Bonjour à tous, pour commencer merci à vous tous pour l'aider que vous apportez au débutant sans défense

J'ai remarqué que ce problème affectait beaucoup d'internaute. Et aucun des topic déja aborder à ce sujet n'ont pu m'aider, voici ce qu'il y avait :

Au départ un fond d'écran bleu avec "spyware infection bla bla..." et une fenêtre de XP antivirus 2008 qui s'ouvrait tout le temps.
Je suis débutant mais pas débile pour autant alors j'ai utiliser Ccleaner, Adware, kaspersky, j'ai ensuite effectué une réparation du windows.
Tout tourne normalement à l'exception de ce fond d'écran rouge "your privacy is in danger" qui est un lien faire un site internet. Par ailleur, impossible de faire les modification sur le bureau. Clique droit/proprieté il n'y a plus que l'onglet général avec l'URL introuvable du wallpaper.


J'ai remarqué qu'il fallait un rapport, j'en ai sorti un avec Hijackthis et le voici donc :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:02:20, on 06.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Wroblevski\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: bgrqfetx - {04B2B073-361D-420E-B5A5-78C4B926E39A} - C:\WINDOWS\bgrqfetx.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 7784175557
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 7844459734
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] _0_3_0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O21 - SSODL: tfnslopk - {0EAED4DD-FCD3-4BAC-9CA8-211625371A34} - C:\WINDOWS\tfnslopk.dll
O21 - SSODL: xokvrpwg - {1F894B93-1EB9-4A46-BB65-5C49DE717783} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 5943 bytes

merci à vous

et voici le rapport avec SmitFraudFix

SmitFraudFix v2.333

Rapport fait à 14:13:52.96, 06.08.2008
Executé à partir de C:\Documents and Settings\Wroblevski\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Wroblevski


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Wroblevski\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\WROBLE~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

[!] Suspicious: bgrqfetx.dll
Toolbar: bgrqfetx - {04B2B073-361D-420E-B5A5-78C4B926E39A}
TypeLib: {EA91BBFE-28A8-4EC4-9D26-2EDC083D8A2F}
Interface: {E6783AEA-8858-4163-A13F-80B6C2A8F3C0}
Classe: bgrqfetx.bdqa
Classe: bgrqfetx.ToolBar.1

[!] Suspicious: tfnslopk.dll
SSODL: tfnslopk - {0EAED4DD-FCD3-4BAC-9CA8-211625371A34}


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\KASPER~1\\KASPER~1\\mzvkbd.dll,C:\\PROGRA~1\\KASPER~1\\KASPER~1\\adialhk.dll,C:\\PROGRA~1\\KASPER~1\\KASPER~1\\kloehk.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom 440x 10/100 Integrated Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 80.83.47.198
DNS Server Search Order: 80.83.47.11
DNS Server Search Order: 80.83.47.157
DNS Server Search Order: 80.83.47.10

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS2\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


ps : un autre symptôme est apparu, une fenêtre internet s'ouvre avec à nouveau ce Xp antivirus 2008

Bonjour,

Redémarre en mode sans échec

Lance SmitfraudFix.exe et choisis cette fois l'Option 2 et réponds oui à la ou les questions.
Sauvegarde le rapport sur ton Bureau.

Redémarre normalement.

Poste le rapport généré par SmitfraudFix ainsi qu’un nouveau hijackthis.

***

Télécharge Deckard's System Scanner (DSS) (ou DSS) sur ton Bureau.
NB : Tu dois être connecté avec des droits d'Administrateur.

• ferme toutes les applications et fenêtres
• double-clique sur dss.exe pour le lancer et suis les instructions ci-dessous

Attention, il est conseillé de stopper temporairement les logiciels résidents de protection (pare-feu, antivirus, etc.)

• s'il s'agit d'une première utilisation ou d'une nouvelle version de DSS :
• tu devras cliquer 2 fois sur le OK des boîtes de dialogue

Attention, si tu tardes trop, la réponse Abandon sera automatiquement validée

• quand le traitement est terminé (clique sur OK), deux fichiers texte s'affichent :

main.txt <- ouvert en premier plan et en plein écran
extra.txt <- ouvert en second plan et en fenêtré (regarde la barre des taches)
S'il s'agit d'une utilisation supplémentaire de DSS :

• tu n'auras pas de boîte de dialogue (pas de OK)
• quand le traitement est terminé, un fichier texte s'affiche :

main.txt <- ouvert en premier plan et en plein écran

• copie (Ctrl+A puis Ctrl+C) et colle (Ctrl+V) le contenu de main.txt dans ton prochain post
• copie de même le contenu de extra.txt dans ton prochain post, si tu as ce fichier (première utilisation)
• n'oublie pas de réactiver les protections si elles ont été stoppées.

Ce que fait DSS :

• crée un point de restauration dans Windows XP et Vista
• nettoie les fichiers temporaires, DPF-Downloaded Program Files et le Cache Internet, vide la Corbeille de tous les lecteurs
• vérifie quelques zones importantes de ton système et établit un rapport pour examen par ton conseiller en sécurité. DSS lance automatiquement HijackThis pour toi; il va aussi créer un raccourci HijackThis sur ton Bureau si tu n'as pas déjà HijackThis d'installé.

voici le rapport smitfraudfix.exe en mode sans echec :

SmitFraudFix v2.333

Rapport fait à 14:54:48.03, 06.08.2008
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom 440x 10/100 Integrated Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 80.83.47.198
DNS Server Search Order: 80.83.47.11
DNS Server Search Order: 80.83.47.157
DNS Server Search Order: 80.83.47.10

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS2\Services\Tcpip\..\{AF08F250-6E3D-41AC-BB2D-AB14A8214F01}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Et celui de hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:59:44, on 06.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Wroblevski\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 7784175557
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 7844459734
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] _0_3_0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O21 - SSODL: xokvrpwg - {1F894B93-1EB9-4A46-BB65-5C49DE717783} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 5745 bytes

je commence a délécharger Deckard's system scanner

merci encore

Voici le main.txt

Deckard's System Scanner v20071014.68
Run by Wroblevski on 2008-08-06 15:03:36
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2008-08-06 13:03:39 UTC - RP2 - Deckard's System Scanner Restore Point
1: 2008-08-06 11:36:36 UTC - RP1 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Wroblevski.exe) ------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:41, on 06.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Wroblevski\Bureau\dss.exe
C:\DOCUME~1\WROBLE~1\Bureau\Wroblevski.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 7784175557
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 7844459734
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] _0_3_0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O21 - SSODL: xokvrpwg - {1F894B93-1EB9-4A46-BB65-5C49DE717783} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 5657 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 cmuda3 (C-Media PCI Audio Interface) - c:\windows\system32\drivers\cmudax3.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 iPod Service (Service de l'iPod) - "c:\program files\ipod\bin\ipodservice.exe" (file missing)
S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" <Not Verified; Microsoft Corporation; Windows Live installer>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Contrôleur audio multimédia
Device ID: PCI\VEN_8086&DEV_266E&SUBSYS_01991028&REV_03\3&172E68DD&0&F2
Manufacturer:
Name: Contrôleur audio multimédia
PNP Device ID: PCI\VEN_8086&DEV_266E&SUBSYS_01991028&REV_03\3&172E68DD&0&F2
Service:


-- Scheduled Tasks -------------------------------------------------------------

2008-08-04 22:00:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-07-06 and 2008-08-06 -----------------------------

2008-08-06 15:00:57 0 d--h----- C:\WINDOWS\$hf_mig$
2008-08-06 14:58:22 0 d-------- C:\WINDOWS\LastGood
2008-08-06 14:13:57 2166 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-06 14:13:24 81920 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; 404Fix>
2008-08-06 14:13:23 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-06 14:13:23 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-08-06 14:13:23 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-08-06 14:13:23 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-08-06 14:13:23 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-08-06 14:13:23 82944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-06 14:13:23 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-06 14:00:27 0 d-------- C:\Documents and Settings\Wroblevski\SmitfraudFix <SMITFR~1>
2008-08-06 13:38:31 0 d-------- C:\WINDOWS\pss
2008-08-06 13:34:01 0 d-------- C:\WINDOWS\Prefetch
2008-08-06 12:24:01 96559 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-08-06 12:24:01 87855 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-08-06 12:23:30 213024 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-06 12:23:30 1017888 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-06 12:23:30 0 d-------- C:\Program Files\Kaspersky Lab
2008-08-06 12:23:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-06 12:22:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-06 11:57:27 0 dr-h----- C:\Documents and Settings\Wroblevski\Recent
2008-08-06 10:33:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-06 10:19:41 0 d-------- C:\Program Files\RogueRemover FREE
2008-08-06 10:18:11 0 d-------- C:\Program Files\microsoft frontpage
2008-08-06 10:15:19 0 d-------- C:\Documents and Settings\Administrateur\Application Data\rhc9shj0e99l
2008-08-06 10:13:58 0 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-08-06 10:13:58 0 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-08-06 10:13:58 0 dr-h----- C:\Documents and Settings\Administrateur\SendTo
2008-08-06 10:13:58 0 d--h----- C:\Documents and Settings\Administrateur\Recent
2008-08-06 10:13:58 524288 --ah----- C:\Documents and Settings\Administrateur\NTUSER.DAT
2008-08-06 10:13:58 0 d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-08-06 10:13:58 0 d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-08-06 10:13:58 0 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-08-06 10:13:58 0 d--h----- C:\Documents and Settings\Administrateur\Local Settings
2008-08-06 10:13:58 0 d-------- C:\Documents and Settings\Administrateur\Favoris
2008-08-06 10:13:58 0 d---s---- C:\Documents and Settings\Administrateur\Cookies
2008-08-06 10:13:58 0 d-------- C:\Documents and Settings\Administrateur\Bureau
2008-08-06 10:13:58 0 dr-h----- C:\Documents and Settings\Administrateur\Application Data
2008-08-06 10:13:58 0 d---s---- C:\Documents and Settings\Administrateur\Application Data\Microsoft
2008-08-06 10:10:22 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-06 10:10:19 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\Mozilla
2008-08-06 09:50:29 0 d-------- C:\Program Files\CCleaner
2008-08-06 01:21:54 94208 --a------ C:\WINDOWS\system32\pphccshj0e99l.exe
2008-08-06 01:21:54 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\rhc9shj0e99l
2008-08-06 01:21:28 60928 --a------ C:\WINDOWS\system32\blphccshj0e99l.scr <Not Verified; Sysinternals; Sysinternals Blue Screen>
2008-08-06 01:18:58 86016 --a------ C:\WINDOWS\lnvegaow.exe
2008-08-06 01:18:58 139264 --a------ C:\WINDOWS\evoq.exe
2008-08-05 22:35:12 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\CyberLink
2008-08-05 22:34:42 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-05 22:34:33 0 d-------- C:\Program Files\Fichiers communs\CyberLink
2008-08-05 22:33:55 0 d-------- C:\Program Files\CyberLink
2008-08-05 22:33:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Temp
2008-08-05 22:05:06 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\dvdcss
2008-08-04 17:29:03 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\Apple Computer
2008-08-04 17:28:46 0 d-------- C:\Program Files\iTunes
2008-08-04 17:28:10 0 d-------- C:\Program Files\QuickTime
2008-08-04 17:28:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-04 17:27:58 0 d-------- C:\Program Files\Apple Software Update
2008-08-04 17:27:52 0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-08-04 17:27:38 0 d-------- C:\Program Files\Fichiers communs\Apple
2008-08-04 17:27:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-08-04 13:39:58 139264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-08-04 13:39:58 524288 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-08-04 13:39:58 413760 --a------ C:\WINDOWS\system32\mpg4c32.dll <Not Verified; Microsoft Corporation; Microsoft MPEG-4 Video Codec>
2008-08-04 13:39:58 261632 --a------ C:\WINDOWS\system32\mcdvd_32.dll <Not Verified; MainConcept; MainConcept DV Codec "2.0.4>
2008-08-04 13:39:58 638976 --a------ C:\WINDOWS\system32\divx.dll <Not Verified; DivXNetworks, Inc.; DivX Video for Windows Codec>
2008-08-04 13:39:58 0 d-------- C:\Program Files\AVSMedia
2008-08-04 13:36:44 0 d-------- C:\Downloads
2008-08-04 13:31:29 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\AVS4YOU
2008-08-04 13:31:26 0 d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-08-04 13:30:44 0 d-------- C:\Program Files\Fichiers communs\AVSMedia
2008-08-04 13:30:24 0 d-------- C:\Program Files\AVS4YOU
2008-08-04 13:29:07 0 d-------- C:\Program Files\FlashGet
2008-08-04 13:21:30 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\vlc
2008-08-04 13:21:14 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\Media Player Classic
2008-08-04 13:18:16 0 d-------- C:\Program Files\VideoLAN
2008-08-04 12:02:40 0 d--hs--c- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-08-04 12:02:31 0 d-------- C:\Program Files\Windows Live
2008-08-04 12:02:22 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-03 23:31:28 32768 --a------ C:\WINDOWS\system32\CMUdaProp3.dll <Not Verified; C-Media Corporation; CMI8738/CMI9738/CMI9739 Audio Device>
2008-08-03 23:31:28 262144 --a------ C:\WINDOWS\system32\CMRMDRV3.exe <Not Verified; C-Media Corporation; CmiRemoveDriver Application>
2008-08-03 23:31:28 28672 --a------ C:\WINDOWS\system32\CMRMDRV3.dll
2008-08-03 23:31:28 917504 --a------ C:\WINDOWS\system\CMDS3D3.dll <Not Verified; C-Media Electronics Inc.; C-Media Cmids3d>
2008-08-03 23:31:28 712704 --a------ C:\WINDOWS\system\AUDIO3D3.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-08-03 23:31:28 712704 --a------ C:\WINDOWS\system\a3d.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-08-03 23:30:36 274432 --a------ C:\WINDOWS\CmiPCIUninstall.exe <Not Verified; C-Media Corporation; CmiUSBUninstall Application>
2008-08-03 23:30:26 1405632 --a------ C:\WINDOWS\system32\drivers\cmudax3.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
2008-08-03 23:30:25 36864 --a------ C:\WINDOWS\system32\cmudax3.DLL <Not Verified; C-Media Electronics Ins.; C-Media PCI Audio>
2008-08-03 23:30:25 0 d-------- C:\Program Files\C-Media PCI Audio
2008-08-03 23:28:45 0 d-------- C:\Program Files\QuickZip4
2008-08-03 23:11:48 0 d-------- C:\Program Files\ma-config.com
2008-08-03 23:11:48 0 d-------- C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-08-03 22:52:22 0 d-------- C:\Documents and Settings\All Users\Application Data\media center programs
2008-08-03 20:55:42 0 d--hs---- C:\WINDOWS\Installer
2008-08-03 20:55:41 0 d-------- C:\Program Files\Fichiers communs\ODBC
2008-08-03 20:55:38 0 dr------- C:\Program Files
2008-08-03 20:55:38 0 d-------- C:\Program Files\Fichiers communs
2008-08-03 20:55:38 0 d-------- C:\Program Files\Fichiers communs\SpeechEngines
2008-08-03 20:55:14 0 d--h----- C:\Documents and Settings\Default User\Voisinage réseau
2008-08-03 20:55:14 0 d--h----- C:\Documents and Settings\Default User\Voisinage d'impression
2008-08-03 20:55:14 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-08-03 20:55:14 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-08-03 20:55:14 0 d--h----- C:\Documents and Settings\Default User\Modèles
2008-08-03 20:55:14 0 d-------- C:\Documents and Settings\Default User\Mes documents
2008-08-03 20:55:14 0 dr------- C:\Documents and Settings\Default User\Menu Démarrer
2008-08-03 20:55:14 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-08-03 20:55:14 0 d-------- C:\Documents and Settings\Default User\Favoris
2008-08-03 20:55:14 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-08-03 20:55:14 0 d-------- C:\Documents and Settings\Default User\Bureau
2008-08-03 20:55:14 0 d--h----- C:\Documents and Settings\All Users\Modèles
2008-08-03 20:55:14 0 dr------- C:\Documents and Settings\All Users\Menu Démarrer
2008-08-03 20:55:14 0 d-------- C:\Documents and Settings\All Users\Favoris
2008-08-03 20:55:14 0 dr------- C:\Documents and Settings\All Users\Documents
2008-08-03 20:55:14 0 d-------- C:\Documents and Settings\All Users\Bureau
2008-08-03 20:55:01 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-08-03 20:55:01 0 d-------- C:\WINDOWS\system32\CatRoot
2008-08-03 20:54:55 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-08-03 20:54:55 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-08-03 20:54:55 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2008-08-03 20:54:55 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-08-03 20:54:32 0 d-------- C:\Documents and Settings
2008-08-03 20:54:31 0 d--hs---- C:\System Volume Information
2008-08-03 20:48:33 0 d-------- C:\WINDOWS
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\WinSxS
2008-08-03 20:48:33 0 dr------- C:\WINDOWS\Web
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\twain_32
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\wins
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\wbem
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\usmt
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\spool
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\ShellExt
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\Setup
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\ras
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\oobe
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\npp
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\mui
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\inetsrv
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\IME
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\icsxml
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\ias
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\export
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\drivers
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-08-03 20:48:33 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\dhcp
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\config
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\3076
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\2052
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1054
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1042
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1041
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1037
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1036
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1033
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1031
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1028
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system32\1025
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\system
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\security
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Resources
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\repair
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Provisioning
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\PeerNet
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\pchealth
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\mui
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\msapps
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\msagent
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Media
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\java
2008-08-03 20:48:33 0 d--h----- C:\WINDOWS\inf
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\ime
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Help
2008-08-03 20:48:33 0 dr--s---- C:\WINDOWS\Fonts
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Driver Cache
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Debug
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Cursors
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Connection Wizard
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\Config
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\AppPatch
2008-08-03 20:48:33 0 d-------- C:\WINDOWS\addins
2008-08-03 19:56:25 0 d-------- C:\Program Files\Alwil Software
2008-08-03 19:53:43 0 d-------- C:\Program Files\Funcom
2008-08-03 19:52:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Funcom
2008-08-03 19:40:08 0 d-------- C:\WINDOWS\system32\fr-fr
2008-08-03 19:40:07 0 d-------- C:\WINDOWS\system32\fr
2008-08-03 19:40:07 0 d-------- C:\WINDOWS\system32\bits
2008-08-03 19:40:07 0 d-------- C:\WINDOWS\l2schemas
2008-08-03 19:39:09 0 d-------- C:\WINDOWS\ServicePackFiles
2008-08-03 19:37:37 0 d-------- C:\WINDOWS\network diagnostic
2008-08-03 19:36:32 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-08-03 19:34:57 0 d-------- C:\WINDOWS\EHome
2008-08-03 19:30:25 0 d-------- C:\WINDOWS\nview
2008-08-03 19:30:00 0 d-------- C:\NVIDIA
2008-08-03 19:25:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-08-03 19:25:12 0 d-------- C:\WINDOWS\system32\PreInstall
2008-08-03 19:23:41 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\Adobe
2008-08-03 19:23:32 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\Macromedia
2008-08-03 19:22:43 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-08-03 19:22:41 0 d---s---- C:\Documents and Settings\Wroblevski\UserData
2008-08-03 19:21:55 0 d-------- C:\Program Files\Broadcom
2008-08-03 19:21:45 0 d-------- C:\WINDOWS\Downloaded Installations
2008-08-03 19:21:45 0 d-------- C:\Program Files\Fichiers communs\InstallShield
2008-08-03 19:21:35 0 d-------- C:\dell
2008-08-03 19:11:26 0 d-------- C:\Documents and Settings\Wroblevski\Application Data\Identities
2008-08-03 19:11:17 0 d--h----- C:\Documents and Settings\Wroblevski\Voisinage réseau
2008-08-03 19:11:17 0 d--h----- C:\Documents and Settings\Wroblevski\Voisinage d'impression
2008-08-03 19:11:17 0 dr-h----- C:\Documents and Settings\Wroblevski\SendTo
2008-08-03 19:11:17 1572864 --ah----- C:\Documents and Settings\Wroblevski\NTUSER.DAT
2008-08-03 19:11:17 0 d--h----- C:\Documents and Settings\Wroblevski\Modèles
2008-08-03 19:11:17 0 dr------- C:\Documents and Settings\Wroblevski\Mes documents
2008-08-03 19:11:17 0 dr------- C:\Documents and Settings\Wroblevski\Menu Démarrer
2008-08-03 19:11:17 0 d--h----- C:\Documents and Settings\Wroblevski\Local Settings
2008-08-03 19:11:17 0 dr------- C:\Documents and Settings\Wroblevski\Favoris
2008-08-03 19:11:17 0 d---s---- C:\Documents and Settings\Wroblevski\Cookies
2008-08-03 19:11:17 0 d-------- C:\Documents and Settings\Wroblevski\Bureau
2008-08-03 19:11:17 0 dr-h----- C:\Documents and Settings\Wroblevski\Application Data
2008-08-03 19:09:06 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-08-03 19:09:05 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-08-03 19:09:04 229376 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2008-08-03 19:09:04 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2008-08-03 19:09:04 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2008-08-03 19:09:04 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-08-03 19:09:04 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-08-03 19:08:39 229376 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-08-03 19:08:39 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-08-03 19:08:39 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2008-08-03 19:08:39 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-08-03 19:08:39 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-08-03 19:06:22 0 d-------- C:\WINDOWS\system32\xircom
2008-08-03 19:06:20 262144 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-08-03 19:06:03 0 -rahs---- C:\MSDOS.SYS
2008-08-03 19:06:03 0 -rahs---- C:\IO.SYS
2008-08-03 19:06:03 0 --a------ C:\CONFIG.SYS
2008-08-03 19:06:03 0 --a------ C:\AUTOEXEC.BAT
2008-08-03 19:05:13 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-08-03 19:05:05 0 dr------- C:\WINDOWS\Offline Web Pages
2008-08-03 19:05:05 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-08-03 19:04:55 0 d--h----- C:\Program Files\WindowsUpdate
2008-08-03 19:04:52 0 d-------- C:\Program Files\Services en ligne
2008-08-03 19:04:37 0 d-------- C:\WINDOWS\system32\DirectX
2008-08-03 19:04:08 0 d---s---- C:\WINDOWS\Tasks
2008-08-03 19:04:08 0 d-------- C:\Program Files\Fichiers communs\MSSoap
2008-08-03 19:04:02 0 d-------- C:\WINDOWS\srchasst
2008-08-03 19:04:01 0 d-------- C:\WINDOWS\system32\Macromed
2008-08-03 19:03:51 0 d-------- C:\Program Files\Movie Maker
2008-08-03 19:03:40 0 d-------- C:\WINDOWS\system32\Restore
2008-08-03 19:03:05 23032 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-08-03 19:02:50 0 d-------- C:\WINDOWS\Registration
2008-08-03 19:02:18 0 d-------- C:\Program Files\Messenger
2008-08-03 19:02:15 0 d-------- C:\Program Files\MSN Gaming Zone
2008-08-03 19:01:42 0 d-------- C:\Program Files\Windows NT
2008-08-03 19:01:39 0 d-------- C:\WINDOWS\system32\MsDtc
2008-08-03 19:01:38 0 d-------- C:\WINDOWS\system32\Com


-- Find3M Report ---------------------------------------------------------------

2008-08-06 13:36:19 367658 --a------ C:\WINDOWS\system32\perfh00C.dat
2008-08-06 13:36:19 48616 --a------ C:\WINDOWS\system32\perfc00C.dat
2008-08-04 13:21:17 1097 --a------ C:\Documents and Settings\Wroblevski\Application Data\QuickZip45.ini
2008-08-03 20:55:14 62 --ahs---- C:\Documents and Settings\Wroblevski\Application Data\desktop.ini
2008-08-03 19:37:26 252240 -rahs---- C:\ntldr
2008-05-16 14:01:00 1630208 --a------ C:\WINDOWS\system32\nwiz.exe
2008-05-16 14:01:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-05-16 14:01:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-05-16 14:01:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-05-16 14:01:00 1486848 --a------ C:\WINDOWS\system32\nview.dll
2008-05-16 14:01:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-05-16 14:01:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-05-16 14:01:00 425984 --a------ C:\WINDOWS\system32\keystone.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
06.08.2008 12:29 62728 --a------ C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [16.05.2008 14:01]
"nwiz"="nwiz.exe" [16.05.2008 14:01 C:\WINDOWS\system32\nwiz.exe]
"CmPCIaudio"="CMICNFG3.cpl" []
"Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [25.09.2007 10:10]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [22.07.2008 20:42]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [27.05.2008 10:50]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30.07.2008 10:47]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [20.03.2008 20:23]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [14.12.2007 11:36]
"BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [27.06.2008 16:50]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [16.05.2008 14:01]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [25.04.2008 18:21]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14.04.2008 04:34]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07.07.2008 09:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=1 (0x1)
"NoDispScrSavPage"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm