A l'aide !

Bonjour,
Mon PC est infecté par Win32:Mabezat [Wrm], qui crée des fichiers .exe ainsi que des archives .rar dans la plupart de mes dossiers, et en particulier sur mon DD externe. De plus, de nombreux problemes commencent à apparaître, comme l'impossibilité d'accéder directement à C:, l'impossibilité d'utiliser Windows Media Player, ...
Je commence à en etre vraiment lassé, c'est pourquoi j'aimerais beaucoup que cela se résolve, merci.

PS : si ça peut aider, j'ai également un Ubuntu en dual-boot.

Bon, j'ai installé RSIT, et donc voici le log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gourson at 2009-05-30 14:05:36
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 4 GB (7%) free of 52 GB
Total RAM: 2046 MB (65% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
ShoppingReport - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - G:\Logiciels\RealPlayer\rpbrowserrecordplugin.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 118842]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 184423]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-03-06 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-11-10 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E1BACF55-35E1-4E47-9247-2D48660E5545}]
Zango - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-03-06 2436160]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-09-29 67584]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [2005-11-10 36975]
"SigmatelSysTrayApp"=C:\WINDOWS\stsystra.exe [2006-03-24 282624]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-08 761947]
"Dell QuickSet"=C:\Program Files\Dell\QuickSet\quickset.exe [2006-06-29 1032192]
"IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2006-05-01 667718]
"DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2005-12-09 49152]
"CTSVolFE.exe"=C:\Program Files\Creative\Mixer\CTSVolFE.exe [2005-02-23 57344]
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-12-06 127035]
"ISUSPM Startup"=C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe [2005-06-10 249856]
"ISUSScheduler"=C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe [2005-06-10 81920]
"WooCnxMon"=C:\PROGRA~1\Wanadoo\CnxMon.exe [2004-05-13 24576]
"SpeedTouch USB Diagnostics"=C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [2004-01-26 866816]
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe [2004-05-13 24576]
"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"avast!"=C:\PROGRA~1\Avast4\ashDisp.exe [2008-11-26 81000]
"IntelliPoint"=C:\Program Files\Microsoft IntelliPoint\point32.exe [2005-03-24 217088]
"atwtusb"=atwtusb.exe beta []
"WD Button Manager"=C:\WINDOWS\system32\WDBtnMgr.exe [2007-12-25 364544]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-03-28 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2005-12-10 133016]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-01-14 185872]
"Diamondback"=C:\Program Files\Razer\Diamondback 3G\razerhid.exe [2007-08-01 147456]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-10 15360]
"ModemOnHold"=C:\Program Files\NetWaiting\netWaiting.exe []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2006-10-13 20058152]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-08-29 68856]
"DriverUpdaterPro"=C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe [2008-06-06 2293284]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-06-26 1211176]
"Wallpaper"=C:\Program Files\Wallpaper\Wallpaper.exe [2007-08-21 233472]
"Steam"=G:\Jeux\Empire Total War\Steam.exe -silent []

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
ScanPanel.lnk - C:\ScanPanel\ScnPanel.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-23 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-10 240128]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"F:\Jeux\Battlefield2\Bf2_w32ded.exe"="F:\Jeux\Battlefield2\Bf2_w32ded.exe:*:Enabled:Bf2_w32ded"
"C:\Program Files\Alias\Maya8.0\bin\maya.exe"="C:\Program Files\Alias\Maya8.0\bin\maya.exe:*:Enabled:Maya"
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"F:\Jeux\Counter Strike\Counter-Strike\Counter-Strike\cstrike.exe"="F:\Jeux\Counter Strike\Counter-Strike\Counter-Strike\cstrike.exe:*:Enabled:CounterStrike Launcher"
"C:\Jeux\Counter Strike\Counter-Strike\Counter-Strike\cstrike.exe"="C:\Jeux\Counter Strike\Counter-Strike\Counter-Strike\cstrike.exe:*:Enabled:CounterStrike Launcher"
"C:\Jeux\Counter-Strike\cstrike.exe"="C:\Jeux\Counter-Strike\cstrike.exe:*:Enabled:CounterStrike Launcher"
"\\MANMAN\COUNTER STRIKE\Counter-Strike\cstrike.exe"="\\MANMAN\COUNTER STRIKE\Counter-Strike\cstrike.exe:*:Enabled:cstrike.exe"
"F:\Jeux\Titan Quest\Titan Quest.exe"="F:\Jeux\Titan Quest\Titan Quest.exe:*:Enabled:Titan Quest"
"\\MANMAN\Titan Quest\Titan Quest.exe"="\\MANMAN\Titan Quest\Titan Quest.exe:*:Enabled:Titan Quest.exe"
"\\MANMAN\COUNTER-STRIKE\cstrike.exe"="\\MANMAN\COUNTER-STRIKE\cstrike.exe:*:Enabled:cstrike.exe"
"\\MANMAN\Speezou (F)\Jeux\Battlefield2\Bf2_w32ded.exe"="\\MANMAN\Speezou (F)\Jeux\Battlefield2\Bf2_w32ded.exe:*:Enabled:Bf2_w32ded.exe"
"\\MANMAN\UnrealTournament\System\UnrealTournament.exe"="\\MANMAN\UnrealTournament\System\UnrealTournament.exe:*:Enabled:UnrealTournament.exe"
"C:\Data\steamapps\gladiatorpo\counter-strike source\hl2.exe"="C:\Data\steamapps\gladiatorpo\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Data\Steam\steamapps\gladiatorpo\counter-strike source\hl2.exe"="C:\Data\Steam\steamapps\gladiatorpo\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Data\AoE\empires2.exe"="C:\Data\AoE\empires2.exe:*:Enabled:Age of Empires II"
"C:\Data\Battlefield\BF1942.exe"="C:\Data\Battlefield\BF1942.exe:*:Enabled:BF1942"
"C:\Jeux\Battlefield 1942\BF1942.exe"="C:\Jeux\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"
"C:\Jeux\Battlefield\BF1942.exe"="C:\Jeux\Battlefield\BF1942.exe:*:Enabled:BF1942"
"F:\Jeux\Dawn of War\W40k.exe"="F:\Jeux\Dawn of War\W40k.exe:*:Enabled:W40K"
"D:\Jeux\Dawn of War\W40k.exe"="D:\Jeux\Dawn of War\W40k.exe:*:Enabled:W40K"
"F:\Jeux\Rome Total War\RomeTW.exe"="F:\Jeux\Rome Total War\RomeTW.exe:*:Enabled:Rome: Total War"
"G:\steam mis a jour\Half Life 2\SteamApps\gladiatorpo\counter-strike source\hl2.exe"="G:\steam mis a jour\Half Life 2\SteamApps\gladiatorpo\counter-strike source\hl2.exe:*:Enabled:hl2"
"D:\WoW-frFR-Installer-downloader.exe"="D:\WoW-frFR-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-1.12.0-frFR-downloader.exe"="D:\World of Warcraft\WoW-1.12.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="D:\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-2.0.3-frFR-downloader.exe"="D:\World of Warcraft\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-2.0.3.6299-to-2.0.5.6320-frFR-downloader.exe"="D:\World of Warcraft\WoW-2.0.3.6299-to-2.0.5.6320-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-2.0.5.6320-to-2.0.6.6337-frFR-downloader.exe"="D:\World of Warcraft\WoW-2.0.5.6320-to-2.0.6.6337-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\Jeux\World of Warcraft\WoW-1.12.0-frFR-downloader.exe"="D:\Jeux\World of Warcraft\WoW-1.12.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\Jeux\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="D:\Jeux\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\WOW le vrai\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="G:\WOW le vrai\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\WOW le vrai\WoW-2.0.3-frFR-downloader.exe"="G:\WOW le vrai\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\WOW\WoW-2.0.3-frFR-downloader.exe"="G:\WOW\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\WOW\WoW-2.0.3.6299-to-2.0.5.6320-frFR-downloader.exe"="G:\WOW\WoW-2.0.3.6299-to-2.0.5.6320-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\WOW\WoW-2.0.5.6320-to-2.0.6.6337-frFR-downloader.exe"="G:\WOW\WoW-2.0.5.6320-to-2.0.6.6337-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\Jeux\Warcraft III\Warcraft III.exe"="G:\Jeux\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\Warcraft III\Warcraft III.exe"="C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Jeux\Warcraft III\Warcraft III.exe"="C:\Jeux\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Jeux\blobby volley\volley.exe"="C:\Jeux\blobby volley\volley.exe:*:Enabled:volley"
"D:\WORLD\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="D:\WORLD\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\WORLD\WoW-2.0.3-frFR-downloader.exe"="D:\WORLD\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\WORLD\WoW-2.0.3.6299-to-2.0.6.6337-frFR-downloader.exe"="D:\WORLD\WoW-2.0.3.6299-to-2.0.6.6337-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"G:\Steam\steamapps\gladiatorpo\counter-strike source\hl2.exe"="G:\Steam\steamapps\gladiatorpo\counter-strike source\hl2.exe:*:Enabled:hl2"
"D:\WORLD\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe"="D:\WORLD\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\WORLD\WoW-2.0.12.6546-to-2.1.0.6692-frFR-downloader.exe"="D:\WORLD\WoW-2.0.12.6546-to-2.1.0.6692-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\Unreal\UT2004\System\UT2004.exe"="D:\Unreal\UT2004\System\UT2004.exe:*:Enabled:UT2004"
"G:\Jeux\Battlefield2\Bf2_w32ded.exe"="G:\Jeux\Battlefield2\Bf2_w32ded.exe:*:Enabled:Bf2_w32ded"
"G:\Jeux\Battlefield2\BF2.exe"="G:\Jeux\Battlefield2\BF2.exe:*:Enabled:Battlefield 2"
"G:\Jeux\Overlord\Overlord.exe"="G:\Jeux\Overlord\Overlord.exe:*:Enabledverlord"
"G:\Jeux\Call Of Duty 2\CoD2MP_s.exe"="G:\Jeux\Call Of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"G:\Jeux\Rome Total War\RomeTW.exe"="G:\Jeux\Rome Total War\RomeTW.exe:*:Enabled:Rome: Total War"
"C:1\Jeux\Rome Total War\RomeTW.exe"="C:1\Jeux\Rome Total War\RomeTW.exe:*:Enabled:RomeTW.exe"
"C:1\Jeux\Call Of Duty 2\CoD2MP_s.exe"="C:1\Jeux\Call Of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s.exe"
"C:7\Jeux\Rome Total War\RomeTW.exe"="C:7\Jeux\Rome Total War\RomeTW.exe:*:Enabled:RomeTW.exe"
"C:9\Jeux\Rome Total War\RomeTW-BI.exe"="C:9\Jeux\Rome Total War\RomeTW-BI.exe:*:Enabled:RomeTW-BI.exe"
"C:9\Jeux\Call Of Duty 2\CoD2MP_s.exe"="C:9\Jeux\Call Of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s.exe"
"C:9\Unreal\UT2004\System\UT2004.exe"="C:9\Unreal\UT2004\System\UT2004.exe:*:Enabled:UT2004"
"G:\Unreal\UT2004\System\UT2004.exe"="G:\Unreal\UT2004\System\UT2004.exe:*:Enabled:UT2004"
"C:\Program Files\Cyanide\Loki\Loki.exe"="C:\Program Files\Cyanide\Loki\Loki.exe:*:Enabled:Loki"
"C:\Program Files\Cyanide\Loki\Autorun\AutoRun.exe"="C:\Program Files\Cyanide\Loki\Autorun\AutoRun.exe:*:Enabled:Loki - AutoRun"
"G:\LimeWire\LimeWire.exe"="G:\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"G:\Logiciel\FileZilla\FileZilla.exe"="G:\Logiciel\FileZilla\FileZilla.exe:*:Enabled:FileZilla"
"G:\Jeux\DarkCrusade\DarkCrusade.exe"="G:\Jeux\DarkCrusade\DarkCrusade.exe:*:EnabledarkCrusade"
"C:\Program Files\Adobe\Photoshop Elements 4.0\AdobePhotoshopElementsMediaServer.exe"="C:\Program Files\Adobe\Photoshop Elements 4.0\AdobePhotoshopElementsMediaServer.exe:*isabled:Adobe Photoshop Elements Media Server"
"G:\Jeux\Counter Strike\Counter-Strike\Counter-Strike\cstrike.exe"="G:\Jeux\Counter Strike\Counter-Strike\Counter-Strike\cstrike.exe:*:Enabled:CounterStrike Launcher"
"G:\Jeux\Titan Quest\Titan Quest.exe"="G:\Jeux\Titan Quest\Titan Quest.exe:*:Enabled:Titan Quest"
"G:\Steam\Half Life 2\SteamApps\tom53160\counter-strike source\hl2.exe"="G:\Steam\Half Life 2\SteamApps\tom53160\counter-strike source\hl2.exe:*:Enabled:hl2"
"G:\Jeux\Empire Earth\Empire Earth.exe"="G:\Jeux\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth"
"G:\Logiciel\LimeWire\LimeWire.exe"="G:\Logiciel\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"G:\Jeux\AoE II\empires2.exe"="G:\Jeux\AoE II\empires2.exe:*:Enabled:Age of Empires II"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"G:\Jeux\GTA2\gta2.exe"="G:\Jeux\GTA2\gta2.exe:*:Enabled:GTA2 main executable"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:EnablednkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:EnablednkBstrB"
"D:\Logiciels\Xfire\xfire.exe"="D:\Logiciels\Xfire\xfire.exe:*:Enabled:Xfire"
"D:\Jeux\CoD4\iw3mp.exe"="D:\Jeux\CoD4\iw3mp.exe:*:Enabled:iw3mp"
"C:0\Jeux\Call Of Duty 4\iw3mp.exe"="C:0\Jeux\Call Of Duty 4\iw3mp.exe:*:Enabled:iw3mp.exe"
"D:\Jeux\Call Of Duty 4\iw3mp.exe"="D:\Jeux\Call Of Duty 4\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:6\Jeux\Call Of Duty 4\iw3mp.exe"="C:6\Jeux\Call Of Duty 4\iw3mp.exe:*:Enabled:iw3mp.exe"
"F:\Logiciels\Xfire\xfire.exe"="F:\Logiciels\Xfire\xfire.exe:*:Enabled:Xfire"
"C:\Jeux\Liero Xtreme\LieroX.exe"="C:\Jeux\Liero Xtreme\LieroX.exe:*:Enabled:LieroX"
"F:\Logiciels\Hamachi\hamachi.exe"="F:\Logiciels\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"F:\Jeux\Call Of Duty 4\cod4 server.exe"="F:\Jeux\Call Of Duty 4\cod4 server.exe:*:Enabled:cod4 server"
"F:\Jeux\crysis\Bin32\Crysis.exe"="F:\Jeux\crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32"
"F:\Jeux\crysis\Bin32\CrysisDedicatedServer.exe"="F:\Jeux\crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Jeux\TmNationsForever\TmForever.exe"="C:\Jeux\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"F:\Logiciels\LimeWire\LimeWire.exe"="F:\Logiciels\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"F:\Jeux\Call Of Duty 4\iw3mp.exe"="F:\Jeux\Call Of Duty 4\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"F:\Jeux\Heroes\Heroes3.exe"="F:\Jeux\Heroes\Heroes3.exe:*:Enabled:Heroes of Might and Magic® III"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
shell\AutoRun\command - G:\
shell\explore\command - RECYCLED\INFO.exe
shell\open\command - RECYCLED\INFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{048c23b7-94cb-11db-9414-0015c54ca3eb}]
shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ae0c7ef-e971-11dd-aaf1-0015c54ca3eb}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d3aa47f-c7ea-11db-a985-0015c54ca3eb}]
shell\PlayWithPowerDVD\command - "C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" MOVIE "%L"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5706183b-7591-11db-a106-0016cffe313c}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8226c19b-48a9-11db-8714-0018de0d4ca7}]
shell\AutoRun\command - G:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e86f88f-0718-11dd-aa49-000e504896b8}]
shell\AutoRun\command - zPharaoh.exe
shell\explore\command - zPharaoh.exe
shell\open\command - zPharaoh.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8679698-76fd-11db-a108-000e504896b8}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed5f5cb7-8885-11dc-aa05-0015c54ca3eb}]
shell\AutoRun\command - F:\
shell\explore\command - F:\RECYCLED\INFO.exe
shell\open\command - F:\RECYCLED\INFO.exe


======List of files/folders created in the last 1 months======

2009-05-30 14:05:37 ----D---- C:\Program Files\trend micro
2009-05-30 14:05:36 ----D---- C:\rsit
2009-05-29 20:07:00 ----RSH---- C:\zPharaoh.exe
2009-05-25 00:23:45 ----D---- C:\Program Files\Guitar Pro 5
2009-05-21 20:59:09 ----D---- C:\Documents and Settings\Gourson\Application Data\tazebama
2009-05-08 10:39:04 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-05-08 10:38:55 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-05-08 10:33:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-05-08 10:33:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-05-08 10:32:48 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-05-08 10:32:42 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-05-08 10:31:34 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$

======List of files/folders modified in the last 1 months======

2009-05-30 14:05:37 ----RD---- C:\Program Files
2009-05-30 14:04:18 ----SHD---- C:\WINDOWS\Installer
2009-05-30 14:04:17 ----D---- C:\WINDOWS\Temp
2009-05-30 14:03:36 ----A---- C:\WINDOWS\ModemLog_Câble de communication entre deux ordinateurs.txt
2009-05-30 02:22:24 ----D---- C:\WINDOWS
2009-05-30 02:20:18 ----D---- C:\Program Files\Mozilla Firefox
2009-05-30 00:10:42 ----SHD---- C:\WINDOWS\system32\dllcache
2009-05-30 00:10:37 ----D---- C:\WINDOWS\system32
2009-05-30 00:10:37 ----D---- C:\Program Files\Windows Media Player
2009-05-30 00:10:37 ----D---- C:\Program Files\Internet Explorer
2009-05-30 00:05:30 ----D---- C:\Program Files\Outlook Express
2009-05-29 22:42:31 ----D---- C:\Program Files\Movie Maker
2009-05-29 22:11:42 ----D---- C:\WINDOWS\system32\Restore
2009-05-29 20:57:12 ----A---- C:\WINDOWS\ModemLog_Modem télécopieur Bluetooth.txt
2009-05-29 20:57:12 ----A---- C:\WINDOWS\ModemLog_Modem Bluetooth.txt
2009-05-29 20:57:01 ----A---- C:\WINDOWS\ModemLog_Conexant HDA D110 MDC V.92 Modem.txt
2009-05-29 20:07:25 ----D---- C:\Program Files\Windows NT
2009-05-29 20:07:24 ----D---- C:\Program Files\NetMeeting
2009-05-29 20:07:06 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-29 19:52:04 ----D---- C:\WINDOWS\system32\ias
2009-05-29 19:51:48 ----A---- C:\WINDOWS\ModemLog_Simulateur de modem Bluetooth.txt
2009-05-29 19:51:38 ----D---- C:\WINDOWS\Registration
2009-05-29 19:51:15 ----A---- C:\WINDOWS\ScnPanel.ini
2009-05-29 19:50:44 ----SHD---- C:\WINDOWS\CSC
2009-05-28 18:36:07 ----D---- C:\Program Files\QuickTime
2009-05-27 20:28:39 ----D---- C:\Documents and Settings\Gourson\Application Data\Skype
2009-05-25 01:26:36 ----D---- C:\WINDOWS\system32\FxsTmp
2009-05-25 00:23:47 ----RSD---- C:\WINDOWS\Fonts
2009-05-24 23:30:01 ----D---- C:\Documents and Settings\Gourson\Application Data\dvdcss
2009-05-21 23:27:11 ----D---- C:\Program Files\Messenger Plus! Live
2009-05-21 22:07:49 ----A---- C:\WINDOWS\War3Unin.exe
2009-05-21 21:06:04 ----A---- C:\WINDOWS\ScUnin.exe
2009-05-21 21:06:03 ----A---- C:\WINDOWS\IsUn040c.exe
2009-05-21 21:05:55 ----A---- C:\WINDOWS\uninst.exe
2009-05-21 21:05:47 ----A---- C:\WINDOWS\IsUninst.exe
2009-05-21 20:59:09 ----D---- C:\Documents and Settings
2009-05-20 13:14:20 ----D---- C:\WINDOWS\Prefetch
2009-05-18 21:00:45 ----D---- C:\Documents and Settings\Gourson\Application Data\Dev-Cpp
2009-05-17 17:18:32 ----D---- C:\Documents and Settings\Gourson\Application Data\OpenOffice.org2
2009-05-15 22:13:24 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-14 18:55:36 ----D---- C:\Documents and Settings\Gourson\Application Data\.purple
2009-05-10 00:16:26 ----A---- C:\WINDOWS\NeroDigital.ini
2009-05-08 18:15:46 ----HD---- C:\WINDOWS\inf
2009-05-08 11:01:30 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-05-08 10:56:29 ----D---- C:\WINDOWS\system32\wbem
2009-05-08 10:56:28 ----D---- C:\WINDOWS\AppPatch
2009-05-08 10:39:00 ----A---- C:\WINDOWS\imsins.BAK
2009-05-08 10:38:40 ----D---- C:\WINDOWS\system32\fr-fr
2009-05-08 10:38:27 ----D---- C:\WINDOWS\ie7updates
2009-05-08 10:33:26 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-11-26 26944]
R1 APPDRV;APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [2005-08-12 16128]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-11-26 111184]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-11-26 50864]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-10 40320]
R1 omci;OMCI WDM Device Driver; C:\WINDOWS\system32\DRIVERS\omci.sys [2004-02-13 17153]
R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R1 Tcpip6;Pilote du protocole IPv6 Microsoft; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2008-06-20 225920]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.10.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-09-14 21275]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-11-26 94032]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-11-23 40480]
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; \??\C:\WINDOWS\system32\drivers\Haspnt.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-04 12544]
R2 NwlnkIpx;Protocole de transport compatible NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2004-08-10 88448]
R2 NwlnkNb;NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-10 63232]
R2 NwlnkSpx;Protocole NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-10 55936]
R2 s24trans;Transport RLAN; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2006-05-01 13568]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2001-06-21 73728]
R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-12-06 25883]
R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-12-06 34843]
R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-12-06 4123]
R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-12-06 2271]
R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-12-06 86586]
R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-12-06 15227]
R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-12-06 6363]
R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-12-06 98714]
R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-12-06 100603]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-10 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-11-26 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-23 1578496]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2005-08-05 45312]
R3 btaudio;Périphérique audio Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2006-05-24 328237]
R3 BTDriver;Pilote de communications virtuelles Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2006-05-24 30427]
R3 BTKRNL;Enumérateur de bus Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2006-05-24 851434]
R3 btwmodem;Modem Bluetooth; C:\WINDOWS\system32\DRIVERS\btwmodem.sys [2006-05-24 30285]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2006-05-24 66488]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2008-09-13 223128]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-05-06 25280]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-08-12 137728]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys [2005-12-01 936960]
R3 HSXHWAZL;HSXHWAZL; C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys [2005-12-01 192512]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-10 61824]
R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2006-10-13 163584]
R3 Razerlow;Diamondback 3G USB Filter Driver; C:\WINDOWS\System32\Drivers\DB3G.sys [2005-04-24 13225]
R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-07-14 28544]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-07-12 51328]
R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-07-14 307968]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-10 5888]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-10 67584]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2006-03-24 1156648]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-08 191872]
R3 tunmp;Pilote de carte miniport Tun Microsoft; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2004-08-10 12416]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2005-10-26 27264]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver; C:\WINDOWS\system32\DRIVERS\w39n51.sys [2006-04-26 1429632]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys [2005-12-01 669696]
S1 aiptektp;HyperPen; C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-07-07 22272]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S2 DS1410D;DS1410D; \??\C:\WINDOWS\system32\drivers\ds1410d.sys []
S3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [2003-12-08 53600]
S3 alcaudsl;SpeedTouch ADSL Modem ATM Transport; C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [2003-12-08 70688]
S3 Bridge;Pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2004-08-10 71552]
S3 BridgeMP;Miniport de pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2004-08-10 71552]
S3 BTWDNDIS;Serveur d'accès au réseau local Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2006-05-24 148900]
S3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2006-05-24 45683]
S3 DSproct;DSproct; \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys []
S3 E100B;Pilote de carte Intel (R) PRO; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-23 117760]
S3 gel90xne;gel90xne; \??\C:\DOCUME~1\Gourson\LOCALS~1\Temp\gel90xne.sys []
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 MHNDRV;Pilote MHN; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 nm;Pilote du Moniteur réseau; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-10 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2005-03-15 20352]
S3 sffdisk;Pilote de classe de stockage SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2004-08-10 11136]
S3 sffp_sd;Pilote de protocole de stockage SFF pour SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2004-08-10 10240]
S3 Sntnlusb;Rainbow USB SuperPro; C:\WINDOWS\system32\DRIVERS\SNTNLUSB.SYS [2001-06-21 20032]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-02-18 30464]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys [2006-09-07 10112]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtre de bus AGP Intel; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368]
S4 agpCPQ;Filtre de bus AGP Compaq; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2004-08-04 44928]
S4 alim1541;Filtre de bus AGP ALI; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2004-08-04 42752]
S4 amdagp;Pilote de filtre du bus AMD AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2004-08-04 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2004-08-04 5504]
S4 sisagp;Filtre de bus AGP SIS; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2004-08-04 41088]
S4 viaagp;Filtre de bus AGP VIA; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;Service d'application d'assistance IPv6; C:\WINDOWS\system32\svchost.exe [2004-08-10 14336]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Avast4\aswUpdSv.exe [2008-11-26 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-23 409600]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast4\ashServ.exe [2008-11-26 155160]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2006-05-24 266295]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
R2 ehSched;Service de planification Media Center; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 103424]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2006-05-01 114753]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 NICCONFIGSVC;NICCONFIGSVC; C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe [2006-06-29 376832]
R2 NWCWorkstation;Service client pour NetWare; C:\WINDOWS\system32\svchost.exe [2004-08-10 14336]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-04-23 66872]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2006-05-01 217164]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2006-05-01 540745]
R2 WLANKEEPER;Intel(R) PROSet/Wireless SSO Service; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2006-05-01 262217]
R3 iPod Service;Service de l'iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2004-08-10 268800]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-09-24 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Avast4\ashMaiSv.exe [2008-11-26 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Avast4\ashWebSv.exe [2008-11-26 352920]
S3 Boonty Games;Boonty Games; C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2008-07-22 69120]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-06 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2004-08-10 14336]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-10 14336]

-----------------EOF-----------------




Apparamment, le fichier C:\zPharaoh.exe est détécté par Avast comme un rootkit, et tazebama comme un ver ...

Merci pour la rapidité de la réponse !
Voila le scan avec UsbFix :


############################## [ UsbFix V3.026 | Scan ]

# User : Gourson (Administrateurs) # RAYMOUF
# Update on 26/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 14:43:26 | 30/05/2009

# Genuine Intel(R) CPU T2400 @ 1.83GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1296 [VPS 090510-0] 4.8.1296 [ (!) Disabled | (!) Outdated ]
# AV : [ (!) Disabled | (!) Outdated ]
# FW : [ (!) Disabled ]

# C:\ # Disque fixe local # 51,19 Go (3,64 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# G:\ # Disque fixe local # 298,02 Go (3,57 Go free) [BACKENAÏ] # FAT32
# H:\ # Disque amovible # 7,49 Go (6,41 Go free) [CURRAHEE] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Razer\Diamondback 3G\razerhid.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Wallpaper\Wallpaper.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\ScanPanel\ScnPanel.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Razer\Diamondback 3G\razerofa.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre Startup ]

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.google.fr/hws/sb/dell-row/fr/side.html?channel=fr"
HKCU_Main: "Start Page"="http://www.google.fr/"
HKCU_Main: "Window Title"="Wanadoo"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Gourson"
HKLM_logon: "AltDefaultUserName"="Gourson"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: ehTray=C:\WINDOWS\ehome\ehtray.exe
HKLM_Run: SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
HKLM_Run: SigmatelSysTrayApp=stsystra.exe
HKLM_Run: ATICCC="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
HKLM_Run: SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
HKLM_Run: Dell QuickSet=C:\Program Files\Dell\QuickSet\quickset.exe
HKLM_Run: IntelZeroConfig="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
HKLM_Run: DVDLauncher="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
HKLM_Run: CTSVolFE.exe="C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
HKLM_Run: dla=C:\WINDOWS\system32\dla\tfswctrl.exe
HKLM_Run: ISUSPM Startup="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
HKLM_Run: ISUSScheduler="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
HKLM_Run: WooCnxMon=C:\PROGRA~1\Wanadoo\CnxMon.exe
HKLM_Run: SpeedTouch USB Diagnostics="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
HKLM_Run: WOOWATCH=C:\PROGRA~1\Wanadoo\Watch.exe
HKLM_Run: UserFaultCheck=%systemroot%\system32\dumprep 0 -u
HKLM_Run: NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe
HKLM_Run: avast!=C:\PROGRA~1\Avast4\ashDisp.exe
HKLM_Run: IntelliPoint="C:\Program Files\Microsoft IntelliPoint\point32.exe"
HKLM_Run: atwtusb=atwtusb.exe beta
HKLM_Run: WD Button Manager=WDBtnMgr.exe
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKLM_Run: iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKLM_Run: DAEMON Tools="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
HKLM_Run: Diamondback=C:\Program Files\Razer\Diamondback 3G\razerhid.exe
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: ModemOnHold=C:\Program Files\NetWaiting\netWaiting.exe
HKCU_Run: Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKCU_Run: DriverUpdaterPro=C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
HKCU_Run: H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
HKCU_Run: Wallpaper="C:\Program Files\Wallpaper\Wallpaper.exe" Starter
HKCU_Run: Steam="G:\Jeux\Empire Total War\Steam.exe" -silent

################## [ Fichiers # Dossiers infectieux ]

Found ! "C:\Documents and Settings\Gourson\Application Data\tazebama"
Found ! "C:\Documents and Settings\Gourson\Application Data\tazebama\zPharaoh.dat"
Found ! "C:\Documents and Settings\hook.dl_"
Found ! "C:\Documents and Settings\tazebama.dl_"
Found ! "C:\Documents and Settings\tazebama.dll"
Found ! C:\DOCUME~1\Gourson\LOCALS~1\Temp\war3_Install.exe
C:\autorun.inf # -> fichier appelé : "C:\zPharaoh.exe" ( présent ! )
Found ! C:\autorun.inf
Found ! C:\zPharaoh.exe
G:\autorun.inf # -> fichier appelé : "G:\zPharaoh.exe" ( absent ! )
Found ! G:\autorun.inf
H:\autorun.inf # -> fichier appelé : "H:\zPharaoh.exe" ( présent ! )
Found ! H:\autorun.inf
Found ! H:\zPharaoh.exe

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\G\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\G\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\G\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{048c23b7-94cb-11db-9414-0015c54ca3eb}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{0ae0c7ef-e971-11dd-aaf1-0015c54ca3eb}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{0ae0c7f0-e971-11dd-aaf1-0015c54ca3eb}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{0ae0c7f0-e971-11dd-aaf1-0015c54ca3eb}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{0ae0c7f0-e971-11dd-aaf1-0015c54ca3eb}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{5706183b-7591-11db-a106-0016cffe313c}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{8226c194-48a9-11db-8714-806d6172696f}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{8226c194-48a9-11db-8714-806d6172696f}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{8226c194-48a9-11db-8714-806d6172696f}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{8226c19b-48a9-11db-8714-0018de0d4ca7}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{9e86f88f-0718-11dd-aa49-000e504896b8}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{9e86f88f-0718-11dd-aa49-000e504896b8}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{9e86f88f-0718-11dd-aa49-000e504896b8}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{d8679698-76fd-11db-a108-000e504896b8}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ed5f5cb7-8885-11dc-aa05-0015c54ca3eb}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ed5f5cb7-8885-11dc-aa05-0015c54ca3eb}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{ed5f5cb7-8885-11dc-aa05-0015c54ca3eb}\Shell\open\Command

################## [ Informations # Fichier Suspect ]


################## [ Cracks # Keygens # Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.026 ! ]

Voila le rapport :


############################## [ UsbFix V3.026 | Cleaning ]

# User : Gourson (Administrateurs) # RAYMOUF
# Update on 26/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 15:01:38 | 30/05/2009

# Genuine Intel(R) CPU T2400 @ 1.83GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1296 [VPS 090510-0] 4.8.1296 [ Enabled | (!) Outdated ]
# AV : [ (!) Disabled | (!) Outdated ]
# FW : [ (!) Disabled ]

# C:\ # Disque fixe local # 51,19 Go (3,64 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# G:\ # Disque fixe local # 298,02 Go (3,55 Go free) [BACKENAÏ] # FAT32
# H:\ # Disque amovible # 7,49 Go (6,38 Go free) [CURRAHEE] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe

################## [ Fichiers # Dossiers infectieux ]

Deleted ! "C:\Documents and Settings\Gourson\Application Data\tazebama"
Deleted ! "C:\Documents and Settings\hook.dl_"
Deleted ! "C:\Documents and Settings\tazebama.dl_"
Deleted ! "C:\Documents and Settings\tazebama.dll"
Deleted ! C:\DOCUME~1\Gourson\LOCALS~1\Temp\war3_Install.exe
C:\autorun.inf # -> fichier appelé : "C:\zPharaoh.exe" ( présent ! )
Deleted ! -> C:\zPharaoh.exe
Deleted ! C:\autorun.inf
G:\autorun.inf # -> fichier appelé : "G:\zPharaoh.exe" ( présent ! )
Deleted ! -> G:\zPharaoh.exe
Deleted ! G:\autorun.inf
H:\autorun.inf # -> fichier appelé : "H:\zPharaoh.exe" ( présent ! )
Deleted ! -> H:\zPharaoh.exe
Deleted ! H:\autorun.inf

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\G\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{048c23b7-94cb-11db-9414-0015c54ca3eb}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{0ae0c7ef-e971-11dd-aaf1-0015c54ca3eb}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{5706183b-7591-11db-a106-0016cffe313c}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{8226c19b-48a9-11db-8714-0018de0d4ca7}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{d8679698-76fd-11db-a108-000e504896b8}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{ed5f5cb7-8885-11dc-aa05-0015c54ca3eb}\Shell\AutoRun\Command

################## [ Listing des fichiers présent ]

[20/09/2006 15:17|--ahs----|209] - C:\boot.ini
[10/08/2004 13:00|-rahs----|4952] - C:\Bootfont.bin
[18/09/2008 21:20|--a------|74] - C:\CMLoader.log
[14/09/2006 14:30|-rah-----|6102] - C:\dell.sdr
[?|?|?] - C:\hiberfil.sys
[21/09/2006 19:37|--a------|4128] - C:\INFCACHE.1
[21/09/2006 21:29|-rahs----|0] - C:\IO.SYS
[21/09/2006 21:29|-rahs----|0] - C:\MSDOS.SYS
[10/08/2004 13:00|-rahs----|47564] - C:\NTDETECT.COM
[14/09/2006 14:46|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[18/08/2008 15:42|--a------|91] - C:\Setup.log
[30/05/2009 15:03|--a------|4536] - C:\UsbFix.txt
[03/05/2009 01:14|--ah-----|4096] - G:\._.Trashes
[30/05/2009 14:51|--a------|938948] - G:\RSIT.exe
[14/05/2009 23:12|--a------|8684407] - G:\1134693454030_58246.mp4
[15/05/2009 01:16|--a------|29753344] - G:\51820304867_6322.mp4
[30/05/2009 14:51|--a------|3528423] - G:\mbam-setup.exe
[30/05/2009 14:51|--a------|867455] - G:\UsbFix.exe
[30/05/2009 14:05|--a------|40150] - G:\log.txt
[30/05/2009 14:51|--a------|3277857] - G:\ComboFix.exe
[29/04/2009 00:45|--a------|835995] - G:\desmume-0.9.2-win32.zip
[30/05/2009 14:51|--a------|155503] - G:\Module B11 - L'essentiel … savoir.doc .exe
[30/05/2009 14:51|--a------|155843] - G:\Module+B11+-+Fonction+et+connaissance+de+l'entreprise+(R‚sum‚+Total).doc .exe
[07/09/2008 21:53|--a------|347136] - G:\Module B11 - L'essentiel … savoir.doc
[14/09/2008 14:24|--a------|382976] - G:\Module+B11+-+Fonction+et+connaissance+de+l'entreprise+(R‚sum‚+Total).doc
[23/09/2008 09:33|--a------|22621] - G:\B11.odt
[11/01/2009 12:52|--a------|170820] - G:\img003.jpg
[24/03/2009 23:04|--a------|747008] - H:\FSSS.doc
[17/03/2009 19:45|--a------|855014] - H:\SNV10007.JPG
[11/02/2009 19:33|--a------|37497] - H:\Identite.jpg
[29/04/2009 16:56|--a------|732121] - H:\P5Q-ASUS-2002.zip
[29/04/2009 17:05|--a------|1556] - H:\BOOTEX.LOG
[17/03/2009 19:45|--a------|840026] - H:\SNV10008.JPG
[23/03/2009 17:10|--a------|966144] - H:\Rapport.doc
[24/03/2009 12:33|--a------|22528] - H:\index rapport.doc
[24/03/2009 14:48|--a------|979968] - H:\RapportFinal.doc
[30/05/2009 14:51|--a------|1822876] - H:\photofiltre_photofiltre_6.3.2_francais_10731.exe
[13/03/2009 15:12|--a------|1048576] - H:\P5Q-ASUS-2002.ROM
[27/01/2008 02:32|--a------|719599616] - H:\Napoleon Dynamite - 1h29.avi
[31/03/2009 19:24|--a------|345315] - H:\NORDNET%20SA%20-%20Faire%20son%20stage%20chez%20NordNet%20-%20Hem%20(59)%20-%2029.02.08.pdf
[23/04/2009 18:57|--a------|10067519] - H:\Alice Cooper - Poison.flv
[13/05/2009 23:09|--a------|1063] - H:\trishell.cbp
[12/05/2009 16:40|--a------|849] - H:\File1.txt
[12/05/2009 16:50|--a------|1199] - H:\File2.txt
[14/05/2009 15:45|--a------|21531] - H:\RenewableEnergy.odt
[15/05/2009 16:05|--a------|715] - H:\shell.c
[12/05/2009 21:48|--a------|9328] - H:\projet_malloc.c
[15/05/2009 15:52|--a------|515] - H:\shell.c~
[25/12/2008 22:02|--a------|183296] - H:\KABAKDJIAN Massis 01.doc
[11/05/2009 20:40|--a------|8625] - H:\projetnux.c
[18/05/2009 16:30|--a------|700] - H:\tri_insertion.txt
[18/05/2009 16:31|--a------|752] - H:\tri_insertion2.txt
[19/05/2009 18:00|--a------|203] - H:\Tests.txt
[19/05/2009 18:14|--a------|84992] - H:\rapport B23.doc
[19/05/2009 18:18|--a------|5006] - H:\Projet B23 Chauffert-Yvart_Borenstein.zip
[13/01/2009 22:50|--a------|75264] - H:\CV Rayborenstein(2).doc
[26/05/2009 20:52|--a------|513538] - H:\garantie001.pdf
[30/05/2009 14:51|--a------|155513] - H:\FSSS.doc .exe
[30/05/2009 14:51|--a------|155283] - H:\Rapport.doc .exe
[20/02/2009 10:33|--a------|389632] - H:\Rapport de stage.doc
[22/02/2009 21:20|--a------|24576] - H:\config.xls
[05/03/2009 14:26|--a------|30720] - H:\Config.doc
[30/05/2009 14:51|--a------|155353] - H:\Config.doc .exe
[30/05/2009 14:51|--a------|155673] - H:\index rapport.doc .exe
[30/05/2009 14:51|--a------|155503] - H:\RapportFinal.doc .exe
[30/05/2009 14:51|--a------|155643] - H:\KABAKDJIAN Massis 01.doc .exe
[30/05/2009 14:51|--a------|156153] - H:\rapport B23.doc .exe
[30/05/2009 14:51|--a------|155483] - H:\CV Rayborenstein(2).doc .exe
[30/05/2009 14:51|--a------|155783] - H:\Rapport de stage.doc .exe

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# G:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# H:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

################## [ Informations # Fichier Suspect ]


Suspect ! G:\Module B11 - L'essentiel … savoir.doc .exe
Suspect ! G:\Module+B11+-+Fonction+et+connaissance+de+l'entreprise+(R‚sum‚+Total).doc .exe
Suspect ! H:\FSSS.doc .exe
Suspect ! H:\Rapport.doc .exe
Suspect ! H:\Config.doc .exe
Suspect ! H:\index rapport.doc .exe
Suspect ! H:\RapportFinal.doc .exe
Suspect ! H:\KABAKDJIAN Massis 01.doc .exe
Suspect ! H:\rapport B23.doc .exe
Suspect ! H:\CV Rayborenstein(2).doc .exe
Suspect ! H:\Rapport de stage.doc .exe

################## [ Cracks # Keygens # Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.026 ! ]

Voila le rapport ... par contre j'ai l'impression qu'il y a un peu trop de "not found" et de "failed" pour que ça soit positif :S


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder G:\Module B11 - L'essentiel … savoir.doc .exe not found.
File/Folder G:\Module+B11+-+Fonction+et+connaissance+de+l'entreprise+(R‚sum‚+Total).doc .exe not found.
File/Folder H:\FSSS.doc .exe not found.
File/Folder H:\Rapport.doc .exe not found.
File/Folder H:\Config.doc .exe not found.
File/Folder H:\index rapport.doc .exe not found.
File/Folder H:\RapportFinal.doc .exe not found.
File/Folder H:\KABAKDJIAN Massis 01.doc .exe not found.
File/Folder H:\rapport B23.doc .exe not found.
File/Folder H:\CV Rayborenstein(2).doc .exe not found.
File/Folder H:\Rapport de stage.doc .exe not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Gourson\LOCALS~1\Temp\etilqs_jatxhVNWncykGxbc1VUe scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Gourson\LOCALS~1\Temp\etilqs_kekFde1gSttQxde4cD1Z scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Gourson\LOCALS~1\Temp\etilqs_kekFde1gSttQxde4cD1Z-journal scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_490.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\OfflineCache\index.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTM by OldTimer - Version 2.1.0.0 log created on 05302009_151944

Files moved on Reboot...
File C:\DOCUME~1\Gourson\LOCALS~1\Temp\etilqs_jatxhVNWncykGxbc1VUe not found!
File C:\DOCUME~1\Gourson\LOCALS~1\Temp\etilqs_kekFde1gSttQxde4cD1Z not found!
File C:\DOCUME~1\Gourson\LOCALS~1\Temp\etilqs_kekFde1gSttQxde4cD1Z-journal not found!
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
File C:\WINDOWS\temp\Perflib_Perfdata_490.dat not found!
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\OfflineCache\index.sqlite moved successfully.
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Gourson\Local Settings\Application Data\Mozilla\Firefox\Profiles\7wz54t6t.default\XUL.mfl moved successfully.

Registry entries deleted on Reboot...

J'ai lancé ComboFix, et ai accepté l'installation de la console de récupération Windows.
Le message "Connexion à http://download.microsoft.com . . ." est apparu,
puis "#################################### 100,0%".

C'est à ce moment la qu'une fenetre d'erreur m'indiquant qu'un fichier incorrect avait été trouvé, et m'a proposé de fermer ou d'ignorer. J'ai ignoré les trois fenetres qui sont apparues de cette manière, et maintenant la console ne semble plus avancer : un petit trait blanc apparait un peu partout aléatoirement dans la console, et il est écrit : "Nom de commande ou fichier incorrect".

Que faire ?

J'ai téléchargé et lancé la console dont tu m'as donné le lien, mais il semblait y avoir des problèmes, et de plus elle m'a demandé la taille à allouer pour les fichiers, ce à quoi je n'ai rien répondu, et je l'ai fermé.
J'ai ensuite lancé ComboFix, qui m'a indiqué que Tazebama avait essayé de se lier avec ComboFix.
ComboFix n'a ensuite pas trouvé la console donc j'ai ignoré, et lancé la recherche.
Apres quelques messages d'erreurs en tout genre, ComboFix a fait reboot le PC, mais sans laisser de rapport ...

En tout cas, n'utilise pas tes disques amovibles sur un autre PC car ils contiennent des fichiers infectés. Une personne que j'ai essayé de dépanner la dernière fois avait infecté trois PC avec Mabezat/Tabezama et il a fallu qu'il formate et réinstalle Windows sur les trois PC...

Essaie cet utilitaire :
http://www.avg.com/virus-removal.ndi-93495

Non, télécharge rmmabez et exécute-le, il va analyser et va essayer de désinfecter.

Retélécharge ComboFix et réessaie de l'exécuter.

Ça ne sent pas bon.

• Télécharge Dr.Web CureIt! sur ton Bureau.
• Double-clique sur drweb-cureit.exe et clique sur Commencer le scan.
• Ce scan rapide permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, clique sur le bouton Oui pour Tout à l'invite.
• Lorsque le scan rapide est terminé, clique sur Options > Changer la configuration.
• Choisis l'onglet Scanner, et décoche Analyse heuristique.
• De retour à la fenêtre principale : choisis Analyse complète.
• Clique la flèche verte sur la droite et le scan débutera. Une publicité apparaît quelquefois, ferme-la.
• Clique Oui pour Tout si un fichier est détecté.
• A la fin du scan, si des infections sont trouvées, clique sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, clique sur Quarantaine.
• Au menu principal de l'outil, en haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport.
• Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv.
• Ferme Dr.Web CureIt!
• Redémarre ton ordinateur (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.
• Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.

NB : Dr.Web en version gratuite est un scanner à la demande et n'entre pas en conflit avec ton antivirus résident.

Fais le scan en mode sans échec.

Pour redémarrer en mode sans échec :

• Redémarre ton PC.
• Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
• Dans le menu d'options avancées, choisis Mode sans échec.
• Choisis ta session.

Bon j'ai essayé en mode sans échec ... le problème est que le programme me sort que l'archive est corrompu et quitte, donc pas de possibilité de scan.

Aucune idée, je lance le drweb-cureit.exe et il me sort qu'il faut décompresser à un endroit, mais que l'archive est corrompu =/

Pas encore ... je vais reessayer plus tard, et je re-testerai en mode sans échec.

Essaie de le supprimer avec Unlocker :
http://ccollomb.free.fr/unlocker/unlocker1.8.7.exe

Juste pour info, j'ai examiné le dossier ... il contient 1200 fichiers et dossiers qui pèsent environ 1 Go chacuns, ainsi que 600 fichiers et dossiers cachés

Oui voilà : G:\Jeux\Commandos
Ca aurait un rapport avec l'infection ?

Ben c'est le nom d'un jeu que j'ai installé il y a quelques mois ... mais à la base il pesait que quelques centaines de Mo ...

Oui, c'est possible.

Bon, j'ai abandonné l'idée pour mon portable, il reste plus que le formattage.
Par contre je viens de lancer UsbFix sur mon autre pc, qui contenait quelques fichiers corrompus, et voici le rapport :


############################## [ UsbFix V3.032 ]

# User : Raymouf (Administrateurs) # MOUF
# Update on 15/06/09 by Chiquitine29
# Start at: 17:57:42 | 18/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

# Processeur Intel Pentium III Xeon
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Disabled
# AV : avast! antivirus 4.8.1335 [VPS 090427-0] 4.8.1335 [ Enabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 127,99 Go (100,14 Go free) # NTFS
# D:\ # Disque CD-ROM
# G:\ # Disque fixe local # 468,18 Go (410,12 Go free) # NTFS

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\logonui.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\ASWLSVC.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\ASWL2K.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

Supprimé ! HKCU\...\Explorer\MountPoints2\{a89bec04-0dba-11de-bc72-0022153fafdc}\Shell\AutoRun\Command

################## [ Listing des fichiers présent ]

[18/06/2009 17:56|--a------|170] - C:\ASWL2K.ini
[08/03/2009 21:52|--a------|0] - C:\AUTOEXEC.BAT
[01/05/2009 15:18|--ahs----|212] - C:\boot.ini
[28/08/2001 14:00|-rahs----|4952] - C:\Bootfont.bin
[08/03/2009 21:52|--a------|0] - C:\CONFIG.SYS
[?|?|?] - C:\hiberfil.sys
[08/03/2009 21:52|-rahs----|0] - C:\IO.SYS
[08/03/2009 21:52|-rahs----|0] - C:\MSDOS.SYS
[10/03/2009 21:38|-rahs----|47564] - C:\NTDETECT.COM
[10/03/2009 21:52|-rahs----|252240] - C:\ntldr
[29/02/2004 17:44|--a------|52576] - C:\orange.bmp
[?|?|?] - C:\pagefile.sys
[18/06/2009 17:58|--a------|2881] - C:\UsbFix.txt

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# G:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

################## [ ! Fin du rapport # UsbFix V3.032 ! ]



Il a l'air sain, non ?

Non, je le fais de suite.

Pourquoi pas.

Pourquoi dis-tu qu'il est infecté ?

Vu le nombre de fichiers infectés, ça m'étonnerait que tu puisses désinfecter de manière sûre et définitive à part si tu formates.