Setup Bootstrapper>
2008-04-18 14:56:27 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Adobe
2008-04-18 14:50:06 0 d-------- C:\Program Files\Fichiers communs\Adobe
2008-04-16 13:31:48 0 d-------- C:\Program Files\Azureus
2008-04-15 19:28:56 464474 --a------ C:\WINDOWS\system32\perfh00C.dat
2008-04-15 19:28:56 73020 --a------ C:\WINDOWS\system32\perfc00C.dat
2008-04-15 17:57:12 0 d-------- C:\Program Files\Java
2008-04-15 17:47:36 0 d-------- C:\Program Files\Winamp
2008-04-15 17:16:14 0 d-------- C:\Program Files\QuickTime
2008-04-15 17:11:41 0 d-------- C:\Program Files\Avast4
2008-04-15 17:10:25 0 d-------- C:\Program Files\Satsuki Decoder Pack
2008-04-15 17:07:55 0 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-15 16:39:29 0 d-------- C:\Program Files\Fichiers communs
2008-04-15 16:34:24 0 d-------- C:\Program Files\ATI Technologies
2008-04-15 16:30:17 0 d-------- C:\Program Files\NETGEAR XE104 Powerline Encryption Utility
2008-04-09 10:18:23 0 d-------- C:\Program Files\BOINC
2008-04-08 19:17:12 0 d-------- C:\Program Files\Veoh
2008-03-09 04:00:51 0 d-------- C:\Program Files\Windows Live
2008-03-07 14:56:25 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-07 14:56:14 0 d-------- C:\Program Files\Windows Live Toolbar
2008-03-07 14:56:01 0 d-------- C:\Program Files\Windows Live Favorites
2008-03-07 14:54:20 0 d--hs--c- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-24 20:08:56 0 d-------- C:\Program Files\iPod
2008-02-20 19:27:21 0 d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Snapfish


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07F8A8CD-EAAF-4246-AF54-76B7C0E980C1}]
C:\WINDOWS\system32\wvUliiIb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1652ED0D-3F01-40E2-8720-6E9E908FE144}]
20/04/2008 18:22 274432 --------- C:\WINDOWS\system32\urqoLbCr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29F3B90B-CE69-4C96-8B4C-72498439105B}]
C:\WINDOWS\system32\efcYqqpm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62B0ACF4-D98A-43D9-BC73-1F7D5366E68A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6b18927e-3f32-4319-b718-fef91d95aaf6}]
20/04/2008 21:02 94272 --a------ C:\WINDOWS\system32\ovgpcefq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C920D7C5-D37A-4FCF-BC31-CF84E21B85F8}]
C:\WINDOWS\system32\jkkHYsQh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [17/02/2005 08:15]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [17/02/2005 08:15]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [10/05/2006 11:12]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [01/05/2006 12:07]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [10/04/2006 09:19]
"avast!"="C:\PROGRA~1\Avast4\ashDisp.exe" [29/03/2008 19:37]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 23:37]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 22:16]
"BM4f327587"="C:\WINDOWS\system32\uodttxxo.dll" [20/04/2008 21:01]
"4c01461b"="C:\WINDOWS\system32\lhxufqbm.dll" [20/04/2008 21:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 12:34]
"AlcoholAutomount"="C:\Program Files\Alcohol 120\axcmd.exe" [22/02/2008 17:58]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Config"=%systemroot%\system32\run.cmd
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [21/01/2008 15:41:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"NoStartBanner"=01000000
"NoSMHelp"=1 (0x1)
"MemCheckBoxInRunDlg"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)
"NoAutoUpdate"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"NoStartBanner"=01000000
"NoSMHelp"=1 (0x1)
"MemCheckBoxInRunDlg"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)
"NoAutoUpdate"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4df751c-0b13-11dd-84e8-0018f364a1a0}]
AutoRun\command- I:\autorun.exe




-- Hosts -----------------------------------------------------------------------

127.255.255.255 serial.alcohol-soft.com
127.0.0.1 mpa.one.microsoft.com


-- End of Deckard's System Scanner: finished at 2008-04-20 23:52:00 ------------


Et voila l'extra :

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professionnel (build 2600) SP 2.0
Architecture: X86; Language: French

CPU 0: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
CPU 1: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Percentage of Memory in Use: 24%
Physical Memory (total/avail): 2047.17 MiB / 1536.68 MiB
Pagefile Memory (total/avail): 2661.28 MiB / 2227.93 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1906.12 MiB

A: is Removable (Unformatted)
C: is Fixed (NTFS) - 47.33 GiB total, 7.91 GiB free.
D: is Fixed (NTFS) - 97.65 GiB total, 4.42 GiB free.
E: is Fixed (NTFS) - 87.9 GiB total, 12.64 GiB free.
F: is CDROM (No Media)
G: is CDROM (No Media)
I: is CDROM (CDFS)

\\.\PHYSICALDRIVE0 - ST3250620AS - 232.88 GiB - 3 partitions
\PARTITION0 (bootable) - Système de fichiers installable - 47.33 GiB - C:
\PARTITION1 - Étendu avec Inter. 13 étendue - 185.55 GiB - D: - E:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.
AntiVirusDisableNotify is set.
FirewallDisableNotify is set.
UpdatesDisableNotify is set.

AV: avast! antivirus 4.8.1169 [VPS 080420-0] v4.8.1169 (ALWIL Software) [COLOR=RED]Disabled[/COLOR]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx9.exe"="E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx10.exe"="E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Launcher.exe"="E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users.WINDOWS
APPDATA=C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data
CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=XPSP2-5BA9226A3
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Remi.XPSP2-5BA9226A3
LOGONSERVER=\\XPSP2-5BA9226A3
NewEnvironment1=C:\Program Files\ATI Technologies\ATI.ACE\
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Satsuki Decoder Pack\filtres
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\REMI~2.XPS\LOCALS~1\Temp
TMP=C:\DOCUME~1\REMI~2.XPS\LOCALS~1\Temp
USERDOMAIN=XPSP2-5BA9226A3
USERNAME=Remi
USERPROFILE=C:\Documents and Settings\Remi.XPSP2-5BA9226A3
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Admin [I](new local, admin)[/I]
Remi.XPSP2-5BA9226A3 [I](admin)[/I]
Famille
Administrateur.XPSP2-5BA9226A3 [I](new local, admin)[/I]


-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Archiveur WinRAR --> C:\Program Files\WinRAR\uninstall.exe
Assassin's Creed --> C:\Program Files\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x040c -removeonly
ATI - Utilitaire de désinstallation du logiciel --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center --> MsiExec.exe /I{E29047D7-2692-4319-B2B0-7611B023BD8E}
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean
ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}\setup.exe"
ATI Parental Control & Encoder --> MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
Attansic Giga Ethernet Utility --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F698102-5739-441E-96F0-74F4EA540F06}\setup.exe" -l0x9
Attansic L1 Gigabit Ethernet Driver --> rundll32.exe C:\WINDOWS\system32\Attansic\L1\atcInst.dll,AtcUninst C:\WINDOWS\system32\Attansic\L1 x86 1969 1048 L1
avast! Antivirus --> C:\Program Files\Avast4\aswRunDll.exe "C:\Program Files\Avast4\Setup\setiface.dll",RunSetup
AVIVO Codecs --> MsiExec.exe /X{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}
Azureus --> C:\Program Files\Azureus\Uninstall.exe
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Canon i320 --> C:\WINDOWS\system32\CNMCP47.exe "-PRINTERNAMECanon i320" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon i320 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon i320 Installer\Inst2\cnmi040c.dll"
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
High Definition Audio Driver Package - KB888111 --> C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mise à jour de sécurité pour Lecteur Windows Media (KB911564) --> "C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) --> "C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782) --> "C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933729) --> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB936021) --> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB937894) --> "C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938127) --> "C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941202) --> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941568) --> "C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941644) --> "C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941693) --> "C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943055) --> "C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943460) --> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943485) --> "C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338) --> "C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944653) --> "C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB945553) --> "C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946026) --> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB947864) --> "C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948590) --> "C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948881) --> "C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461) -->
Mise à jour pour Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB938828) --> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763) --> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NETGEAR XE104 Powerline Encryption Utility --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2CC49405-4C2C-43AF-8C9A-6020D7244277}\setup.exe" -l0x9 -removeonly
OpenOffice.org 2.4 --> MsiExec.exe /I{2A1AA9CF-2E7D-4235-BDAB-8FA4291DD5D8}
QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Satsuki Decoder Pack --> C:\Program Files\Satsuki Decoder Pack\Uninstall.exe
SoundMAX --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x40c -removeonly
Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Live installer --> MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger --> MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}


-- Application Event Log -------------------------------------------------------

Event Record #/Type472 / Success
Event Submitted/Written: 04/20/2008 10:19:06 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type451 / Success
Event Submitted/Written: 04/20/2008 06:54:21 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type436 / Success
Event Submitted/Written: 04/20/2008 04:35:20 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type429 / Warning
Event Submitted/Written: 04/20/2008 04:25:53 PM
Event ID/Source: 1011 / Windows Product Activation
Event Description:
Votre produit Windows n'a pas encore été activé auprès de Microsoft. Pour activer Windows, utilisez l'Assistant Activation du produit.

Event Record #/Type428 / Warning
Event Submitted/Written: 04/20/2008 04:25:51 PM
Event ID/Source: 1011 / Windows Product Activation
Event Description:
Votre produit Windows n'a pas encore été activé auprès de Microsoft. Pour activer Windows, utilisez l'Assistant Activation du produit.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type738 / Error
Event Submitted/Written: 04/20/2008 06:52:24 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM a reçu l'erreur "%%1084" lors de la mise en route du service EventSystem avec les arguments ""
pour démarrer le serveur :
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Record #/Type734 / Error
Event Submitted/Written: 04/20/2008 06:17:38 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger :
Aavmker4
aswSP
Fips
intelppm

Event Record #/Type733 / Error
Event Submitted/Written: 04/20/2008 06:16:48 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM a reçu l'erreur "%%1084" lors de la mise en route du service EventSystem avec les arguments ""
pour démarrer le serveur :
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Record #/Type707 / Warning
Event Submitted/Written: 04/20/2008 04:11:50 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Event Record #/Type668 / Error
Event Submitted/Written: 04/20/2008 03:03:37 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger :
Aavmker4
aswSP
Fips
intelppm



-- End of Deckard's System Scanner: finished at 2008-04-20 23:52:00 ------------

Merci encore !

Ok, voila le rapport de Combofix :

ComboFix 08-04-20.2 - Remi 2008-04-21 0:45:51.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1792 [GMT 2:00]
Endroit: C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\ComboFix.exe

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bIiilUvw.ini
C:\WINDOWS\system32\bIiilUvw.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJDSIaw.dll
C:\WINDOWS\system32\mpqqYcfe.ini
C:\WINDOWS\system32\mpqqYcfe.ini2
C:\WINDOWS\system32\oynivdba.dll
C:\WINDOWS\system32\pmaffcgu.dll
C:\WINDOWS\system32\rCbLoqru.ini
C:\WINDOWS\system32\rCbLoqru.ini2
C:\WINDOWS\system32\RrsuDJlm.ini
C:\WINDOWS\system32\RrsuDJlm.ini2
C:\WINDOWS\system32\teqspgip.dll
C:\WINDOWS\system32\ukwddblh.dll
C:\WINDOWS\system32\uodttxxo.dll
C:\WINDOWS\system32\urqoLbCr.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-20 to 2008-04-20 ))))))))))))))))))))))))))))))))))))
.

2008-04-21 00:45 . 2008-04-21 00:45 1,024 --ah----- C:\Documents and Settings\Default User.WINDOWS\ntuser.dat.LOG
2008-04-20 23:50 . 2008-04-20 23:50 <REP> d-------- C:\Deckard
2008-04-20 22:05 . 2008-04-20 22:05 <REP> d---s---- C:\Documents and Settings\Famille\UserData
2008-04-20 21:02 . 2008-04-20 22:25 1,540,977 ---hs---- C:\WINDOWS\system32\mbqfuxhl.ini
2008-04-20 21:02 . 2008-04-20 21:02 94,272 --------- C:\WINDOWS\system32\ovgpcefq.dll_old
2008-04-20 18:25 . 2008-04-20 21:01 1,540,797 ---hs---- C:\WINDOWS\system32\xhtaqxwm.ini
2008-04-20 18:13 . 2008-04-20 18:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-20 18:13 . 2008-04-20 18:13 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Malwarebytes
2008-04-20 18:13 . 2008-04-20 18:13 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-04-20 17:00 . 2008-04-20 17:00 <REP> d-------- C:\Program Files\Trend Micro
2008-04-20 16:44 . 2008-04-20 17:42 1,540,737 ---hs---- C:\WINDOWS\system32\dhmdkoab.ini
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Voisinage r‚seau
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Voisinage d'impression
2008-04-20 15:02 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\ModŠles
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Mes documents
2008-04-20 15:02 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Menu D‚marrer
2008-04-20 15:02 . 2008-04-15 15:58 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Favoris
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Bureau
2008-04-20 15:02 . 2008-04-20 15:02 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3
2008-04-20 15:02 . 2008-04-21 00:45 1,024 --ah----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\ntuser.dat.LOG
2008-04-20 13:46 . 2008-04-20 16:12 1,541,157 ---hs---- C:\WINDOWS\system32\avbnhett.ini
2008-04-20 13:44 . 2008-04-20 13:44 94,272 --------- C:\WINDOWS\system32\qgaatipk.dll_old
2008-04-20 13:23 . 2008-04-20 13:43 1,540,677 ---hs---- C:\WINDOWS\system32\jggnwtix.ini
2008-04-19 21:14 . 2008-04-20 16:34 <REP> d-------- C:\VundoFix Backups
2008-04-19 11:50 . 2008-04-21 00:35 886 --a------ C:\WINDOWS\wininit.ini
2008-04-19 09:57 . 2008-04-19 20:23 1,540,729 ---hs---- C:\WINDOWS\system32\oltxwsxq.ini
2008-04-19 09:54 . 2008-04-20 16:56 109,743 --a------ C:\WINDOWS\BM4f327587.xml
2008-04-18 20:53 . 2008-04-18 20:53 38 --a------ C:\WINDOWS\AviSplitter.INI
2008-04-18 17:48 . 2008-04-18 17:48 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Ubisoft
2008-04-18 17:46 . 2008-04-18 17:46 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Ubisoft
2008-04-18 16:58 . 2008-04-18 16:58 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\InstallShield
2008-04-18 15:27 . 2008-04-18 15:27 237,057 --a------ C:\WINDOWS\system32\Office [Keygen].exe
2008-04-17 20:54 . 2008-04-17 20:54 <REP> d---s---- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\UserData
2008-04-15 22:01 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-04-15 22:01 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-04-15 22:01 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-04-15 19:44 . 2008-04-15 19:46 <REP> d-------- C:\Program Files\Alcohol 120
2008-04-15 19:36 . 2006-12-07 07:29 2,374,472 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-04-15 19:34 . 2008-04-15 19:34 <REP> d-------- C:\Documents and Settings\Famille\Application Data\Apple Computer
2008-04-15 19:32 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Famille\Voisinage r‚seau
2008-04-15 19:32 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Famille\Voisinage d'impression
2008-04-15 19:32 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Famille\ModŠles
2008-04-15 19:32 . 2008-04-20 21:02 <REP> dr------- C:\Documents and Settings\Famille\Mes documents
2008-04-15 19:32 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Famille\Menu D‚marrer
2008-04-15 19:32 . 2008-04-20 22:05 <REP> dr------- C:\Documents and Settings\Famille\Favoris
2008-04-15 19:32 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Famille\Bureau
2008-04-15 19:32 . 2008-04-20 22:05 <REP> d-------- C:\Documents and Settings\Famille
2008-04-15 19:32 . 2008-04-21 00:49 1,024 --ah----- C:\Documents and Settings\Famille\ntuser.dat.LOG
2008-04-15 18:54 . 2008-04-15 18:54 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-BDBC385B7\Mes documents
2008-04-15 18:25 . 2008-04-15 18:25 59 --a------ C:\WINDOWS\pp.enc
2008-04-15 18:08 . 2008-04-15 19:38 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-15 17:57 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-15 17:55 . 2008-04-21 00:49 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\OpenOffice.org2
2008-04-15 17:54 . 2005-07-26 15:42 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-04-15 17:53 . 2005-07-26 15:44 58,496 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-04-15 17:53 . 2005-07-26 15:44 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-04-15 17:53 . 2008-02-15 11:23 18,432 -----c--- C:\WINDOWS\system32\dllcache\iedw.exe
2008-04-15 17:52 . 2005-07-26 13:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2008-04-15 17:52 . 2005-07-26 15:43 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage r‚seau
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage d'impression
2008-04-15 17:50 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\ModŠles
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Mes documents
2008-04-15 17:50 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Default User.WINDOWS\Menu D‚marrer
2008-04-15 17:50 . 2008-04-15 15:58 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Favoris
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Bureau
2008-04-15 17:50 . 2008-04-15 17:48 <REP> d--h----- C:\Documents and Settings\All Users.WINDOWS\ModŠles
2008-04-15 17:50 . 2008-04-15 16:30 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Menu D‚marrer
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Favoris
2008-04-15 17:50 . 2008-04-18 11:21 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-04-15 17:50 . 2008-04-20 22:25 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Bureau
2008-04-15 17:49 . 2007-07-09 15:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-04-15 17:48 . 2008-04-15 17:48 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
2008-04-15 17:47 . 2008-04-21 00:45 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS
2008-04-15 17:47 . 2008-04-15 15:57 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS
2008-04-15 17:45 . 2008-04-15 16:00 1,254 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-04-15 17:19 . 2005-07-26 13:44 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-04-15 17:18 . 2002-06-17 07:00 87,552 --a------ C:\WINDOWS\system32\CNMLM47.DLL
2008-04-15 17:18 . 2002-06-12 18:48 73,728 -ra------ C:\WINDOWS\system32\CNMCP47.exe
2008-04-15 17:18 . 2002-06-17 07:00 5,632 --a------ C:\WINDOWS\system32\CNMVS47.DLL
2008-04-15 17:16 . 2008-04-15 17:16 <REP> d-------- C:\Program Files\Bonjour
2008-04-15 17:16 . 2008-04-15 17:16 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-04-15 17:16 . 2008-04-21 00:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-15 17:16 . 2008-04-15 17:16 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-15 17:15 . 2008-04-15 17:15 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-04-15 17:15 . 2007-10-31 15:09 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-04-15 17:12 . 2008-04-15 17:12 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-04-15 17:10 . 2008-04-15 17:10 26 --a------ C:\WINDOWS\system32\satsukidecodersettings.ini
2008-04-15 17:08 . 2008-04-15 17:08 <REP> d-------- C:\Program Files\Ad-Aware 2007
2008-04-15 17:08 . 2008-04-15 17:08 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-04-15 17:05 . 2008-04-15 17:05 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-04-15 16:59 . 2008-04-15 16:59 <REP> d-------- C:\Program Files\Attansic
2008-04-15 16:59 . 2006-07-28 06:28 34,944 -ra------ C:\WINDOWS\system32\drivers\atl01_xp.sys
2008-04-15 16:56 . 2005-03-25 23:43 363,520 --a------ C:\WINDOWS\system32\PsisDecd.dll
2008-04-15 16:56 . 2005-07-26 13:44 33,280 --a------ C:\WINDOWS\system32\PsisRndr.ax
2008-04-15 16:55 . 2005-07-26 13:44 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2008-04-15 16:55 . 2005-07-26 13:44 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-04-15 16:55 . 2005-07-26 13:44 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-04-15 16:55 . 2005-07-26 13:44 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-04-15 16:55 . 2005-07-26 13:44 56,832 --a------ C:\WINDOWS\system32\MSDvbNP.ax
2008-04-15 16:55 . 2005-07-26 13:44 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-04-15 16:55 . 2005-07-26 13:44 18,432 --a------ C:\WINDOWS\system32\BdaPlgIn.ax
2008-04-15 16:55 . 2005-07-26 13:44 11,776 --a------ C:\WINDOWS\system32\drivers\BdaSup.sys
2008-04-15 16:55 . 2005-07-26 13:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2008-04-15 16:49 . 2008-04-15 16:49 <REP> d-------- C:\WINDOWS\system32\drivers\msagent
2008-04-15 16:49 . 2008-04-15 16:49 <REP> d-------- C:\WINDOWS\system32\drivers\fonts
2008-04-15 16:49 . 2008-04-15 16:49 <REP> d-------- C:\WINDOWS\ASUSInstAll
2008-04-15 16:47 . 2008-04-15 16:49 20,572 --a------ C:\WINDOWS\Ascd_log.ini
2008-04-15 16:45 . 2008-04-15 16:57 20,276 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-04-15 16:45 . 2004-04-27 09:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-04-15 16:45 . 2004-08-13 04:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-04-15 16:39 . 2008-04-15 16:39 <REP> d-------- C:\Program Files\Fichiers communs\ATI Technologies
2008-04-15 16:34 . 2006-08-02 03:53 168,832 --a------ C:\WINDOWS\system32\drivers\atinavt2.sys
2008-04-15 16:34 . 2006-08-02 03:53 106,496 --a------ C:\WINDOWS\system32\atinppt2.ax
2008-04-15 16:34 . 2005-12-02 23:49 64,352 --a------ C:\WINDOWS\system32\drivers\ativmc01.cod
2008-04-15 16:33 . 2006-07-19 17:08 917,986 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.cpa
2008-04-15 16:33 . 2006-08-22 21:05 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-04-15 16:33 . 2006-08-23 04:11 307,200 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2008-04-15 16:33 . 2006-08-16 19:52 133,583 -ra------ C:\WINDOWS\system32\atiicdxx.dat
2008-04-15 16:33 . 2006-07-17 15:52 58,560 -ra------ C:\WINDOWS\system32\drivers\ativckxx.vp
2008-04-15 16:33 . 2006-08-23 04:14 35,056 -ra------ C:\WINDOWS\system32\drivers\ativvpxx.vp
2008-04-15 16:33 . 2006-06-22 15:02 6,126 -ra------ C:\WINDOWS\system32\atifglpf.xml
2008-04-15 16:33 . 2006-07-19 17:08 929 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.vp
2008-04-15 16:30 . 2008-04-15 16:30 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallShield
2008-04-15 16:30 . 2004-04-26 18:53 94,208 --a------ C:\WINDOWS\system32\PLCLIB.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 14:32 --------- d-----w C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Azureus
2008-04-19 11:20 --------- d-----w C:\Program Files\eMule
2008-04-18 19:10 --------- d-----w C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Microgaming
2008-04-18 14:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-18 12:50 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-16 11:31 --------- d-----w C:\Program Files\Azureus
2008-04-15 15:57 --------- d-----w C:\Program Files\Java
2008-04-15 15:47 --------- d-----w C:\Program Files\Winamp
2008-04-15 15:16 --------- d-----w C:\Program Files\QuickTime
2008-04-15 15:11 --------- d-----w C:\Program Files\Avast4
2008-04-15 15:10 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2008-04-15 15:07 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-15 14:34 --------- d-----w C:\Program Files\ATI Technologies
2008-04-15 14:30 --------- d-----w C:\Program Files\NETGEAR XE104 Powerline Encryption Utility
2008-04-14 19:23 37,074 ----a-w C:\Documents and Settings\Administrateur\tarkfpiu.exe
2008-04-09 08:18 --------- d-----w C:\Program Files\BOINC
2008-04-08 17:17 --------- d-----w C:\Program Files\Veoh
2008-03-09 02:00 --------- d-----w C:\Program Files\Windows Live
2008-03-07 12:56 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-07 12:56 --------- d-----w C:\Program Files\Windows Live Favorites
2008-03-07 12:56 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-07 12:54 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-24 18:08 --------- d-----w C:\Program Files\iPod
2008-02-20 17:27 --------- d-----w C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Snapfish
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"AlcoholAutomount"="C:\Program Files\Alcohol 120\axcmd.exe" [2008-02-22 17:58 217544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 08:15 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-17 08:15 81920]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 12:07 843776]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19 729088]
"avast!"="C:\PROGRA~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"4c01461b"="C:\WINDOWS\system32\lhxufqbm.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Config"="C:\WINDOWS\system32\run.cmd" [2005-08-23 13:24 341]
"nlsf"="cmd.exe" [2004-08-19 18:09 400896 C:\WINDOWS\system32\cmd.exe]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 17:52 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-07-28 06:28]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 PLCMPR5;PLCMPR5 NDIS Protocol Driver;C:\WINDOWS\system32\PLCMPR5.SYS []
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\PLCNDIS5.SYS [2004-04-26 18:11]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-15 15:15:44 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 00:49:42
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Avast4\ashDisp.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.bin
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-21 0:51:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-20 22:51:16

Pre-Run: 8,471,429,120 octets libres
Post-Run: 8,418,742,272 octets libres

281 --- E O F --- 2008-04-16 01:00:51

Merci !

Ba il n'y a pas eu de redemarrage, mais voici les rapports :

Combofix :

ComboFix 08-04-20.2 - Remi 2008-04-21 14:54:22.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1601 [GMT 2:00]
Endroit: C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE ::
C:\WINDOWS\BM4f327587.xml
C:\WINDOWS\system32\avbnhett.ini
C:\WINDOWS\system32\dhmdkoab.ini
C:\WINDOWS\system32\jggnwtix.ini
C:\WINDOWS\system32\lhxufqbm.dll
C:\WINDOWS\system32\mbqfuxhl.ini
C:\WINDOWS\system32\Office [Keygen].exe
C:\WINDOWS\system32\oltxwsxq.ini
C:\WINDOWS\system32\ovgpcefq.dll_old
C:\WINDOWS\system32\qgaatipk.dll_old
C:\WINDOWS\system32\xhtaqxwm.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\BM4f327587.xml
C:\WINDOWS\system32\avbnhett.ini
C:\WINDOWS\system32\dhmdkoab.ini
C:\WINDOWS\system32\jggnwtix.ini
C:\WINDOWS\system32\mbqfuxhl.ini
C:\WINDOWS\system32\Office [Keygen].exe
C:\WINDOWS\system32\oltxwsxq.ini
C:\WINDOWS\system32\ovgpcefq.dll_old
C:\WINDOWS\system32\qgaatipk.dll_old
C:\WINDOWS\system32\xhtaqxwm.ini

.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-21 to 2008-04-21 ))))))))))))))))))))))))))))))))))))
.

2008-04-21 00:45 . 2008-04-21 00:45 1,024 --ah----- C:\Documents and Settings\Default User.WINDOWS\ntuser.dat.LOG
2008-04-20 23:50 . 2008-04-20 23:50 <REP> d-------- C:\Deckard
2008-04-20 22:05 . 2008-04-20 22:05 <REP> d---s---- C:\Documents and Settings\Famille\UserData
2008-04-20 18:13 . 2008-04-20 18:13 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-20 18:13 . 2008-04-20 18:13 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Malwarebytes
2008-04-20 18:13 . 2008-04-20 18:13 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-04-20 17:00 . 2008-04-20 17:00 <REP> d-------- C:\Program Files\Trend Micro
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Voisinage réseau
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Voisinage d'impression
2008-04-20 15:02 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Modèles
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Mes documents
2008-04-20 15:02 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Menu Démarrer
2008-04-20 15:02 . 2008-04-15 15:58 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Favoris
2008-04-20 15:02 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\Bureau
2008-04-20 15:02 . 2008-04-20 15:02 <REP> d-------- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3
2008-04-20 15:02 . 2008-04-21 00:45 1,024 --ah----- C:\Documents and Settings\Administrateur.XPSP2-5BA9226A3\ntuser.dat.LOG
2008-04-19 21:14 . 2008-04-20 16:34 <REP> d-------- C:\VundoFix Backups
2008-04-19 11:50 . 2008-04-21 00:35 886 --a------ C:\WINDOWS\wininit.ini
2008-04-18 20:53 . 2008-04-18 20:53 38 --a------ C:\WINDOWS\AviSplitter.INI
2008-04-18 17:48 . 2008-04-18 17:48 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Ubisoft
2008-04-18 17:46 . 2008-04-18 17:46 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Ubisoft
2008-04-18 16:58 . 2008-04-18 16:58 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\InstallShield
2008-04-17 20:54 . 2008-04-17 20:54 <REP> d---s---- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\UserData
2008-04-15 22:01 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-04-15 22:01 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-04-15 22:01 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-04-15 19:44 . 2008-04-15 19:46 <REP> d-------- C:\Program Files\Alcohol 120
2008-04-15 19:36 . 2006-12-07 07:29 2,374,472 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-04-15 19:34 . 2008-04-15 19:34 <REP> d-------- C:\Documents and Settings\Famille\Application Data\Apple Computer
2008-04-15 19:32 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Famille\Voisinage réseau
2008-04-15 19:32 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Famille\Voisinage d'impression
2008-04-15 19:32 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Famille\Modèles
2008-04-15 19:32 . 2008-04-20 21:02 <REP> dr------- C:\Documents and Settings\Famille\Mes documents
2008-04-15 19:32 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Famille\Menu Démarrer
2008-04-15 19:32 . 2008-04-20 22:05 <REP> dr------- C:\Documents and Settings\Famille\Favoris
2008-04-15 19:32 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Famille\Bureau
2008-04-15 19:32 . 2008-04-20 22:05 <REP> d-------- C:\Documents and Settings\Famille
2008-04-15 19:32 . 2008-04-21 12:16 1,024 --ah----- C:\Documents and Settings\Famille\ntuser.dat.LOG
2008-04-15 18:54 . 2008-04-15 18:54 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-BDBC385B7\Mes documents
2008-04-15 18:25 . 2008-04-15 18:25 59 --a------ C:\WINDOWS\pp.enc
2008-04-15 18:08 . 2008-04-15 19:38 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-15 17:57 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-15 17:55 . 2008-04-21 12:26 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\OpenOffice.org2
2008-04-15 17:54 . 2005-07-26 15:42 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-04-15 17:53 . 2005-07-26 15:44 58,496 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-04-15 17:53 . 2005-07-26 15:44 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-04-15 17:53 . 2008-02-15 11:23 18,432 -----c--- C:\WINDOWS\system32\dllcache\iedw.exe
2008-04-15 17:52 . 2005-07-26 13:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2008-04-15 17:52 . 2005-07-26 15:43 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage réseau
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage d'impression
2008-04-15 17:50 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Modèles
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Mes documents
2008-04-15 17:50 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Default User.WINDOWS\Menu Démarrer
2008-04-15 17:50 . 2008-04-15 15:58 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Favoris
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Bureau
2008-04-15 17:50 . 2008-04-15 17:48 <REP> d--h----- C:\Documents and Settings\All Users.WINDOWS\Modèles
2008-04-15 17:50 . 2008-04-15 16:30 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer
2008-04-15 17:50 . 2008-04-15 17:50 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Favoris
2008-04-15 17:50 . 2008-04-18 11:21 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-04-15 17:50 . 2008-04-20 22:25 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Bureau
2008-04-15 17:49 . 2007-07-09 15:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-04-15 17:48 . 2008-04-15 17:48 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
2008-04-15 17:47 . 2008-04-21 00:45 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS
2008-04-15 17:47 . 2008-04-15 15:57 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS
2008-04-15 17:45 . 2008-04-15 16:00 1,254 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-04-15 17:19 . 2005-07-26 13:44 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-04-15 17:18 . 2002-06-17 07:00 87,552 --a------ C:\WINDOWS\system32\CNMLM47.DLL
2008-04-15 17:18 . 2002-06-12 18:48 73,728 -ra------ C:\WINDOWS\system32\CNMCP47.exe
2008-04-15 17:18 . 2002-06-17 07:00 5,632 --a------ C:\WINDOWS\system32\CNMVS47.DLL
2008-04-15 17:16 . 2008-04-15 17:16 <REP> d-------- C:\Program Files\Bonjour
2008-04-15 17:16 . 2008-04-15 17:16 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-04-15 17:16 . 2008-04-21 12:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-15 17:16 . 2008-04-15 17:16 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-15 17:15 . 2008-04-15 17:15 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-04-15 17:15 . 2007-10-31 15:09 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-04-15 17:12 . 2008-04-15 17:12 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-04-15 17:10 . 2008-04-15 17:10 26 --a------ C:\WINDOWS\system32\satsukidecodersettings.ini
2008-04-15 17:08 . 2008-04-15 17:08 <REP> d-------- C:\Program Files\Ad-Aware 2007
2008-04-15 17:08 . 2008-04-15 17:08 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-04-15 17:05 . 2008-04-15 17:05 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-04-15 16:59 . 2008-04-15 16:59 <REP> d-------- C:\Program Files\Attansic
2008-04-15 16:59 . 2006-07-28 06:28 34,944 -ra------ C:\WINDOWS\system32\drivers\atl01_xp.sys
2008-04-15 16:56 . 2005-03-25 23:43 363,520 --a------ C:\WINDOWS\system32\PsisDecd.dll
2008-04-15 16:56 . 2005-07-26 13:44 33,280 --a------ C:\WINDOWS\system32\PsisRndr.ax
2008-04-15 16:55 . 2005-07-26 13:44 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2008-04-15 16:55 . 2005-07-26 13:44 91,648 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-04-15 16:55 . 2005-07-26 13:44 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-04-15 16:55 . 2005-07-26 13:44 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-04-15 16:55 . 2005-07-26 13:44 56,832 --a------ C:\WINDOWS\system32\MSDvbNP.ax
2008-04-15 16:55 . 2005-07-26 13:44 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-04-15 16:55 . 2005-07-26 13:44 18,432 --a------ C:\WINDOWS\system32\BdaPlgIn.ax
2008-04-15 16:55 . 2005-07-26 13:44 11,776 --a------ C:\WINDOWS\system32\drivers\BdaSup.sys
2008-04-15 16:55 . 2005-07-26 13:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2008-04-15 16:49 . 2008-04-15 16:49 <REP> d-------- C:\WINDOWS\system32\drivers\msagent
2008-04-15 16:49 . 2008-04-15 16:49 <REP> d-------- C:\WINDOWS\system32\drivers\fonts
2008-04-15 16:49 . 2008-04-15 16:49 <REP> d-------- C:\WINDOWS\ASUSInstAll
2008-04-15 16:47 . 2008-04-15 16:49 20,572 --a------ C:\WINDOWS\Ascd_log.ini
2008-04-15 16:45 . 2008-04-15 16:57 20,276 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-04-15 16:45 . 2004-04-27 09:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-04-15 16:45 . 2004-08-13 04:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-04-15 16:39 . 2008-04-15 16:39 <REP> d-------- C:\Program Files\Fichiers communs\ATI Technologies
2008-04-15 16:34 . 2006-08-02 03:53 168,832 --a------ C:\WINDOWS\system32\drivers\atinavt2.sys
2008-04-15 16:34 . 2006-08-02 03:53 106,496 --a------ C:\WINDOWS\system32\atinppt2.ax
2008-04-15 16:34 . 2005-12-02 23:49 64,352 --a------ C:\WINDOWS\system32\drivers\ativmc01.cod
2008-04-15 16:33 . 2006-07-19 17:08 917,986 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.cpa
2008-04-15 16:33 . 2006-08-22 21:05 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-04-15 16:33 . 2006-08-23 04:11 307,200 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2008-04-15 16:33 . 2006-08-16 19:52 133,583 -ra------ C:\WINDOWS\system32\atiicdxx.dat
2008-04-15 16:33 . 2006-07-17 15:52 58,560 -ra------ C:\WINDOWS\system32\drivers\ativckxx.vp
2008-04-15 16:33 . 2006-08-23 04:14 35,056 -ra------ C:\WINDOWS\system32\drivers\ativvpxx.vp
2008-04-15 16:33 . 2006-06-22 15:02 6,126 -ra------ C:\WINDOWS\system32\atifglpf.xml
2008-04-15 16:33 . 2006-07-19 17:08 929 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.vp
2008-04-15 16:30 . 2008-04-15 16:30 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallShield
2008-04-15 16:30 . 2004-04-26 18:53 94,208 --a------ C:\WINDOWS\system32\PLCLIB.dll
2008-04-15 16:30 . 2005-02-17 07:15 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-04-15 16:30 . 2004-04-26 18:11 17,280 -ra------ C:\WINDOWS\system32\PLCNDIS5.SYS
2008-04-15 16:04 . 2008-04-15 16:20 <REP> d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Voisinage réseau
2008-04-15 16:04 . 2008-04-15 17:50 <REP> d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Voisinage d'impression
2008-04-15 16:04 . 2008-04-15 15:55 <REP> d--h----- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Modèles
2008-04-15 16:04 . 2008-04-19 19:38 <REP> dr------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Mes documents
2008-04-15 16:04 . 2008-04-15 17:50 <REP> dr------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Menu Démarrer
2008-04-15 16:04 . 2008-04-15 16:18 <REP> dr------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Favoris
2008-04-15 16:04 . 2008-04-21 14:54 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau
2008-04-15 16:04 . 2008-04-21 00:04 <REP> d-------- C:\Documents and Settings\Remi.XPSP2-5BA9226A3

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 14:32 --------- d-----w C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Azureus
2008-04-19 11:20 --------- d-----w C:\Program Files\eMule
2008-04-18 19:10 --------- d-----w C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Application Data\Microgaming
2008-04-18 14:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-18 13:26 463,153 ----a-w C:\WINDOWS\system32\setup.exe
2008-04-18 12:50 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-16 11:31 --------- d-----w C:\Program Files\Azureus
2008-04-15 15:57 --------- d-----w C:\Program Files\Java
2008-04-15 15:47 --------- d-----w C:\Program Files\Winamp
2008-04-15 15:16 --------- d-----w C:\Program Files\QuickTime
2008-04-15 15:11 --------- d-----w C:\Program Files\Avast4
2008-04-15 15:10 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2008-04-15 15:07 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-15 14:34 --------- d-----w C:\Program Files\ATI Technologies
2008-04-15 14:30 --------- d-----w C:\Program Files\NETGEAR XE104 Powerline Encryption Utility
2008-04-14 19:23 37,074 ----a-w C:\Documents and Settings\Administrateur\tarkfpiu.exe
2008-04-09 08:18 --------- d-----w C:\Program Files\BOINC
2008-04-08 17:17 --------- d-----w C:\Program Files\Veoh
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-09 02:00 --------- d-----w C:\Program Files\Windows Live
2008-03-07 12:56 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-07 12:56 --------- d-----w C:\Program Files\Windows Live Favorites
2008-03-07 12:56 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-07 12:54 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-24 18:08 --------- d-----w C:\Program Files\iPod
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:02 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-29 10:02 107,368 ----a-w C:\WINDOWS\system32\GEARAspi.dll
2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((( snapshot@2008-04-21_ 0.51.08.89 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-20 22:49:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-21 10:16:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-21 10:16:40 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5d4.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"AlcoholAutomount"="C:\Program Files\Alcohol 120\axcmd.exe" [2008-02-22 17:58 217544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 08:15 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-17 08:15 81920]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 12:07 843776]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19 729088]
"avast!"="C:\PROGRA~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Config"="C:\WINDOWS\system32\run.cmd" [2005-08-23 13:24 341]
"nlsf"="cmd.exe" [2004-08-19 18:09 400896 C:\WINDOWS\system32\cmd.exe]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 17:52 44544]

C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 15:41:28 393216]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"E:\\Program Files\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-07-28 06:28]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 PLCMPR5;PLCMPR5 NDIS Protocol Driver;C:\WINDOWS\system32\PLCMPR5.SYS []
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\PLCNDIS5.SYS [2004-04-26 18:11]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4df751c-0b13-11dd-84e8-0018f364a1a0}]
\Shell\AutoRun\command - I:\autorun.exe

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-15 15:15:44 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 14:55:20
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...


C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Local Settings\Application Data\Microsoft\Messenger\rems113@hotmail.com\SharingMetadata\Working\database_EC4C_180_4C01_46B4\$db_clean$ 0 bytes

Scan terminé avec succès
Les fichiers cachés: 1

**************************************************************************
.
Temps d'accomplissement: 2008-04-21 14:55:49
ComboFix-quarantined-files.txt 2008-04-21 12:55:44
ComboFix2.txt 2008-04-20 22:51:20

Pre-Run: 8,999,276,544 octets libres
Post-Run: 8,979,828,736 octets libres

284 --- E O F --- 2008-04-16 01:00:51


Et Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:59:08, on 21/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\Avast4\ashDisp.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5CD54B7-4FA1-46C1-9E85-35A2D106DC07}: NameServer = 212.27.54.252
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6147 bytes

Merci !

J'avais installé Avast en pensant qu'il était efficace...
Apparemment, je m'étais trompé !

Voila le rapport d'Antivir :

Avira AntiVir Personal
Report file date: mardi 22 avril 2008 17:45

Scanning for 1229227 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode with network
Username: Remi
Computer name: XPSP2-5BA9226A3

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58
ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 15:37:35
ANTIVIR3.VDF : 7.0.3.198 2048 Bytes 22/04/2008 15:37:36
Engineversion : 8.1.0.32
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.26 233850 Bytes 22/04/2008 15:37:48
AESCN.DLL : 8.1.0.14 119156 Bytes 22/04/2008 15:37:47
AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:44
AEPACK.DLL : 8.1.1.2 364917 Bytes 22/04/2008 15:37:46
AEOFFICE.DLL : 8.1.0.18 192890 Bytes 22/04/2008 15:37:44
AEHEUR.DLL : 8.1.0.18 1167735 Bytes 22/04/2008 15:37:43
AEHELP.DLL : 8.1.0.14 115063 Bytes 22/04/2008 15:37:39
AEGEN.DLL : 8.1.0.17 299380 Bytes 22/04/2008 15:37:38
AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43
AECORE.DLL : 8.1.0.27 168310 Bytes 22/04/2008 15:37:37
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 22 avril 2008 17:45

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
14 processes with 14 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '26' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\559177ef2b2f5dcd0dbd7152f944\legitcheckcontrol.dll
[WARNING] The file could not be opened!
C:\559177ef2b2f5dcd0dbd7152f944\spmsg.dll
[WARNING] The file could not be opened!
C:\559177ef2b2f5dcd0dbd7152f944\spuninst.exe
[WARNING] The file could not be opened!
C:\559177ef2b2f5dcd0dbd7152f944\wgalogon.dll
[WARNING] The file could not be opened!
C:\559177ef2b2f5dcd0dbd7152f944\wgatray.exe
[WARNING] The file could not be opened!
C:\Deckard\System Scanner\backup\DOCUME~1\REMI~2.XPS\LOCALS~1\Temp\plkdonmq.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was deleted!
C:\Deckard\System Scanner\backup\DOCUME~1\REMI~2.XPS\LOCALS~1\Temp\vkuicbby.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '488308a5.qua'!
C:\Documents and Settings\Administrateur\tarkfpiu.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '488008a2.qua'!
C:\QooBox\Quarantine\catchme2008-04-21_ 04735,68.zip
[0] Archive type: ZIP
--> urqoLbCr.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48820be0.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\ovgpcefq.dll_old.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48750bf6.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\oynivdba.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '487c0bf9.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\qgaatipk.dll_old.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '486f0be7.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\teqspgip.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '487f0be6.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\ukwddblh.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48850bec.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\urqoLbCr.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '487f0bf3.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'
Begin scan in 'E:\'


End of the scan: mardi 22 avril 2008 18:13
Used time: 28:21 min

The scan has been done completely.

12552 Scanning directories
522025 Files were scanned
10 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
1 files were deleted
0 files were repaired
9 files were moved to quarantine
0 files were renamed
7 Files cannot be scanned
522015 Files not concerned
2322 Archives were scanned
7 Warnings
10 Notes

Merci !

Voila le rapport de Bitdefender :



BitDefender Online Scanner







Rapport d'analyse généré à: Tue, Apr 22, 2008 - 20:37:27









Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;I:\;















Statistiques

Temps


00:20:35

Fichiers


153719

Directoires


12603

Secteurs de boot


4

Archives


996

Paquets programmes


12711







Résultats

Virus identifiés


2

Fichiers infectés


3

Fichiers suspects


0

Avertissements


0

Désinfectés


0

Fichiers effacés


3







Info sur les moteurs

Définition virus


1174205

Version des moteurs


AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins


16

Archive des plugins


42

Unpack des plugins


7

E-mail plugins


6

Système plugins


5







Paramètres d'analyse

Première action


Désinfecté

Seconde Action


Supprimé

Heuristique


Oui

Acceptez les avertissements


Oui

Extensions analysées


exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions




Analyse d'emails


Oui

Analyse des Archives


Oui

Analyser paquets programmes


Oui

Analyse des fichiers


Oui

Analyse de boot


Oui








Fichier analysé


Statut

C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\ComboFix.exe=>(RAR Sfx o)=>327882R2FWJFW\NirCmdC.cfexe


Détecté avec: Spyware.Tool.Nircmd.B

C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\ComboFix.exe=>(RAR Sfx o)=>327882R2FWJFW\NirCmdC.cfexe


Supprimé

C:\Documents and Settings\Remi.XPSP2-5BA9226A3\Bureau\ComboFix.exe=>(RAR Sfx o)


Echec de la mise à jour

E:\Program Files\Gothic III\Gothic3.exe


Infecté par: Trojan.GothicObfus.A

E:\Program Files\Gothic III\Gothic3.exe


Supprimé

E:\System Volume Information\_restore{5237F6F0-8904-4B36-A932-F9DBB9E58AD5}\RP3\A0000829.exe


Infecté par: Trojan.GothicObfus.A

E:\System Volume Information\_restore{5237F6F0-8904-4B36-A932-F9DBB9E58AD5}\RP3\A0000829.exe


Supprimé





















Merci !

Re,

Poste un nouveau rapport hijackthis et dis-moi comment va le PC.

Toujours des problèmes ?

C’est OK, tu ne seras plus infecté(e) quand tu auras fait TOUTES les manip’ ci-dessous

1) Télécharge ToolsCleaner sur ton bureau.
http://www.commentcamarche.net/tel [...] nions.php3

Ce programme va te faire désinstaller tous les outils que je t’ai faits utiliser.

• Clique sur Recherche et laisse le scan agir ...
• Clique sur Suppression pour finaliser.
• Tu peux, si tu le souhaites, te servir des Options facultatives.
• Clique sur Quitter pour obtenir le rapport.
• Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

2) Télécharge et installe Ccleaner :
http://www.01net.com/telecharger/w [...] 32599.html

• Avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires". Ensuite, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Clique sur l'onglet "Nettoyeur" puis sur "Lancer le Nettoyage".
• Ensuite clique sur l'onglet Registre, clique sur "Chercher des erreurs" puis sur "Réparer les erreurs sélectionnées". Il est inutile de faire des sauvegardes des clés. Répète l'opération autant de fois qu'il le faut jusqu'à qu'il ne trouve plus d'erreurs.
• Tutorial ici : http://www.infos-du-net.com/forum/ [...] nstruction

3)

• Désactive ta restauration systeme

• Réactive ta restauration systeme

• Tutorial ici : http://www.infos-du-net.com/forum/ [...] on-systeme

********************************************************************************

Ajoute maintenant [Résolu] au titre. Pour cela :
* Clique, dans ton premier message, sur le bouton "Editer"
* Rajoute la mention [Résolu] au titre
* Clique ensuite sur "Valider votre message"

Ce serait sympa de rapporter ton infection sur > Malware-Complaints < pour faire condamner ses auteurs

- Règles du forum <- ici
- Poster un message <- ici ( par Malekal )

Pour t'enregistrer clique sur le bouton register ( en haut )
Si tu as plus de 13 ans choisis " I Agree to these terms and am over or exactly 13 years of age "
Si tu as moins de 13 ans choisis " I Agree to these terms and am under 13 years of age "

Tu auras une liste par type d'infection
Si ton infection n'est pas dans la liste crée un message dans Autres infections

a+ et bon surf


Quelques liens intéressants :

http://mickael.barroux.free.fr/securite/
http://www.malekal.com/
http://www.infos-du-net.com/forum/ [...] protection

Re,

De rien ce fut un plaisir !

Rapporte ton infection sur malware complain si ce n'est pas fait, c'est important

Merci de consulter ce dossier (en pdf) pour en connaître davantage sur les risques du Net.



Si tu trouves ce document intéressant, n'hésite pas à le transmettre à tes contacts.

Bonne continuation