[Résolu] Programme au démarage

Bonjour , alors voici mon pb , ayant été récemment infecté par un keylogger , je me soucis maintenant un peu plus de la sécurité de mon ptit pc

Je pense avoir virer ce keylogger grâce aux mises a jours de mon antivirus + ccleaner mais
cela dit je trouve bcp de processus que je connais pas dans mon gestionnaire de tache ( certain en double voir plus )

je me demandais donc si on ne pouvais pas virer certain processus ? ou si même certain n'étais pas des virus ?


Voici le rapport hijackthis au cas ou



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40, on 14/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\EXPERTool ATI\TBPanel.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Gainward] C:\Program Files\EXPERTool ATI\TBPanel.exe /A
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: kohmtg.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: SarkoService (SarkophageService) - Unknown owner - C:\WINDOWS\system32\srksrv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 7936 bytes



Je suis sous windows Xp sp3
Pentium 4 D 3Ghz
2 go de ram

dsl si je ne suis pas dans la bonne rubrique , j'ai regarder et elle me paraissais la plus adapté a mon pb :s

############################## [ UsbFix V3.031 ]

# User : Administrateur (Administrateurs) # URANIUMOFCOURSE
# Update on 13/06/09 by Chiquitine29
# Start at: 11:24:25 | 14/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (3,87 Go free) # NTFS
# D:\ # Disque CD-ROM # 529,4 Mo (0 Mo free) [ZT2ZCD1] # CDFS
# E:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\EXPERTool ATI\TBPanel.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre Startup ]

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="http://www.google.com/"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Administrateur"
HKLM_logon: "AltDefaultUserName"="Administrateur"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: SoundMAXPnP=C:\Program Files\Analog Devices\Core\smax4pnp.exe
HKLM_Run: WinampAgent="C:\Program Files\Winamp\winampa.exe"
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM_Run: StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKLM_Run: ArcSoft Connection Service=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
HKLM_Run: avgnt="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM_Run: LFAgent=
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
HKCU_Run: Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
HKCU_Run: RGSC=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKCU_Run: Gainward=C:\Program Files\EXPERTool ATI\TBPanel.exe /A
HKCU_Run: AlcoholAutomount="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
HKCU_Run: Steam="C:\Program Files\Valve\Steam\Steam.exe" -silent
HKCU_Run: cdoosoft=C:\WINDOWS\system32\olhrwef.exe

################## [ Fichiers # Dossiers infectieux ]

Présent ! C:\WINDOWS\system32\nmdfgds0.dll
Présent ! C:\WINDOWS\system32\nmdfgds1.dll
C:\autorun.inf # -> fichier appelé : "C:\q9.cmd" ( Absent ! )
Présent ! C:\autorun.inf
Présent ! D:\install.exe
Présent ! D:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Présent ! HKU\S-1-5-21-1454471165-287218729-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Présent ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )
Présent ! HKLM\software\microsoft\security center "FirewallOverride" ( 0x1 )
Présent ! HKLM\software\microsoft\security center "UpdatesDisableNotify" ( 0x1 )

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{6f129482-d210-11dd-bb51-806d6172696f}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{75494675-dc14-11dd-bb5a-001bfc775f59}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ae85bee5-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ae85bee6-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d8f0939e-995f-11dd-92b1-001bfc775f59}\Shell\AutoRun\Command

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

voila

Voici le rapport




############################## [ UsbFix V3.031 ]

# User : Administrateur (Administrateurs) # URANIUMOFCOURSE
# Update on 13/06/09 by Chiquitine29
# Start at: 13:40:14 | 14/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (3,89 Go free) # NTFS
# D:\ # Disque CD-ROM # 529,4 Mo (0 Mo free) [ZT2ZCD1] # CDFS
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 124 Mo (37,54 Mo free) [FLASHDISK] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Supprimé ! C:\WINDOWS\system32\nmdfgds0.dll
Supprimé ! C:\WINDOWS\system32\nmdfgds1.dll
C:\autorun.inf # -> fichier appelé : "C:\q9.cmd" ( absent ! )
Supprimé ! C:\autorun.inf
(!) Non supprimé ! D:\install.exe
(!) Non supprimé ! D:\autorun.inf
Supprimé ! F:\Recycled\ctfmon.exe
Supprimé ! F:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

Supprimé ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
# HKLM\software\microsoft\security center "AntiVirusOverride" # -> Reset sucessfully !
# HKLM\software\microsoft\security center "FirewallOverride" # -> Reset sucessfully !
# HKLM\software\microsoft\security center "UpdatesDisableNotify" # -> Reset sucessfully !

################## [ Registre # Mountpoints2 ]

Supprimé ! HKCU\...\Explorer\MountPoints2\{6f129482-d210-11dd-bb51-806d6172696f}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{75494675-dc14-11dd-bb5a-001bfc775f59}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{ae85bee5-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{ae85bee6-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{d8f0939e-995f-11dd-92b1-001bfc775f59}\Shell\AutoRun\Command

################## [ Listing des fichiers présent ]

[30/09/2008 18:57|--a------|0] - C:\AUTOEXEC.BAT
[21/01/2009 07:38|-rahs----|282] - C:\boot.ini
[24/08/2001 19:00|-rahs----|4952] - C:\Bootfont.bin
[30/09/2008 18:57|--a------|0] - C:\CONFIG.SYS
[30/09/2008 18:57|-rahs----|0] - C:\IO.SYS
[24/05/2009 03:16|--a------|5996453] - C:\log_fs.log
[30/09/2008 18:57|-rahs----|0] - C:\MSDOS.SYS
[04/08/2004 03:38|-rahs----|47564] - C:\NTDETECT.COM
[26/12/2008 11:11|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[31/05/2009 10:48|--ah-----|268] - C:\sqmdata00.sqm
[02/06/2009 21:58|--ah-----|268] - C:\sqmdata01.sqm
[31/05/2009 10:48|--ah-----|244] - C:\sqmnoopt00.sqm
[02/06/2009 21:58|--ah-----|244] - C:\sqmnoopt01.sqm
[14/06/2009 13:42|--a------|4196] - C:\UsbFix.txt
[21/09/2006 06:10|-r-------|1945600] - D:\00001.tmp
[21/09/2006 06:10|-r-------|46291] - D:\00002.tmp
[21/09/2006 06:10|-r-------|6419] - D:\0x040c.ini
[21/09/2006 06:10|-r-------|156] - D:\Autorun.inf
[21/09/2006 06:10|-r-------|4553324] - D:\BF_Intro.bik
[21/09/2006 06:10|-r-------|75253166] - D:\D1_Com~1.cab
[21/09/2006 06:10|-r-------|80656] - D:\Eula.dll
[21/09/2006 06:10|-r-------|982016] - D:\ISScript11.Msi
[21/09/2006 06:10|-r-------|12806952] - D:\MSGSLogo.bik
[21/09/2006 06:10|-r-------|23304] - D:\PidGen.dll
[21/09/2006 06:10|-r-h-----|4000] - D:\SSIFSDAT.SYS
[21/09/2006 06:10|-r-------|2195] - D:\Setup.ini
[21/09/2006 06:10|-r-------|8375056] - D:\SetupENU.dll
[21/09/2006 06:10|-r-------|60176] - D:\SetupENU3.dll
[21/09/2006 06:10|-r-------|88888] - D:\Splash.EXE
[21/09/2006 06:10|-r-------|921656] - D:\SplashImage.bmp
[21/09/2006 06:10|-r-------|2584848] - D:\WindowsInstaller-KB893803-x86.exe
[21/09/2006 06:10|-r-------|113464] - D:\ZT2PID.dll
[21/09/2006 06:10|-r-------|1195520] - D:\Zoo Tycoon 2 - Zookeeper Collection.msi
[21/09/2006 06:10|-r-------|1026832] - D:\autorun.exe
[21/09/2006 06:10|-r-------|306758] - D:\cluf.rtf
[21/09/2006 06:10|-r-------|260880] - D:\install.exe
[21/09/2006 06:10|-r-------|1708856] - D:\instmsia.exe
[21/09/2006 06:10|-r-------|1822520] - D:\instmsiw.exe
[21/09/2006 06:10|-r-------|316887] - D:\lisezmoi.rtf
[21/09/2006 06:10|-r-------|387087] - D:\setup.isn
[21/09/2006 06:10|-r-------|28097] - D:\setupInc.idx
[21/09/2006 06:10|-r-------|2686232] - D:\vcredist_x86.exe
[21/09/2006 06:10|-r-------|645] - D:\zt2.mcl
[21/09/2006 06:10|-r-------|115495] - D:\zt2.png
[21/09/2006 06:10|-r-------|735] - D:\zt2.xml
[21/09/2006 06:10|-r-------|742] - D:\zt264.xml
[21/09/2006 06:10|-r-------|42384168] - D:\zt2intro.bik

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# F:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

Voici le premier Info.txt


info.txt logfile of random's system information tool 1.06 2009-06-14 20:21:48

======Uninstall list======

-->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
AIDA32 v3.93-->"C:\Program Files\AIDA32 - Personal System Information\unins000.exe"
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x3854
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManger\unins000.exe"
AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
AxCrypt (Désinstaller uniquement)-->"C:\Program Files\Axon Data\AxCrypt\AxCryptU.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Counter-Strike(TM)-->MsiExec.exe /I{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}
EXPERTool ATI 4.1-->"C:\Program Files\EXPERTool ATI\unins000.exe"
FreeUndelete-->C:\Program Files\FreeUndelete\GLF348.exe /handle:fru
Half-Life 2: Deathmatch-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/320
Half-Life 2: Episode One-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/420
Half-Life 2: Lost Coast-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/340
Half-Life 2-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/220
Half-Life: Blue Shift-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/130
Hamachi 1.0.2.5-->C:\Program Files\Hamachi\uninstall.exe
High Definition Audio Driver Package - KB888111-->C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe" /uninstall
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
JkDefrag 3.36-->"C:\Program Files\JkDefrag\unins000.exe"
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Lock Folder XP 3.6-->"C:\Program Files\Everstrike Software\Lock Folder XP 3.6\Uninstall.exe" "C:\Program Files\Fichiers communs\Everstrike Software\Lock Folder XP 3.6\install.log"
Ma-Config.com-->MsiExec.exe /X{560BD6E0-0BA6-43AF-B423-E1DF4D2EB3C3}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaConverter 2.5 for Philips-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8D8B167A-ED0F-43F1-AC10-3F4379F7CBBB}\Setup.exe" -l0x40c
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Module linguistique Microsoft .NET Framework 3.5 - fra-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 9 Trial-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="8M01-249K-1T0E-3A1A-C7AA-MUZ3-8EL4-2U9W"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OpenOffice.org 3.0-->MsiExec.exe /I{F44DA61E-720D-4E79-871F-F6E628B33242}
Opposing Force-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/50
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Radio net FR-->C:\WINDOWS\iun6002.exe "C:\Program Files\Radio net FR\irunin.ini"
Rockstar Games Social Club-->"C:\Program Files\InstallShield Installation Information\{08B3869E-D282-424C-9AFC-870E04A4BA14}\setup.exe" -runfromtemp -l0x040c -removeonly
SA52xx Device Manager-->C:\Program Files\InstallShield Installation Information\{6294CE03-1A16-4610-891E-FDAF9A585A54}\setup.exe -runfromtemp -l0x040c -removeonly
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SLD Codec Pack-->C:\Program Files\SLD Codec Pack\uninstall.exe
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
UsbFix-->C:\UsbFix\Uninstal.exe
Videora iPod Converter 4.07-->C:\Program Files\Red Kawa\Video Converter App\uninstaller.exe
VLC media player 0.9.4-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VNC Free Edition 4.1.3-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
World of Warcraft-->C:\Program Files\Fichiers communs\Blizzard Entertainment\World of Warcraft\Uninstall.exe
Wow Cartographe 1.09-->C:\Program Files\WowCartographe\uninst.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
YouTube Downloader App 1.02-->C:\Program Files\Regensoft\Downloader App\uninstaller.exe
Zoo Tycoon 2 - Zookeeper Collection-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{238DCFCD-70B3-46B2-B90B-2CDCC69A3D03}

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: EICHIZEN
Event Code: 2505
Message: Le serveur n'a pas pu se lier au transport \Device\NetBT_Tcpip_{8D8D7CD1-D326-4AE2-BC55-4B0F396A414C} car un autre ordinateur du réseau porte le même nom. Le serveur n'a pas pu démarrer.

Record Number: 5
Source Name: Server
Time Written: 20090606125644.000000+120
Event Type: erreur
User:

Computer Name: EICHIZEN
Event Code: 2505
Message: Le serveur n'a pas pu se lier au transport \Device\NetBT_Tcpip_{C5BE27E6-955C-486E-A229-CCBB02810ABA} car un autre ordinateur du réseau porte le même nom. Le serveur n'a pas pu démarrer.

Record Number: 4
Source Name: Server
Time Written: 20090606125644.000000+120
Event Type: erreur
User:

Computer Name: EICHIZEN
Event Code: 26
Message: Application popup : Windows - Erreur système : Il existe un nom en double sur le réseau.

Record Number: 3
Source Name: Application Popup
Time Written: 20090606125637.000000+120
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090606125634.000000+120
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090606125634.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: EICHIZEN
Event Code: 101
Message: MsnMsgr (468) Le moteur de base de données est arrêté.

Record Number: 170
Source Name: ESENT
Time Written: 20090209184705.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 103
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 169
Source Name: ESENT
Time Written: 20090209184705.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 302
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données a exécuté la procédure de récupération avec succès.

Record Number: 168
Source Name: ESENT
Time Written: 20090209180044.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 301
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\fsr.log.

Record Number: 167
Source Name: ESENT
Time Written: 20090209180043.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 300
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données initialise la procédure de récupération.

Record Number: 166
Source Name: ESENT
Time Written: 20090209180042.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\Fichiers communs\ArcSoft\Bin;%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"RGSCLauncher"=C:\Program Files\Rockstar Games\Rockstar Games Social Club
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_0_0_0
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip




Et le Deuxieme Log.txt



Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-14 20:21:36
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 4 GB (5%) free of 76 GB
Total RAM: 2047 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21, on 14/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Gainward] C:\Program Files\EXPERTool ATI\TBPanel.exe /A
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: kohmtg.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: SarkoService (SarkophageService) - Unknown owner - C:\WINDOWS\system32\srksrv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 7204 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11222041-111B-46E3-BD29-EFB2449479B1}]
IEPlugin Class - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL [2008-05-26 170496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-12-18 868352]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-04-01 36352]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-03-04 61440]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"ArcSoft Connection Service"=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe [2008-04-17 98616]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"LFAgent"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-11-18 21633320]
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2009-03-28 306088]
"Gainward"=C:\Program Files\EXPERTool ATI\TBPanel.exe [2008-09-05 2300456]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2008-02-22 217544]
"Steam"=C:\Program Files\Valve\Steam\Steam.exe [2009-06-11 1217784]

C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="kohmtg.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-03-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSMHelp"=1
"MemCheckBoxInRunDlg"=1
"NoSMBalloonTip"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"NoAutoUpdate"=1
"ClearDocsOnExit"=64
"NoDrives"=0
"NoDriveTypeAutoRun"=145
"NoDriveAutoRun"=FFFFFFFF
"NoFind"=0
"NoFolderOptions"=0
"NoRun"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 1 months======

2009-06-14 20:21:36 ----D---- C:\rsit
2009-06-14 13:42:35 ----RASHD---- C:\autorun.inf
2009-06-14 13:39:44 ----A---- C:\UsbFix.txt
2009-06-14 11:23:33 ----D---- C:\UsbFix
2009-06-13 20:49:00 ----D---- C:\Documents and Settings\Administrateur\Application Data\Microsoft Games
2009-06-13 20:48:34 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Games
2009-06-13 20:42:43 ----D---- C:\Program Files\Microsoft Games
2009-06-06 07:42:36 ----D---- C:\Program Files\Fichiers communs\Everstrike Software
2009-06-06 07:42:36 ----D---- C:\Program Files\Everstrike Software
2009-06-06 07:35:15 ----D---- C:\Program Files\Sarkophage
2009-06-06 07:35:15 ----A---- C:\WINDOWS\system32\srksrv.exe
2009-06-06 07:23:36 ----D---- C:\Program Files\Axon Data
2009-06-02 21:25:40 ----D---- C:\Program Files\Avira
2009-06-02 21:25:40 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-05-24 03:15:25 ----D---- C:\Program Files\FreeUndelete
2009-05-24 03:15:25 ----D---- C:\Documents and Settings\All Users\Application Data\OfficeRecovery
2009-05-21 21:24:04 ----D---- C:\Documents and Settings\Administrateur\Application Data\ArcSoft
2009-05-21 21:24:01 ----D---- C:\Documents and Settings\Administrateur\Application Data\AVS4YOU
2009-05-21 21:23:54 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2009-05-21 21:23:24 ----D---- C:\Documents and Settings\All Users\Application Data\ArcSoft
2009-05-21 21:23:21 ----RA---- C:\WINDOWS\system32\msvcp71.dll
2009-05-21 21:23:21 ----D---- C:\Program Files\ArcSoft
2009-05-21 21:23:21 ----A---- C:\WINDOWS\system32\unicows.dll
2009-05-21 21:23:20 ----D---- C:\Program Files\Fichiers communs\ArcSoft
2009-05-21 21:22:55 ----D---- C:\Program Files\Fichiers communs\AVSMedia
2009-05-21 21:22:51 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-05-21 21:22:49 ----D---- C:\Program Files\AVS4YOU
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msxml3a.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-05-21 21:22:12 ----D---- C:\Program Files\Philips
2009-05-21 21:21:04 ----D---- C:\Documents and Settings\Administrateur\Application Data\InstallShield
2009-05-21 18:28:33 ----D---- C:\Documents and Settings\Administrateur\Application Data\Red Kawa
2009-05-21 18:28:19 ----D---- C:\Program Files\Regensoft
2009-05-21 18:28:13 ----D---- C:\Program Files\Red Kawa

======List of files/folders modified in the last 1 months======

2009-06-14 16:06:35 ----D---- C:\Program Files\Mozilla Firefox
2009-06-14 13:43:22 ----SHD---- C:\RECYCLER
2009-06-14 13:43:22 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-14 13:42:42 ----D---- C:\WINDOWS
2009-06-14 13:42:36 ----D---- C:\WINDOWS\temp
2009-06-14 13:42:36 ----D---- C:\WINDOWS\Prefetch
2009-06-14 13:41:08 ----D---- C:\WINDOWS\system32
2009-06-14 13:40:15 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-14 13:38:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-14 13:31:21 ----D---- C:\Documents and Settings\Administrateur\Application Data\Skype
2009-06-14 10:56:35 ----D---- C:\Documents and Settings\Administrateur\Application Data\Hamachi
2009-06-14 10:31:40 ----D---- C:\Documents and Settings\Administrateur\Application Data\skypePM
2009-06-13 20:48:34 ----D---- C:\WINDOWS\system32\DirectX
2009-06-13 20:47:52 ----SHD---- C:\WINDOWS\Installer
2009-06-13 20:42:43 ----D---- C:\Program Files
2009-06-13 20:41:45 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-06-12 23:35:38 ----D---- C:\WINDOWS\system32\config
2009-06-06 07:42:36 ----D---- C:\Program Files\Fichiers communs
2009-06-06 07:33:16 ----SHD---- C:\System Volume Information
2009-06-05 14:35:00 ----HD---- C:\WINDOWS\inf
2009-06-04 19:34:20 ----D---- C:\Program Files\World of Warcraft
2009-06-02 21:55:37 ----RSHD---- C:\Recycled
2009-06-02 21:25:51 ----D---- C:\WINDOWS\system32\drivers
2009-06-02 21:25:16 ----D---- C:\WINDOWS\WinSxS
2009-06-02 17:46:33 ----D---- C:\WINDOWS\system32\DllCache
2009-05-31 22:02:32 ----D---- C:\Program Files\JkDefrag
2009-05-29 22:16:49 ----D---- C:\Documents and Settings\Administrateur\Application Data\teamspeak2
2009-05-21 21:23:19 ----HD---- C:\Program Files\InstallShield Installation Information
2009-05-21 18:28:18 ----D---- C:\Program Files\AviSynth 2.5

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 LF30FS;LF30FS; \??\C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-03-04 3565568]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-10-31 93184]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-10-04 25280]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-24 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
R3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 a5ptatse;a5ptatse; C:\WINDOWS\system32\drivers\a5ptatse.sys []
S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe [2008-04-17 102712]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-03-04 602112]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2008-11-25 935208]
R2 SarkophageService;SarkoService; C:\WINDOWS\system32\srksrv.exe [2006-05-07 453632]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-03-03 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-03-15 216232]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------



Voila les deux log

Voici le rapport d'analyse



Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2283
Windows 5.1.2600 Service Pack 3

15/06/2009 18:08:00
mbam-log-2009-06-15 (18-08-00).txt

Type de recherche: Examen rapide
Eléments examinés: 79723
Temps écoulé: 3 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d97fc677-694d-4a75-ac89-a5b85c2bcfed} (Adware.BullseyeToolbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6226ba26-c017-4007-928c-de9715c6fa67} (Adware.BullseyeToolbar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\windows\system32\zmtag.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ovfsthbenbntdkosdoblwxirkxohnhgfemxced.dat (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ovfsthnlrnavrvgwkxpruwsstnfagskyfqcvsb.dat (Trojan.Agent) -> Quarantined and deleted successfully.

voila


ComboFix 09-06-14.02 - Administrateur 15/06/2009 20:18.8 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1407 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycled\Recycled
c:\windows\system32\Drivers\jcyyetf.sys
c:\windows\system32\add7_g.dll
c:\windows\system32\drivers\jcyyetf.sys

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_AVPsys
-------\Service_drgsn


((((((((((((((((((((((((((((( Fichiers créés du 2009-05-15 au 2009-06-15 ))))))))))))))))))))))))))))))))))))
.

2009-06-15 16:10 . 2009-06-15 16:13 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2009-06-15 16:03 . 2009-06-15 16:03 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-14 18:21 . 2009-06-14 18:21 -------- d-----w- C:\rsit
2009-06-14 09:23 . 2009-06-14 11:43 -------- d-----w- C:\UsbFix
2009-06-13 18:49 . 2009-06-13 18:49 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Microsoft Games
2009-06-13 18:48 . 2009-06-13 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Games
2009-06-13 18:42 . 2009-06-13 18:42 -------- d-----w- c:\program files\Microsoft Games
2009-06-06 05:42 . 2009-06-06 05:42 -------- d-----w- c:\program files\Fichiers communs\Everstrike Software
2009-06-06 05:42 . 2009-06-06 05:42 -------- d-----w- c:\program files\Everstrike Software
2009-06-06 05:35 . 2009-06-06 05:38 -------- d-----w- c:\program files\Sarkophage
2009-06-06 05:35 . 2006-05-07 18:18 453632 ----a-w- c:\windows\system32\srksrv.exe
2009-06-06 05:23 . 2009-06-06 05:23 -------- d-----w- c:\program files\Axon Data
2009-06-02 19:25 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-02 19:25 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-02 19:25 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-02 19:25 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\program files\Avira
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-27 19:38 . 2009-05-27 19:38 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-05-24 01:15 . 2009-05-24 01:15 -------- d-----w- c:\program files\FreeUndelete
2009-05-24 01:15 . 2009-05-24 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\OfficeRecovery
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\ArcSoft
2009-05-21 19:23 . 2005-04-27 14:36 245408 ----a-w- c:\windows\system32\unicows.dll
2009-05-21 19:23 . 2003-03-18 20:14 499712 ----a-r- c:\windows\system32\msvcp71.dll
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\ArcSoft
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\AVS4YOU
2009-05-21 19:22 . 2009-01-28 18:49 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-05-21 19:22 . 2009-01-28 18:49 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-05-21 19:22 . 2009-01-28 18:49 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-21 19:22 . 2009-01-28 18:49 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-05-21 19:22 . 2009-05-21 19:22 -------- d-----w- c:\program files\Philips
2009-05-21 19:21 . 2009-05-21 19:21 -------- d-----w- c:\documents and settings\Administrateur\Application Data\InstallShield
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Red Kawa
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\program files\Regensoft
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\program files\Red Kawa

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-15 18:23 . 2008-11-25 17:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Skype
2009-06-15 18:23 . 2008-10-04 13:54 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Hamachi
2009-06-15 18:20 . 2009-03-27 05:43 480776 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-15 16:03 . 2008-10-09 16:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-15 15:59 . 2008-11-25 17:37 -------- d-----w- c:\documents and settings\Administrateur\Application Data\skypePM
2009-06-13 18:41 . 2008-10-03 21:35 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-06-04 17:34 . 2008-10-04 13:58 -------- d-----w- c:\program files\World of Warcraft
2009-05-31 20:02 . 2008-12-18 23:23 -------- d-----w- c:\program files\JkDefrag
2009-05-29 20:16 . 2008-10-18 11:26 -------- d-----w- c:\documents and settings\Administrateur\Application Data\teamspeak2
2009-05-26 11:20 . 2008-10-09 16:30 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2008-10-09 16:30 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-21 19:23 . 2008-10-03 21:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-21 16:28 . 2008-11-17 17:11 -------- d-----w- c:\program files\AviSynth 2.5
2009-05-12 18:06 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iTunes
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iPod
2009-05-12 17:31 . 2009-05-12 17:30 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\Bonjour
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\Apple Software Update
2009-05-12 17:30 . 2009-05-12 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-05-03 03:15 . 2008-10-04 17:34 71392 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-02 08:05 . 2008-10-06 04:39 -------- d-----w- c:\program files\MSBuild
2009-05-02 08:04 . 2008-10-05 13:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-01 13:17 . 2009-03-28 16:17 -------- d-----w- c:\program files\Rockstar Games
2009-04-26 15:53 . 2009-04-26 15:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Nero
2009-04-26 15:16 . 2009-04-26 15:16 -------- d-----w- c:\program files\AskTBar
2009-04-26 15:16 . 2009-04-26 14:59 -------- d-----w- c:\program files\Nero
2009-04-26 15:14 . 2009-04-26 15:14 -------- d-----w- c:\program files\Windows Sidebar
2009-04-26 15:08 . 2009-04-26 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-04-26 15:04 . 2009-04-26 14:58 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-04-26 14:58 . 2008-10-25 22:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\dvdcss
2009-04-26 14:51 . 2008-10-05 12:01 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-04-21 13:39 . 2009-05-02 07:42 2449344 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\maconfsetup.exe
2009-04-21 13:38 . 2009-05-02 07:42 429224 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
2009-04-18 19:02 . 2009-04-18 19:02 -------- d-----w- c:\program files\CCleaner
2009-04-17 14:37 . 2008-10-05 12:00 -------- d-----w- c:\program files\Java
2009-04-17 14:37 . 2009-04-17 14:37 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 06:30 . 2009-04-17 06:29 -------- d-----w- c:\program files\QuickTime
2009-04-17 06:29 . 2009-04-17 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-11 11:17 . 2001-08-24 17:00 81884 ----a-w- c:\windows\system32\perfc00C.dat
2009-04-11 11:17 . 2001-08-24 17:00 504216 ----a-w- c:\windows\system32\perfh00C.dat
2009-04-02 14:29 . 2009-04-02 14:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-28 17:59 . 2009-03-28 17:59 15872 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-03-28 17:57 . 2009-03-28 17:57 9158 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-03-28 13:55 . 2008-10-05 10:09 716272 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-03-28 13:23 . 2009-03-28 13:23 0 ----a-w- c:\windows\ativpsrm.bin
2009-03-28 13:22 . 2009-03-28 13:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-03-26 13:23 . 2009-05-12 17:30 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-03-26 13:23 . 2009-05-12 17:30 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-03-19 14:32 . 2009-05-12 17:31 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 14:32 . 2009-03-19 14:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"RGSC"="c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2009-03-28 306088]
"Gainward"="c:\program files\EXPERTool ATI\TBPanel.exe" [2008-09-05 2300456]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 217544]
"Steam"="c:\program files\Valve\Steam\Steam.exe" [2009-06-11 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-03 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-10-4 624416]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4661:TCP"= 4661:TCP:emule
"4672:UDP"= 4672:UDP:emule
"4242:TCP"= 4242:TCP:emule
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [02/06/2009 21:25 108289]
R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [19/11/2004 18:07 101488]
R2 SarkophageService;SarkoService;c:\windows\system32\srksrv.exe [06/06/2009 07:35 453632]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [28/03/2009 15:25 93184]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [15/03/2009 10:34 216232]
.
Contenu du dossier 'Tâches planifiées'

2009-05-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-LFAgent - (no file)


.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator2_8\Ghost
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\
FF - plugin: c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-15 20:23
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1454471165-287218729-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:02,85,c7,6e,99,00,4f,c6,00,db,59,71,2a,de,7b,23,8e,55,63,3b,3d,
e9,c6,57,81,5f,c6,4a,b0,99,d3,4f,c3,5e,f1,63,1d,ca,9e,4d,a7,48,ce,65,07,f6,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3308)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\CF20513.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\RealVNC\VNC4\winvnc4.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Heure de fin: 2009-06-15 20:27 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-15 18:27
ComboFix2.txt 2009-03-28 23:20
ComboFix3.txt 2009-02-27 19:28
ComboFix4.txt 2009-01-21 05:41

Avant-CF: 4 072 566 784 octets libres
Après-CF: 4 063 174 656 octets libres

257

Je ne sais pas si c'est bon , mais le seul message que je reçoit est :



0 bytes size received / Se ha recibido un archivo vacio

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_J | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 14/06/2009 à 10:30 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:11:36, 16/06/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: URANIUMOFCOURSE | Utilisateur actuel: Administrateur
.
Administrateur: Administrateur
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
.
C:\Program Files\AskTBar
.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.11 *

Nom du profil: pfpqg1uj.default (Administrateur)
.
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.11" );
.
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

============== Suspect (Cracks, Serials ... ) ==============

+---------------------------------------------------------------------------+

2796 Octet(s) - C:\Ad-Report-SCAN.log

1 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

Fin à: 19:25:51 | 16/06/2009
.
============== E.O.F ==============
.

voila

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_J | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 14/06/2009 à 10:30 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 20:32:44, 16/06/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: URANIUMOFCOURSE | Utilisateur actuel: Administrateur
.
Administrateur: Administrateur
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
.
C:\Program Files\AskTBar\bar
C:\Program Files\AskTBar\bar\Nouveau Archive WinRAR.rar
C:\Program Files\AskTBar

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.11 *

Nom du profil: pfpqg1uj.default (Administrateur)
.
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.11" );
.
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============



+---------------------------------------------------------------------------+

2749 Octet(s) - C:\Ad-Report-CLEAN.log
3018 Octet(s) - C:\Ad-Report-SCAN.log

20 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
1 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

Fin à: 20:47:57 | 16/06/2009
.
============== E.O.F ==============
.

euh... non vraiment pas désole


je vient de voir a quoi sert ce ''dossier'' et je n'ai vraiment pas installer ce genre de logiciel sur mon pc , du moins je n'en ai pas le souvenir ...

et je suis seul a utiliser ce pc :s

ComboFix 09-06-16.05 - Administrateur 17/06/2009 20:13.9 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1538 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\srksrv.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Sarkophage
c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe
c:\program files\Sarkophage\sarkomenu.dll
c:\windows\system32\srksrv.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SARKOPHAGESERVICE
-------\Service_SarkophageService


((((((((((((((((((((((((((((( Fichiers créés du 2009-05-17 au 2009-06-17 ))))))))))))))))))))))))))))))))))))
.

2009-06-16 18:06 . 2009-06-16 18:06 -------- d-----w- c:\program files\Micro Application
2009-06-16 17:11 . 2009-06-17 02:15 -------- d-----w- c:\program files\Ad-remover
2009-06-15 16:10 . 2009-06-15 16:13 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2009-06-15 16:03 . 2009-06-15 16:03 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-14 18:21 . 2009-06-14 18:21 -------- d-----w- C:\rsit
2009-06-13 18:49 . 2009-06-13 18:49 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Microsoft Games
2009-06-13 18:48 . 2009-06-13 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Games
2009-06-13 18:42 . 2009-06-13 18:42 -------- d-----w- c:\program files\Microsoft Games
2009-06-06 05:42 . 2009-06-17 02:19 -------- d-----w- c:\program files\Everstrike Software
2009-06-06 05:42 . 2009-06-06 05:42 -------- d-----w- c:\program files\Fichiers communs\Everstrike Software
2009-06-02 19:25 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-02 19:25 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-02 19:25 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-02 19:25 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\program files\Avira
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-27 19:38 . 2009-05-27 19:38 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-05-24 01:15 . 2009-06-17 02:22 -------- d-----w- c:\program files\FreeUndelete
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\ArcSoft
2009-05-21 19:23 . 2005-04-27 14:36 245408 ----a-w- c:\windows\system32\unicows.dll
2009-05-21 19:23 . 2003-03-18 20:14 499712 ----a-r- c:\windows\system32\msvcp71.dll
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\ArcSoft
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\AVS4YOU
2009-05-21 19:22 . 2009-01-28 18:49 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-05-21 19:22 . 2009-01-28 18:49 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-05-21 19:22 . 2009-01-28 18:49 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-21 19:22 . 2009-01-28 18:49 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Red Kawa
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\program files\Red Kawa

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-17 18:17 . 2008-10-04 13:54 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Hamachi
2009-06-17 18:16 . 2009-03-27 05:43 480776 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-17 18:08 . 2008-11-25 17:37 -------- d-----w- c:\documents and settings\Administrateur\Application Data\skypePM
2009-06-17 18:07 . 2008-11-25 17:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Skype
2009-06-17 02:22 . 2008-11-17 17:11 -------- d-----w- c:\program files\AviSynth 2.5
2009-06-15 16:03 . 2008-10-09 16:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-13 18:41 . 2008-10-03 21:35 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-06-04 17:34 . 2008-10-04 13:58 -------- d-----w- c:\program files\World of Warcraft
2009-05-31 20:02 . 2008-12-18 23:23 -------- d-----w- c:\program files\JkDefrag
2009-05-29 20:16 . 2008-10-18 11:26 -------- d-----w- c:\documents and settings\Administrateur\Application Data\teamspeak2
2009-05-26 11:20 . 2008-10-09 16:30 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2008-10-09 16:30 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-21 19:23 . 2008-10-03 21:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-12 18:06 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iTunes
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iPod
2009-05-12 17:31 . 2009-05-12 17:30 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\Apple Software Update
2009-05-12 17:30 . 2009-05-12 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-05-03 03:15 . 2008-10-04 17:34 71392 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-02 08:05 . 2008-10-06 04:39 -------- d-----w- c:\program files\MSBuild
2009-05-02 08:04 . 2008-10-05 13:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-01 13:17 . 2009-03-28 16:17 -------- d-----w- c:\program files\Rockstar Games
2009-04-26 15:53 . 2009-04-26 15:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Nero
2009-04-26 15:16 . 2009-04-26 14:59 -------- d-----w- c:\program files\Nero
2009-04-26 15:14 . 2009-04-26 15:14 -------- d-----w- c:\program files\Windows Sidebar
2009-04-26 15:08 . 2009-04-26 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-04-26 15:04 . 2009-04-26 14:58 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-04-26 14:58 . 2008-10-25 22:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\dvdcss
2009-04-26 14:51 . 2008-10-05 12:01 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-04-21 13:39 . 2009-05-02 07:42 2449344 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\maconfsetup.exe
2009-04-21 13:38 . 2009-05-02 07:42 429224 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
2009-04-18 19:02 . 2009-04-18 19:02 -------- d-----w- c:\program files\CCleaner
2009-04-17 14:37 . 2009-04-17 14:37 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-11 11:17 . 2001-08-24 17:00 81884 ----a-w- c:\windows\system32\perfc00C.dat
2009-04-11 11:17 . 2001-08-24 17:00 504216 ----a-w- c:\windows\system32\perfh00C.dat
2009-04-02 14:29 . 2009-04-02 14:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-28 17:59 . 2009-03-28 17:59 15872 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-03-28 17:57 . 2009-03-28 17:57 9158 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-03-28 13:55 . 2008-10-05 10:09 716272 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-03-28 13:23 . 2009-03-28 13:23 0 ----a-w- c:\windows\ativpsrm.bin
2009-03-28 13:22 . 2009-03-28 13:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-03-26 13:23 . 2009-05-12 17:30 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-03-26 13:23 . 2009-05-12 17:30 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"RGSC"="c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2009-03-28 306088]
"Gainward"="c:\program files\EXPERTool ATI\TBPanel.exe" [2008-09-05 2300456]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 217544]
"Steam"="c:\program files\Valve\Steam\Steam.exe" [2009-06-11 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-03 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-10-4 624416]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4661:TCP"= 4661:TCP:emule
"4672:UDP"= 4672:UDP:emule
"4242:TCP"= 4242:TCP:emule
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [02/06/2009 21:25 108289]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [28/03/2009 15:25 93184]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [15/03/2009 10:34 216232]
.
Contenu du dossier 'Tâches planifiées'

2009-05-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator2_8\Ghost
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\
FF - plugin: c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-17 20:18
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1454471165-287218729-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:02,85,c7,6e,99,00,4f,c6,00,db,59,71,2a,de,7b,23,8e,55,63,3b,3d,
e9,c6,57,81,5f,c6,4a,b0,99,d3,4f,c3,5e,f1,63,1d,ca,9e,4d,a7,48,ce,65,07,f6,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2452)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\RealVNC\VNC4\winvnc4.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Heure de fin: 2009-06-17 20:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-17 18:22
ComboFix2.txt 2009-06-15 18:27
ComboFix3.txt 2009-03-28 23:20
ComboFix4.txt 2009-02-27 19:28
ComboFix5.txt 2009-06-17 18:13

Avant-CF: 5 333 876 736 octets libres
Après-CF: 5 326 454 784 octets libres

240



voila

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-19 22:23:30
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 10 GB (13%) free of 76 GB
Total RAM: 2047 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23, on 19/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\EXPERTool ATI\TBPanel.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrateur\Bureau\Repare\RSIT.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Gainward] C:\Program Files\EXPERTool ATI\TBPanel.exe /A
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8200 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11222041-111B-46E3-BD29-EFB2449479B1}]
IEPlugin Class - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL [2008-05-26 170496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-06-19 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-19 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-12-18 868352]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-04-01 36352]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-03-04 61440]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"ArcSoft Connection Service"=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe [2008-04-17 98616]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-06-19 148888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uninstall Adobe Download Manager"=C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
"NoIE4StubProcessing"=C:\WINDOWS\system32\reg.exe [2008-04-13 53248]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-11-18 21633320]
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2009-03-28 306088]
"Gainward"=C:\Program Files\EXPERTool ATI\TBPanel.exe [2008-09-05 2300456]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2008-02-22 217544]
"Steam"=C:\Program Files\Valve\Steam\Steam.exe [2009-06-11 1217784]

C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-03-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"MemCheckBoxInRunDlg"=1
"NoSMBalloonTip"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"NoAutoUpdate"=1
"ClearDocsOnExit"=64
"NoDrives"=0
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 1 months======

2009-06-19 22:22:23 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-19 22:22:23 ----D---- C:\WINDOWS\ie8updates
2009-06-19 22:22:15 ----A---- C:\WINDOWS\imsins.BAK
2009-06-19 22:22:05 ----D---- C:\WINDOWS\WBEM
2009-06-19 22:21:52 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-06-19 22:21:06 ----HDC---- C:\WINDOWS\ie8
2009-06-19 22:21:02 ----D---- C:\WINDOWS\LastGood
2009-06-19 22:18:09 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-19 22:17:43 ----N---- C:\WINDOWS\system32\SET15A.tmp
2009-06-19 22:17:43 ----N---- C:\WINDOWS\system32\SET155.tmp
2009-06-19 22:17:42 ----N---- C:\WINDOWS\system32\SET157.tmp
2009-06-19 22:17:42 ----N---- C:\WINDOWS\system32\SET156.tmp
2009-06-19 22:17:41 ----N---- C:\WINDOWS\system32\SET15B.tmp
2009-06-19 22:15:15 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-06-19 22:15:15 ----D---- C:\Program Files\Adobe
2009-06-19 22:15:02 ----SHD---- C:\Config.Msi
2009-06-19 22:11:37 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-19 22:11:37 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-19 22:11:37 ----A---- C:\WINDOWS\system32\java.exe
2009-06-19 22:07:52 ----SD---- C:\ComboFix
2009-06-17 20:22:36 ----A---- C:\ComboFix.txt
2009-06-17 20:20:40 ----SHD---- C:\RECYCLER
2009-06-17 20:15:56 ----D---- C:\WINDOWS\temp
2009-06-16 20:06:42 ----D---- C:\Program Files\Micro Application
2009-06-16 19:11:14 ----D---- C:\Program Files\Ad-remover
2009-06-15 18:10:17 ----D---- C:\Documents and Settings\Administrateur\Application Data\vlc
2009-06-15 18:08:58 ----A---- C:\WINDOWS\ippln.txt
2009-06-14 20:21:36 ----D---- C:\rsit
2009-06-14 13:42:35 ----RASHD---- C:\autorun.inf
2009-06-14 13:39:44 ----A---- C:\UsbFix.txt
2009-06-13 20:49:00 ----D---- C:\Documents and Settings\Administrateur\Application Data\Microsoft Games
2009-06-13 20:48:34 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Games
2009-06-13 20:42:43 ----D---- C:\Program Files\Microsoft Games
2009-06-06 07:42:36 ----D---- C:\Program Files\Fichiers communs\Everstrike Software
2009-06-06 07:42:36 ----D---- C:\Program Files\Everstrike Software
2009-06-02 21:25:40 ----D---- C:\Program Files\Avira
2009-06-02 21:25:40 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-05-24 03:15:25 ----D---- C:\Program Files\FreeUndelete
2009-05-21 21:24:04 ----D---- C:\Documents and Settings\Administrateur\Application Data\ArcSoft
2009-05-21 21:24:01 ----D---- C:\Documents and Settings\Administrateur\Application Data\AVS4YOU
2009-05-21 21:23:54 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2009-05-21 21:23:24 ----D---- C:\Documents and Settings\All Users\Application Data\ArcSoft
2009-05-21 21:23:21 ----RA---- C:\WINDOWS\system32\msvcp71.dll
2009-05-21 21:23:21 ----D---- C:\Program Files\ArcSoft
2009-05-21 21:23:21 ----A---- C:\WINDOWS\system32\unicows.dll
2009-05-21 21:23:20 ----D---- C:\Program Files\Fichiers communs\ArcSoft
2009-05-21 21:22:55 ----D---- C:\Program Files\Fichiers communs\AVSMedia
2009-05-21 21:22:51 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-05-21 21:22:49 ----D---- C:\Program Files\AVS4YOU
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msxml3a.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-05-21 18:28:33 ----D---- C:\Documents and Settings\Administrateur\Application Data\Red Kawa
2009-05-21 18:28:13 ----D---- C:\Program Files\Red Kawa

======List of files/folders modified in the last 1 months======

2009-06-19 22:23:01 ----D---- C:\Program Files\Mozilla Firefox
2009-06-19 22:22:45 ----HD---- C:\WINDOWS\inf
2009-06-19 22:22:45 ----D---- C:\WINDOWS
2009-06-19 22:22:44 ----D---- C:\WINDOWS\system32\DllCache
2009-06-19 22:22:44 ----D---- C:\WINDOWS\system32
2009-06-19 22:22:41 ----D---- C:\Program Files\Internet Explorer
2009-06-19 22:22:11 ----D---- C:\WINDOWS\system32\config
2009-06-19 22:22:05 ----D---- C:\WINDOWS\system32\fr-FR
2009-06-19 22:21:59 ----D---- C:\WINDOWS\Media
2009-06-19 22:21:56 ----D---- C:\WINDOWS\Help
2009-06-19 22:21:02 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-19 22:18:10 ----D---- C:\WINDOWS\Debug
2009-06-19 22:16:30 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-06-19 22:16:02 ----SHD---- C:\WINDOWS\Installer
2009-06-19 22:15:18 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-06-19 22:15:15 ----D---- C:\Program Files\Fichiers communs
2009-06-19 22:15:15 ----D---- C:\Program Files
2009-06-19 22:13:49 ----D---- C:\Program Files\NOS
2009-06-19 22:11:26 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-06-19 22:09:43 ----D---- C:\Program Files\Java
2009-06-19 22:08:36 ----D---- C:\WINDOWS\system32\Restore
2009-06-19 22:07:55 ----D---- C:\WINDOWS\erdnt
2009-06-19 22:02:42 ----D---- C:\Documents and Settings\Administrateur\Application Data\skypePM
2009-06-19 22:02:35 ----D---- C:\Documents and Settings\Administrateur\Application Data\Hamachi
2009-06-19 22:02:28 ----D---- C:\Documents and Settings\Administrateur\Application Data\Skype
2009-06-17 20:22:39 ----D---- C:\WINDOWS\system32\drivers
2009-06-17 20:19:14 ----A---- C:\WINDOWS\system.ini
2009-06-17 20:15:19 ----D---- C:\WINDOWS\AppPatch
2009-06-17 20:13:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-17 04:22:11 ----D---- C:\Program Files\AviSynth 2.5
2009-06-15 18:03:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-06-15 17:59:37 ----D---- C:\WINDOWS\Prefetch
2009-06-14 13:43:22 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-13 20:48:34 ----D---- C:\WINDOWS\system32\DirectX
2009-06-13 20:41:45 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-06-06 07:33:16 ----SHD---- C:\System Volume Information
2009-06-04 19:34:20 ----D---- C:\Program Files\World of Warcraft
2009-06-02 21:25:16 ----D---- C:\WINDOWS\WinSxS
2009-05-31 22:02:32 ----D---- C:\Program Files\JkDefrag
2009-05-29 22:16:49 ----D---- C:\Documents and Settings\Administrateur\Application Data\teamspeak2
2009-05-21 21:23:19 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-03-04 3565568]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-10-31 93184]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-10-04 25280]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-24 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 a8mkpsrl;a8mkpsrl; C:\WINDOWS\system32\drivers\a8mkpsrl.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe [2008-04-17 102712]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-03-04 602112]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-06-19 152984]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2008-11-25 935208]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-03-03 593920]
S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS\system32\spupdsvc.exe [2009-01-07 26144]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-03-15 216232]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------


Voila , j'ai quand meme mis a jour Internet explorer meme si j'utilise Firefox ( mis a jour )



( dsl pour le retard petit pb de net :-( )

a priori , non pour le moment


Merci bcp

[ Rapport ToolsCleaner version 2.3.6 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Combofix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Administrateur\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Rsit.exe: trouvé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Nouveau dossier\UsbFix.exe: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Ad-remover\BACKUP\Ad-R.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe: supprimé !
C:\Program Files\Ad-remover\BACKUP\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Administrateur\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Rsit.exe: supprimé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Nouveau dossier\UsbFix.exe: supprimé !
C:\Combofix: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !



Merci bcp je change l'intitulé du message

Ok c'est fait Merci bcp encore une fois