Assiste.Forums

de **WAFFY** » 07 Fév 2009, 12:09

Bonjour à tous.
Je n'arrive plus à mettre à jour Malwarebytes anti-malware, ni à installer Spybot v162.
J'ai effectué la PAD, mais cela ne résoud rien.
Je retrouve toujours adaware.rightonads en HKEY_CLASSES_ROOT\Typelib\{3160f356-e8c3-4de2-a698-92eeeb3d3400} (Adware.RightOnAds) et j'ai toujours les mêmes pbs.
Je vous joins le log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:06:25, on 07/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\SCUSAPI.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pascal\Bureau\HJT.exe

R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SCUSAPI] SCUSAPI.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68581EE9-114E-4C6F-B58A-31E2A8A6D4A0}: NameServer = 85.255.115.19 85.255.112.71
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

--
End of file - 5589 bytes

J'ai des doutes sur:
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O17 - HKLM\System\CCS\Services\Tcpip\..\{68581EE9-114E-4C6F-B58A-31E2A8A6D4A0}: NameServer = 85.255.115.19 85.255.112.71

Merci d'avance....

de **nickW** » 07 Fév 2009, 19:24

Bonsoir,

Remarque préliminaire:
Pour pouvoir utiliser les sauvegardes créées par HijackThis, il faut que le programme HijackThis soit installé dans un dossier non système, non temporaire, et qui lui est réservé.
Je te conseille donc
*- de créer un dossier (par exemple: C:\HJT)
*- d'y déplacer le fichier HijackThis.exe
Si tu le laisses tel qu'il est actuellement, sur le Bureau, pas de sauvegardes aisément exploitables (donc plus aucune possibilité de faire "marche arrière").

Effectivement, des éléments infectés sont visibles (détournement de DNS).

Nettoyage, puis création de deux rapports détaillés:

Note: Ces manips doivent être effectuées en ayant ouvert une session avec les "droits Administrateur" (ne pas utiliser le profil utilisateur nommé "Administrateur" visible en mode sans échec)
Sous Windows XP, pour vérifier si un compte a les droits "Administrateur":
Démarrer---->Paramètres---->Panneau de configuration---->Comptes d'utilisateurs
A côté de l'icône représentant certains comptes (hormis celui nommé "Administrateur"), il est indiqué "Administrateur de l'ordinateur"
C'est l'un de ces comptes qu'il faudra utiliser.

Au vu de la longueur de la procédure, je te conseille de l'imprimer, ou d'en sélectionner toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC (Note: tu n'auras pas accès à Internet ni à ton navigateur, et des redémarrages sont possibles).
Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection.

Étape 1: OTListIt2 (de OldTimer), téléchargement
Télécharger OTListIt2.exe depuis http://oldtimer.geekstogo.com/OTListIt2.exe
Enregistrer ce fichier sur le Bureau.

Étape 2: SmitFraudFix (de S!ri), option 5: Recherche et suppression détournement DNS

Note préliminaire importante:
SmitFraudFix est détecté par certains antivirus comme étant un RiskTool (outil à risque).
Ceci est exact puisque certains de ses composants, s'ils étaient mis entre de mauvaises mains, pourraient effectuer des actions dangereuses.
Dans le cas de SmitFraudFix, il faut les laisser s'exécuter, et, si nécessaire, désactiver temporairement les programmes de protection en temps réel (lors du téléchargement et de l'exécution de l'outil).

Télécharger SmitFraudFix depuis http://siri.urz.free.fr/Fix/SmitfraudFix.exe
ou http://siri.geekstogo.com/SmitfraudFix.exe
Enregistrer ce fichier sur le Bureau.

Fermer toutes les fenêtres de programme ouvertes. Fermer tous les navigateurs (pas d'Internet Explorer, Firefox, Opera, etc, ouvert).
Faire un double clic sur SmitfraudFix.exe pour lancer l'outil.
Appuyer sur n'importe quelle touche après avoir lu le message d'avertissement.
Après l'affichage du menu, taper 5 puis faire Entrée pour corriger le détournement DNS.

Étape 3: OTListIt2 (de OldTimer)
Fermer toutes les fenêtres de programme ouvertes.

Faire un double clic sur OTListIt2.exe pour lancer l'outil.

L'écran principal de OTListIt2 s'affiche:

Si ce n'est déjà fait, dans le paragraphe Extra Registry, cocher le bouton-radio Use SafeList

Cocher (en haut) la case située devant Scan All Users:

Puis cliquer sur le bouton Run Scan:

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer le Bloc-notes.
Le second rapport est visible dans la Barre des tâches. Le fermer également.
Fermer la fenêtre de OTListIt2.

Étape 4: Résultats
Envoyer en réponse:
*- le rapport de SmitFraudFix (contenu du fichier SystemDrive\rapport.txt)
[SystemDrive représente la partition sur laquelle est installé le système, généralement C:]
Note importante:
Si ce rapport de SmitFraudFix contient des dizaines de lignes commençant par "127.0.0.1", il ne faut pas toutes les envoyer sur le forum.
Il ne faut envoyer que les 15 premières lignes commençant par "127.0.0.1" avec le reste du log.

Envoyer ensuite en réponse dans deux messages distincts (à cause de la longueur des logs):
*- les deux rapports de OTListIt2 (contenu des fichiers OTListIt.txt et Extras.txt situés sur le Bureau).
Les rapports envoyés sur le forum doivent se terminer par une ligne contenant <End>. Si ce n'est pas le cas, ils sont incomplets, et doivent alors être découpés en plusieurs messages.

Note importante: Pour l'envoi de ta(tes) réponse(s), il ne faut pas créer un nouveau sujet, mais cliquer sur le bouton "Répondre"

pour continuer dans ce fil de discussion.

A suivre,

de **WAFFY** » 07 Fév 2009, 21:40

Bonsoir NickW !
Et merci pour tes indications claires et précises.
Voici le rapport SmitFraudFix:
SmitFraudFix v2.392

Rapport fait à 21:21:17,32, 07/02/2009
Executé à partir de C:\Documents and Settings\Pascal\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{EC9494F0-65EA-4630-9BDB-B3C98C6A1345}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EC9494F0-65EA-4630-9BDB-B3C98C6A1345}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EC9494F0-65EA-4630-9BDB-B3C98C6A1345}: DhcpNameServer=208.67.220.220,208.67.222.222

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{EC9494F0-65EA-4630-9BDB-B3C98C6A1345}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EC9494F0-65EA-4630-9BDB-B3C98C6A1345}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EC9494F0-65EA-4630-9BDB-B3C98C6A1345}: DhcpNameServer=208.67.220.220,208.67.222.222

A suivre les rapports OTListit2

de **WAFFY** » 07 Fév 2009, 21:41

Ci-joint le rapport OTListIt.txt:

OTListIt logfile created on: 07/02/2009 21:23:15 - Run
OTListIt2 by OldTimer - Version 1.0.4.1 Folder = C:\Documents and Settings\Pascal\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

511,48 Mb Total Physical Memory | 249,46 Mb Available Physical Memory | 48,77% Memory free
1,22 Gb Paging File | 1,01 Gb Available in Paging File | 82,66% Paging File free
Paging file location(s): C:\pagefile.sys 0 0;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,22 Gb Total Space | 9,10 Gb Free Space | 12,26% Space Free | Partition Type: NTFS
Drive D: | 72,27 Gb Total Space | 71,53 Gb Free Space | 98,98% Space Free | Partition Type: NTFS
Drive E: | 2,55 Gb Total Space | 2,55 Gb Free Space | 99,83% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PIV3000
Current User Name: Pascal
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

[2009/01/23 18:39:42 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgamsvr.exe
[2009/01/23 18:34:54 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgupsvc.exe
[2009/01/23 18:39:43 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgemc.exe
[2008/12/20 11:41:39 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
[2008/05/03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
[2005/01/28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe
[2004/08/19 16:10:06 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
[2001/10/22 14:33:58 | 00,045,056 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\SCUSAPI.exe
[2006/08/19 11:37:06 | 00,049,152 | ---- | M] (ZSMCSNAP) -- C:\WINDOWS\ZSSnp211.EXE
[2009/01/30 01:27:29 | 00,049,152 | ---- | M] () -- C:\WINDOWS\Domino.EXE
[2008/12/20 11:41:39 | 00,136,600 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
[2003/07/08 15:25:22 | 00,925,770 | ---- | M] () -- C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
[2009/02/07 20:20:33 | 00,419,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTListIt2.exe

========== (O23) Win32 Services (SafeList) ==========

[2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
[2009/01/23 18:39:42 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgamsvr.exe -- (Avg7Alrt [Auto | Running])
[2009/01/23 18:34:54 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgupsvc.exe -- (Avg7UpdSvc [Auto | Running])
[2009/01/23 18:39:43 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgemc.exe -- (AVGEMS [Auto | Running])
[2005/10/17 08:28:11 | 00,054,784 | ---- | M] (Macrovision) -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA [Disabled | Stopped])
[2004/08/19 16:09:38 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [On_Demand | Stopped])
[2004/10/22 02:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
[2003/05/14 11:29:54 | 00,753,716 | ---- | M] () -- C:\Program Files\Ahead\InCD\incdsrv.exe -- (InCDsrv [Disabled | Stopped])
[2008/12/20 11:41:39 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
[2005/01/26 15:30:04 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
[2008/05/03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
[2005/01/26 15:25:34 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
[2007/12/28 18:42:09 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Disabled | Stopped])
[2005/01/26 15:20:14 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
[2005/01/28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running])
[2007/01/19 11:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped])
[2006/04/03 17:12:14 | 00,014,032 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend [Disabled | Stopped])

========== Driver Services (SafeList) ==========

[2002/10/11 18:19:00 | 00,046,551 | ---- | M] (Analog Deivces) -- C:\WINDOWS\system32\drivers\adildr.sys -- (ADILOADER [Auto | Stopped])
[2002/11/22 22:14:36 | 00,122,505 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\drivers\adiusbaw.sys -- (adiusbaw [On_Demand | Running])
[2004/02/24 04:08:52 | 00,400,384 | ---- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS [On_Demand | Running])
[2004/03/19 13:02:08 | 00,613,244 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running])
[2009/01/23 18:39:37 | 00,821,856 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avg7core.sys -- (Avg7Core [System | Running])
[2009/01/23 18:34:58 | 00,004,224 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avg7rsw.sys -- (Avg7RsW [System | Running])
[2009/01/23 18:34:58 | 00,027,776 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avg7rsxp.sys -- (Avg7RsXP [System | Running])
[2009/01/23 18:39:47 | 00,010,760 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avgclean.sys -- (AvgClean [System | Running])
[2009/01/23 18:35:00 | 00,004,960 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avgtdi.sys -- (AvgTdi [Auto | Running])
[2005/10/17 08:28:09 | 00,012,464 | ---- | M] (Macrovision Europe Ltd) -- C:\WINDOWS\system32\drivers\CdaC15BA.SYS -- (CdaC15BA [Auto | Running])
[2003/12/03 17:44:58 | 00,013,566 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\drivers\cdrbsvsd.sys -- (cdrbsvsd [System | Running])
[2002/11/18 14:51:40 | 00,377,358 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmaudio.sys -- (cmpci [On_Demand | Stopped])
[2006/08/12 02:28:58 | 00,798,464 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmuda3.sys -- (cmuda3 [On_Demand | Running])
[2003/05/14 11:31:32 | 00,085,296 | ---- | M] () -- C:\WINDOWS\system32\drivers\incdfs.sys -- (InCDfs [Disabled | Running])
[2003/05/14 11:31:58 | 00,026,336 | ---- | M] (Ahead Software) -- C:\WINDOWS\system32\drivers\incdpass.sys -- (InCDPass [System | Running])
[2003/04/25 13:13:42 | 00,023,920 | ---- | M] (Ahead Software AG) -- C:\WINDOWS\system32\drivers\incdrm.sys -- (incdrm [System | Running])
[2004/03/12 18:23:56 | 00,845,092 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\Ctxs51.sys -- (Intels51 [On_Demand | Running])
[2008/05/03 05:46:00 | 06,554,496 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv [On_Demand | Running])
[2001/08/28 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink [On_Demand | Running])
[2007/03/08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\pxhelp20.sys -- (PxHelp20 [Boot | Running])
[2001/08/17 22:05:16 | 00,028,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\OVCD.sys -- (QCDonner [On_Demand | Running])
[2004/08/03 22:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139 [On_Demand | Running])
[2001/10/22 14:33:46 | 00,031,728 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\drivers\SCUSPAC.SYS -- (SCUSMFP1 [Auto | Running])
[2001/10/22 14:33:46 | 00,022,796 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\drivers\SCUSPRO.SYS -- (SCUSMFP2 [Auto | Running])
[2001/10/22 14:33:58 | 00,025,768 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\drivers\SCUSUSB.SYS -- (SCUSUSB [On_Demand | Stopped])
[2005/04/20 17:15:52 | 00,163,644 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv [Auto | Running])
[2005/08/10 13:44:04 | 00,050,688 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01 [Boot | Running])
[2005/05/16 14:20:39 | 00,006,656 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02 [Boot | Running])
[2005/04/14 13:12:32 | 00,019,968 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02 [Boot | Running])
[2005/11/03 15:40:07 | 00,063,488 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02 [Boot | Running])
[2001/08/17 21:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\drivers\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped])
[2005/12/22 12:24:50 | 00,080,272 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\sscdbus.sys -- (sscdbus [On_Demand | Stopped])
[2005/12/22 12:24:52 | 00,010,864 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys -- (sscdmdfl [On_Demand | Stopped])
[2005/12/22 12:24:52 | 00,137,884 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\sscdmdm.sys -- (sscdmdm [On_Demand | Stopped])
[2009/02/07 10:02:09 | 00,102,664 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm [Auto | Running])
[2001/08/28 13:00:00 | 00,012,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\ws2ifsl.sys -- (WS2IFSL [System | Running])
[2006/10/18 09:23:40 | 00,391,866 | ---- | M] (ZSMC Corporation) -- C:\WINDOWS\system32\drivers\ZS211.sys -- (ZSMC211 [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions =
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://windowsupdate.microsoft.com/
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions =
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://windowsupdate.microsoft.com/
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\S-1-5-21-1177238915-1409082233-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (23 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (dcads) - {b9a85eaa-c89c-66bd-46c6-097f778c6d43} - C:\WINDOWS\system32\nsdA.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Reg Error: Key does not exist or could not be opened. File not found
O3 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\..\Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Reg Error: Key does not exist or could not be opened. File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP (GRISOFT, s.r.o.)
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe ()
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /install ()
O4 - HKLM..\Run: [SCUSAPI] SCUSAPI.exe (Sharp Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe (ZSMCSNAP)
O4 - HKCU..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (GRISOFT, s.r.o.)
O4 - HKU\S-1-5-18..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (GRISOFT, s.r.o.)
O4 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk = C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe (Sony Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe (Sony Corporation.)
O4 - Startup: C:\Documents and Settings\Cathy\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Léa\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Pascal\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Thomas\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ShutdownWithoutLogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLastUserName = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 0
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 0
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Sites: 41 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Sites: 39 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Sites: 40 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Sites: 40 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\..Trusted Sites: 39 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} http://messenger.zone.msn.com/binary/ms ... b31267.cab (Checkers Class)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} http://messenger.zone.msn.com/binary/Me ... b31267.cab (MessengerStatsClient Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... mv9dmo.cab (Reg Error: Key does not exist or could not be opened.)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} http://messenger.zone.msn.com/binary/Me ... b31267.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: DirectAnimation Java Classes (Reg Error: Key does not exist or could not be opened.)
O16 - DPF: Microsoft XML Parser for Java (Reg Error: Key does not exist or could not be opened.)
O18 - Protocol\Handler: - ipp - No CLSID value found
O18 - Protocol\Handler: - ipp\0x00000001 - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler: - livecall - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler: - msdaipp - No CLSID value found
O18 - Protocol\Handler: - msdaipp\0x00000001 - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler: - msdaipp\oledb - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler: - msnim - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O20 - See sections below for AppInitDlls and Winlogon settings

========== Shell Execute Hooks ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" (HKLM) -- C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" (HKLM) -- Reg Error: Key does not exist or could not be opened. File not found

========== Safeboot Options ==========

"AlternateShell" = cmd.exe

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []
[2004/11/18 16:08:40 | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT -- [ NTFS ]

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/02/07 20:20:26 | 00,419,328 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTListIt2.exe
[2009/02/07 20:17:54 | 00,000,000 | ---D | C] -- C:\HJThis
[2009/02/07 17:57:07 | 00,000,000 | ---D | C] -- C:\WINDOWS\BDOSCAN8
[2009/02/07 10:04:48 | 00,102,664 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/02/07 09:36:41 | 00,002,120 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2009/02/07 09:36:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\SmitfraudFix
[2009/02/07 09:18:55 | 00,000,000 | ---D | C] -- C:\VundoFix Backups
[2009/02/07 08:47:43 | 00,001,548 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\CCleaner.lnk
[2009/02/07 08:47:42 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/02/07 08:37:33 | 00,576,868 | ---- | C] (IL-MAFIOSO ) -- C:\Documents and Settings\Pascal\Bureau\Navilog1.exe
[2009/02/07 08:36:46 | 01,661,793 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\SmitfraudFix.exe
[2009/02/07 08:36:32 | 00,096,978 | ---- | C] (Business Information Solutions) -- C:\Documents and Settings\Pascal\Bureau\VirtumundoBeGone.exe
[2009/02/07 00:27:40 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro
[2009/02/07 00:27:32 | 00,000,000 | ---D | C] -- C:\rsit
[2009/02/07 00:15:15 | 00,781,851 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\RSIT.exe
[2009/02/06 22:58:58 | 00,000,000 | ---D | C] -- C:\_OTMoveIt
[2009/02/06 22:55:41 | 00,348,160 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTMoveIt3.exe
[2009/02/06 21:32:50 | 00,000,000 | ---D | C] -- C:\ToolBar SD
[2009/02/06 21:32:08 | 00,343,017 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\ToolBarSD.exe
[2009/02/06 20:27:46 | 00,000,080 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\fix.reg
[2009/02/03 09:15:35 | 00,085,664 | ---- | C] () -- C:\WINDOWS\System32\98a5e3ff-62f9-4650-087a-5f2f16a23de3.exe
[2009/02/03 03:13:29 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009/02/02 23:31:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\backups
[2009/02/02 22:55:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\GenProc
[2009/01/30 01:09:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Application Data\SUPERAntiSpyware.com
[2009/01/30 01:09:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2009/01/30 00:21:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Application Data\Malwarebytes
[2009/01/30 00:21:44 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/01/30 00:21:43 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/01/30 00:21:40 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/01/30 00:21:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/01/30 00:21:38 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/01/29 23:54:00 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/01/29 23:10:25 | 00,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 8.lnk
[2009/01/29 22:24:51 | 00,000,212 | ---- | C] () -- C:\Boot.bak
[2009/01/29 22:24:49 | 00,263,488 | ---- | C] () -- C:\cmldr
[2009/01/29 22:24:41 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/01/29 22:23:37 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/01/29 22:23:37 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/01/29 22:23:37 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/01/29 22:23:37 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/01/29 22:23:37 | 00,089,504 | ---- | C] (Smallfrogs Studio) -- C:\WINDOWS\fdsv.exe
[2009/01/29 22:23:37 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/01/29 22:23:37 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/01/29 22:23:37 | 00,049,152 | ---- | C] () -- C:\WINDOWS\VFIND.exe
[2009/01/29 22:23:37 | 00,029,696 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009/01/29 22:23:32 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/01/29 22:22:48 | 03,048,418 | R--- | C] () -- C:\Documents and Settings\Pascal\Bureau\ComboFix.exe
[2009/01/29 21:32:54 | 00,132,597 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\Flash_Disinfector.exe
[2009/01/29 15:41:24 | 00,670,720 | ---- | C] () -- C:\WINDOWS\System32\nsdA.dll
[2009/01/29 00:18:03 | 00,009,668 | ---- | C] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090129_001800.reg
[2009/01/28 23:05:32 | 00,038,748 | ---- | C] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090128_230526.reg
[2009/01/23 20:17:45 | 00,000,512 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily).job
[2009/01/23 18:35:01 | 00,010,760 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgclean.sys
[2009/01/23 18:35:01 | 00,001,532 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\AVG 7.5.lnk
[2009/01/23 18:35:00 | 00,026,952 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/01/23 18:35:00 | 00,004,960 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdi.sys
[2009/01/23 18:34:58 | 00,027,776 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsxp.sys
[2009/01/23 18:34:58 | 00,004,224 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsw.sys
[2009/01/23 18:34:56 | 00,821,856 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7core.sys

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/02/07 21:15:24 | 00,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/02/07 21:15:24 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/02/07 21:14:48 | 00,176,754 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009/02/07 21:14:08 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/02/07 21:12:17 | 04,303,414 | -H-- | M] () -- C:\Documents and Settings\Pascal\Local Settings\Application Data\IconCache.db
[2009/02/07 20:39:53 | 00,000,211 | ---- | M] () -- C:\WINDOWS\spnutmp.ini
[2009/02/07 20:27:22 | 01,661,793 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\SmitfraudFix.exe
[2009/02/07 20:20:33 | 00,419,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTListIt2.exe
[2009/02/07 20:14:06 | 00,085,664 | ---- | M] () -- C:\WINDOWS\System32\98a5e3ff-62f9-4650-087a-5f2f16a23de3.exe
[2009/02/07 20:12:59 | 00,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/02/07 20:12:58 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/02/07 17:51:24 | 00,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/02/07 17:51:24 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/02/07 17:33:00 | 00,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/02/07 17:33:00 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/02/07 17:31:27 | 00,000,512 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily).job
[2009/02/07 17:31:27 | 00,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2009/02/07 15:42:11 | 00,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
[2009/02/07 15:42:11 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2009/02/07 15:00:46 | 00,000,838 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/02/07 15:00:46 | 00,000,282 | RHS- | M] () -- C:\boot.ini
[2009/02/07 15:00:46 | 00,000,280 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/02/07 14:16:45 | 00,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2009/02/07 14:16:45 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2009/02/07 14:02:16 | 00,002,120 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2009/02/07 11:53:45 | 00,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
[2009/02/07 11:53:44 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2009/02/07 11:37:26 | 00,000,268 | -H-- | M] () -- C:\sqmdata16.sqm
[2009/02/07 11:37:26 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2009/02/07 10:02:09 | 00,102,664 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/02/07 09:46:19 | 00,000,268 | -H-- | M] () -- C:\sqmdata15.sqm
[2009/02/07 09:46:19 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2009/02/07 08:47:43 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\CCleaner.lnk
[2009/02/07 08:37:38 | 00,576,868 | ---- | M] (IL-MAFIOSO ) -- C:\Documents and Settings\Pascal\Bureau\Navilog1.exe
[2009/02/07 08:36:36 | 00,096,978 | ---- | M] (Business Information Solutions) -- C:\Documents and Settings\Pascal\Bureau\VirtumundoBeGone.exe
[2009/02/07 01:03:31 | 00,000,268 | -H-- | M] () -- C:\sqmdata14.sqm
[2009/02/07 01:03:30 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2009/02/07 00:55:35 | 00,000,268 | -H-- | M] () -- C:\sqmdata13.sqm
[2009/02/07 00:55:35 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2009/02/07 00:15:48 | 00,781,851 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\RSIT.exe
[2009/02/06 23:43:09 | 00,000,268 | -H-- | M] () -- C:\sqmdata12.sqm
[2009/02/06 23:43:09 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2009/02/06 23:41:20 | 00,161,936 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/02/06 23:37:27 | 00,033,112 | ---- | M] () -- C:\Documents and Settings\Pascal\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/02/06 23:02:22 | 00,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2009/02/06 23:02:22 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2009/02/06 22:55:46 | 00,348,160 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTMoveIt3.exe
[2009/02/06 22:40:41 | 00,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2009/02/06 22:40:40 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2009/02/06 22:05:37 | 00,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2009/02/06 22:05:36 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2009/02/06 21:32:13 | 00,343,017 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\ToolBarSD.exe
[2009/02/06 20:42:02 | 00,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/02/06 20:42:02 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/02/06 20:27:46 | 00,000,080 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\fix.reg
[2009/02/06 20:21:42 | 00,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/02/06 20:21:42 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/02/06 19:55:07 | 00,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/02/06 19:55:07 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/02/06 19:22:11 | 00,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/02/06 19:22:10 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/02/06 19:12:03 | 00,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/02/06 19:12:02 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/02/01 14:24:30 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/01/30 01:27:29 | 00,049,152 | ---- | M] () -- C:\WINDOWS\Domino.EXE
[2009/01/30 00:21:44 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/01/29 23:10:25 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 8.lnk
[2009/01/29 22:21:14 | 03,048,418 | R--- | M] () -- C:\Documents and Settings\Pascal\Bureau\ComboFix.exe
[2009/01/29 21:32:59 | 00,132,597 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\Flash_Disinfector.exe
[2009/01/29 19:51:22 | 00,000,584 | ---- | M] () -- C:\Documents and Settings\Pascal\Mes documents\Mes dossiers de partage.lnk
[2009/01/29 15:41:24 | 00,670,720 | ---- | M] () -- C:\WINDOWS\System32\nsdA.dll
[2009/01/29 00:18:44 | 00,009,668 | ---- | M] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090129_001800.reg
[2009/01/28 23:05:55 | 00,038,748 | ---- | M] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090128_230526.reg
[2009/01/28 20:45:50 | 00,000,664 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Winamp.lnk
[2009/01/26 08:57:03 | 00,143,872 | ---- | M] () -- C:\Documents and Settings\Pascal\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/23 18:39:47 | 00,010,760 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgclean.sys
[2009/01/23 18:39:37 | 00,821,856 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7core.sys
[2009/01/23 18:39:37 | 00,026,952 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/01/23 18:35:01 | 00,001,532 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\AVG 7.5.lnk
[2009/01/23 18:35:00 | 00,004,960 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdi.sys
[2009/01/23 18:34:58 | 00,027,776 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsxp.sys
[2009/01/23 18:34:58 | 00,004,224 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsw.sys
[2009/01/14 16:11:32 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/01/14 16:11:28 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> %SystemRoot%\Domino.EXE:SummaryInformation
@Alternate Data Stream - 0 bytes -> %SystemRoot%\Domino.EXE:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
<End>

de **WAFFY** » 07 Fév 2009, 21:49

Et le rapport Extras.txt de OTListIt2:

OTListIt Extras logfile created on: 07/02/2009 21:23:15 - Run
OTListIt2 by OldTimer - Version 1.0.4.1 Folder = C:\Documents and Settings\Pascal\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

511,48 Mb Total Physical Memory | 249,46 Mb Available Physical Memory | 48,77% Memory free
1,22 Gb Paging File | 1,01 Gb Available in Paging File | 82,66% Paging File free
Paging file location(s): C:\pagefile.sys 0 0;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,22 Gb Total Space | 9,10 Gb Free Space | 12,26% Space Free | Partition Type: NTFS
Drive D: | 72,27 Gb Total Space | 71,53 Gb Free Space | 98,98% Space Free | Partition Type: NTFS
Drive E: | 2,55 Gb Total Space | 2,55 Gb Free Space | 99,83% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PIV3000
Current User Name: Pascal
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] --
========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2007/01/19 11:55:02 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
[2007/01/04 15:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2004/08/19 16:09:52 | 00,083,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test
[2007/01/19 11:55:02 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
[2007/01/04 15:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
[2006/08/26 12:01:22 | 00,106,496 | ---- | M] () -- C:\Documents and Settings\Thomas\Bureau\My games\Counter-Strike Source\hl2.exe:*:Disabled:hl2
[2006/03/30 11:51:12 | 11,747,976 | ---- | M] (Firaxis Games) -- C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4
[2008/04/14 01:03:42 | 11,976,704 | ---- | M] () -- C:\Program Files\TmNationsForever\TmForever.exe:*:Disabled:TmForever
[2009/01/23 18:39:44 | 00,514,560 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe
[2009/01/23 18:39:42 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe
[2009/01/23 18:39:43 | 00,590,848 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe
[2009/01/23 18:39:43 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Enabled:avgemc.exe
[2009/01/14 16:11:26 | 01,273,488 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1E2F8AE3-3437-44E6-BB75-E95751D6B83F}" = Picture Package
"{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}" = Windows Live Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{2F151B50-B434-4838-B51D-70442EBA093E}" = OpenMG Secure Module 4.1.00
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{44D02D8B-FFB3-4245-8D26-68D10B4C4023}" = Webcam (ZS0211)
"{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = modem ADSL USB
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90AF040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
"{917E73C2-C7DA-4C12-9774-A6A2730BCAAB}" = Worms Forts Under Siege
"{A122962F-331A-4C2E-93DB-AD92D8A4FB14}" = OpenOffice.org 2.4
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{AC76BA86-7AD7-1036-7B44-A81300000003}" = Adobe Reader 8.1.3 - Français
"{AE01D94C-A3E6-437C-B278-88FE03C98E52}" = Kit de connexion ADSL
"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}" = Windows Live Messenger
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"98a5e3ff-62f9-4650-087a-5f2f16a23de3" = Contextual Tool Dcads
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player Plugin
"Audacity_is1" = Audacity 1.2.6
"AVG7Uninstall" = AVG 7.5
"Cacheman 5.11" = Cacheman 5.11
"CCleaner" = CCleaner (remove only)
"CdaC13Ba" = SafeCast Shared Components
"CDex" = CDex extraction audio
"C-Media PCI Audio Driver" = C-Media WDM Audio Driver
"C-Media PCI Sound" = C-Media PCI Audio
"Creatix V.9X DSP Data Fax Modem" = Creatix V.9X DSP Data Fax Modem
"HijackThis" = HijackThis 2.0.2
"InCD!UninstallKey" = Ahead InCD
"InstallShield_{2F151B50-B434-4838-B51D-70442EBA093E}" = OpenMG Secure Module 4.1.00
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.0.5)" = Mozilla Firefox (3.0.5)
"MRW!UninstallKey" = Ahead InCD EasyWrite Reader
"NMPUninstallKey" = Ahead NeroMediaPlayer
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.1-05-13-31-01" = OpenMG Limited Patch 4.1-05-13-31-01
"PCI Audio Driver" = PCI Audio Driver
"Pilote SHARP série AJ-6000" = Pilote SHARP série AJ-6000
"SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Shareaza_is1" = Shareaza version 2.2.3.0
"The Sudoku Challenge-retail" = The Sudoku Challenge
"TmNationsForever_is1" = TmNationsForever
"WidelookPlug" = Widelook Plug-in for Mozilla
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = Archiveur WinRAR

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:42 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

Error - 15/12/2008 07:58:43 | Computer Name = PIV3000 | Source = ESENT | ID = 623
Description = Catalog Database (756) La banque des versions de l'instance (0) a
atteint la taille maximale de 16 Mo. Une transaction de longue durée empêche peut-être
le nettoyage de cette banque des versions et cause l'augmentation de sa taille.
Les mises à jour seront rejetées jusqu'à ce que la transaction de longue durée
ait été entièrement validée ou annulée. Transaction de longue durée possible : ID
de Session : 0x02D603C0 Contexte de session : 0x00000000 ID de thread de contexte
de session : 0x000002B8

[ System Events ]
Error - 07/02/2009 13:44:56 | Computer Name = PIV3000 | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service netman
avec les arguments "" pour démarrer le serveur : {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 07/02/2009 13:45:03 | Computer Name = PIV3000 | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service EventSystem
avec les arguments "" pour démarrer le serveur : {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 07/02/2009 13:49:32 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7000
Description = Le service General Purpose USB Driver (adildr.sys) n'a pas pu démarrer
en raison de l'erreur : %%1058

Error - 07/02/2009 13:49:32 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7000
Description = Le service Pilote de port parallèle n'a pas pu démarrer en raison
de l'erreur : %%1058

Error - 07/02/2009 13:49:32 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7001
Description = Le service Hôte de périphérique universel Plug-and-Play dépend du
service Service de découvertes SSDP qui n'a pas pu démarrer en raison de l'erreur :
%%1058

Error - 07/02/2009 13:49:32 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
charger : SASDIFSV SASKUTIL

Error - 07/02/2009 16:14:35 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7000
Description = Le service General Purpose USB Driver (adildr.sys) n'a pas pu démarrer
en raison de l'erreur : %%1058

Error - 07/02/2009 16:14:35 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7000
Description = Le service Pilote de port parallèle n'a pas pu démarrer en raison
de l'erreur : %%1058

Error - 07/02/2009 16:14:35 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7001
Description = Le service Hôte de périphérique universel Plug-and-Play dépend du
service Service de découvertes SSDP qui n'a pas pu démarrer en raison de l'erreur :
%%1058

Error - 07/02/2009 16:14:35 | Computer Name = PIV3000 | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
charger : SASDIFSV SASKUTIL

<End>

de **nickW** » 07 Fév 2009, 23:33

Bonsoir,

Flash_Disinfector, ComboFix, Malwarebytes' Anti-Malware, SUPERAntiSpyware, GenProc, ToolBar S&D, OTMoveIt3, VirtumundoBeGone, RSIT, SmitfraudFix, Navilog1, VundoFix, sans parler des analyses en ligne.

La plupart de ces outils ne doivent pas être utilisés sans l'avis d'un conseiller.
Certains ont été demandés sur 01net, mais pas tous.
http://forum.telecharger.01net.com/tele ... ges-1.html

Qui t'a demandé de les exécuter? sur quel forum?

A suivre,

de **WAFFY** » 08 Fév 2009, 10:34

Bonjour,
Pas d'inscription sur d'autres forum. Même sujet précedemment traité sur 01 NET, sans résultats:http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/trojan_et_spywares/pb-dinstallation-spybot-443011/messages-1.html.
Si il y a d'autres actions qui ont été effectuées sans indication du forum, c'est que j'ai essayé de me débrouiller seul, n'ayant plus de réponse du forum. Jusqu'à trouver votre forum en appuyant sur le bouton "Send log to Trend Micro" de HiJackThis.
Depuis que vous me répondez, je suis à la lettre vos indications.
Et soyons clair, je n'ai pas l'intention, pendant que vous traitez mon sujet, d'effectuer d'autres manips en parallèle....

de **nickW** » 08 Fév 2009, 19:35

Bonsoir,

Rappel important à propos de ComboFix:

Le guide officiel de ComboFix a écrit:Vous ne devez pas utiliser ComboFix sans qu'un assistant vous demande expressément de le faire. De plus, en raison de la puissance de cet outil, il vous est fortement conseillé de ne pas essayer de traiter les informations affichées par ComboFix sans l'aide de quelqu'un qui a suivi une formation adéquate. Si vous le faites quand même, seul, sachez qu'une mauvaise utilisation du programme pourrait entraîner des problèmes dans le fonctionnement normal de votre ordinateur.
http://www.bleepingcomputer.com/combofi ... r-combofix

Nouvelles recherches, plus étendues:

Note: Ces manips doivent être effectuées en ayant ouvert une session avec les "droits Administrateur" (ne pas utiliser le profil utilisateur nommé "Administrateur" visible en mode sans échec)

Étape 1: Pas de processus de contrôle en temps réel
Désactiver le module résident de l'antivirus.

AVG: ouvrir AVG Control Center, double clic sur "AVG Resident Shield", décocher "Turn on AVG Resident Shield"

Étape 2: Malwarebytes' Anti-Malware, recherche
Fermer toutes les fenêtres de programme ouvertes.
Lancer Malwarebytes' Anti-Malware via le Menu Démarrer.
Dans l'onglet Paramètres, vérifier que toutes les cases sont cochées sauf "Créer une option dans le menu contextuel pour analyser des fichiers (clic droit)".
Dans l'onglet Mise à jour, cliquer sur le bouton Recherche de mise à jour et installer toutes les mises à jour trouvées.
Dans l'onglet Recherche, cocher le bouton radio situé devant "Exécuter un examen rapide" puis cliquer sur le bouton Rechercher.
Attendre sans rien faire d'autre la fin de la recherche; dans la fenêtre annonçant la fin de l'analyse, cliquer sur OK; puis cliquer sur le bouton "Afficher les résultats".

Cliquer sur le bouton "Enregistrer le rapport", valider la sauvegarde, puis cliquer sur le bouton "Quitter"

Étape 3: Processus de contrôle en temps réel
Important: Réactiver le module résident de l'antivirus.

Étape 4: OTListIt2 (de OldTimer)
Fermer toutes les fenêtres de programme ouvertes.

Faire un double clic sur OTListIt2.exe pour lancer l'outil.

L'écran principal de OTListIt2 s'affiche:

Dans le paragraphe File Age, ouvrir la liste déroulante et choisir 60 Days

Cocher (en haut) la case située devant Scan All Users:

Puis cliquer sur le bouton Run Scan:

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer le Bloc-notes.
Fermer la fenêtre de OTListIt2.

Étape 5: Résultats
Envoyer en réponse:
*- le log de Malwarebytes' Anti-Malware (contenu du fichier mbam-log-*-**-**** (**-**-**).txt situé dans le dossier SystemDrive\Documents and Settings\<tonprofil>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs / *-**-**** (**-**-**) représente la date [mois-jour-année] et l'heure [hh-mn-ss])
[SystemDrive représente la partition sur laquelle est installé le système, généralement C:]

Envoyer ensuite en réponse dans un message distinct (à cause de la longueur du log):
*- le rapport principal de OTListIt2 (contenu du fichier OTListIt2.txt situé sur le Bureau).
Le rapport envoyé sur le forum doit se terminer par une ligne contenant <End>. Si ce n'est pas le cas, il est incomplet, et doit alors être découpé en plusieurs messages.

Note importante: Pour l'envoi de ta(tes) réponse(s), il ne faut pas créer un nouveau sujet, mais cliquer sur le bouton "Répondre"

pour continuer dans ce fil de discussion.

A suivre,

de **WAFFY** » 08 Fév 2009, 23:30

Bonsoir,

Ci-joint le rapport de Malware (je n'ai pas pu le mettre à jour: échec ):

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1715
Windows 5.1.2600 Service Pack 2

08/02/2009 23:17:52
mbam-log-2009-02-08 (23-17-34).txt

Type de recherche: Examen rapide
Eléments examinés: 68471
Temps écoulé: 3 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Typelib\{3160f356-e8c3-4de2-a698-92eeeb3d3400} (Adware.RightOnAds) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b9a85eaa-c89c-66bd-46c6-097f778c6d43} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b9a85eaa-c89c-66bd-46c6-097f778c6d43} (Trojan.BHO) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{68581ee9-114e-4c6f-b58a-31e2a8a6d4a0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.19 85.255.112.71 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{68581ee9-114e-4c6f-b58a-31e2a8a6d4a0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.19 85.255.112.71 -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\nso8.dll (Trojan.BHO) -> No action taken.

A suivre le rapport OTlist2

de **WAFFY** » 08 Fév 2009, 23:33

Ci-joint le rapport OTListIT2.txt :

OTListIt logfile created on: 08/02/2009 23:19:02 - Run 4
OTListIt2 by OldTimer - Version 1.0.4.1 Folder = C:\Documents and Settings\Pascal\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

511,48 Mb Total Physical Memory | 246,77 Mb Available Physical Memory | 48,25% Memory free
1,22 Gb Paging File | 1,00 Gb Available in Paging File | 82,34% Paging File free
Paging file location(s): C:\pagefile.sys 0 0;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,22 Gb Total Space | 9,83 Gb Free Space | 13,24% Space Free | Partition Type: NTFS
Drive D: | 72,27 Gb Total Space | 71,53 Gb Free Space | 98,98% Space Free | Partition Type: NTFS
Drive E: | 2,55 Gb Total Space | 2,55 Gb Free Space | 99,83% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PIV3000
Current User Name: Pascal
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 60 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

[2009/01/23 18:39:42 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgamsvr.exe
[2009/01/23 18:34:54 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgupsvc.exe
[2009/01/23 18:39:43 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgemc.exe
[2008/12/20 11:41:39 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
[2008/05/03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
[2005/01/28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe
[2004/08/19 16:10:06 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
[2001/10/22 14:33:58 | 00,045,056 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\SCUSAPI.exe
[2006/08/19 11:37:06 | 00,049,152 | ---- | M] (ZSMCSNAP) -- C:\WINDOWS\ZSSnp211.EXE
[2009/01/30 01:27:29 | 00,049,152 | ---- | M] () -- C:\WINDOWS\Domino.EXE
[2008/12/20 11:41:39 | 00,136,600 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
[2009/01/23 18:39:43 | 00,590,848 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgcc.exe
[2003/07/08 15:25:22 | 00,925,770 | ---- | M] () -- C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
[2009/02/07 20:20:33 | 00,419,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTListIt2.exe

========== (O23) Win32 Services (SafeList) ==========

[2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
[2009/01/23 18:39:42 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgamsvr.exe -- (Avg7Alrt [Auto | Running])
[2009/01/23 18:34:54 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgupsvc.exe -- (Avg7UpdSvc [Auto | Running])
[2009/01/23 18:39:43 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.) -- C:\Program Files\Grisoft\AVG7\avgemc.exe -- (AVGEMS [Auto | Running])
[2005/10/17 08:28:11 | 00,054,784 | ---- | M] (Macrovision) -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA [Disabled | Stopped])
[2004/08/19 16:09:38 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [On_Demand | Stopped])
[2004/10/22 02:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
[2003/05/14 11:29:54 | 00,753,716 | ---- | M] () -- C:\Program Files\Ahead\InCD\incdsrv.exe -- (InCDsrv [Disabled | Stopped])
[2008/12/20 11:41:39 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
[2005/01/26 15:30:04 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
[2008/05/03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
[2005/01/26 15:25:34 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
[2007/12/28 18:42:09 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Disabled | Stopped])
[2005/01/26 15:20:14 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
[2005/01/28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running])
[2007/01/19 11:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped])
[2006/04/03 17:12:14 | 00,014,032 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend [Disabled | Stopped])

========== Driver Services (SafeList) ==========

[2002/10/11 18:19:00 | 00,046,551 | ---- | M] (Analog Deivces) -- C:\WINDOWS\system32\drivers\adildr.sys -- (ADILOADER [Auto | Stopped])
[2002/11/22 22:14:36 | 00,122,505 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\drivers\adiusbaw.sys -- (adiusbaw [On_Demand | Running])
[2004/02/24 04:08:52 | 00,400,384 | ---- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS [On_Demand | Running])
[2004/03/19 13:02:08 | 00,613,244 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running])
[2009/01/23 18:39:37 | 00,821,856 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avg7core.sys -- (Avg7Core [System | Running])
[2009/01/23 18:34:58 | 00,004,224 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avg7rsw.sys -- (Avg7RsW [System | Running])
[2009/01/23 18:34:58 | 00,027,776 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avg7rsxp.sys -- (Avg7RsXP [System | Running])
[2009/01/23 18:39:47 | 00,010,760 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avgclean.sys -- (AvgClean [System | Running])
[2009/01/23 18:35:00 | 00,004,960 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\system32\drivers\avgtdi.sys -- (AvgTdi [Auto | Running])
[2005/10/17 08:28:09 | 00,012,464 | ---- | M] (Macrovision Europe Ltd) -- C:\WINDOWS\system32\drivers\CdaC15BA.SYS -- (CdaC15BA [Auto | Running])
[2003/12/03 17:44:58 | 00,013,566 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\drivers\cdrbsvsd.sys -- (cdrbsvsd [System | Running])
[2002/11/18 14:51:40 | 00,377,358 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmaudio.sys -- (cmpci [On_Demand | Stopped])
[2006/08/12 02:28:58 | 00,798,464 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmuda3.sys -- (cmuda3 [On_Demand | Running])
[2003/05/14 11:31:32 | 00,085,296 | ---- | M] () -- C:\WINDOWS\system32\drivers\incdfs.sys -- (InCDfs [Disabled | Running])
[2003/05/14 11:31:58 | 00,026,336 | ---- | M] (Ahead Software) -- C:\WINDOWS\system32\drivers\incdpass.sys -- (InCDPass [System | Running])
[2003/04/25 13:13:42 | 00,023,920 | ---- | M] (Ahead Software AG) -- C:\WINDOWS\system32\drivers\incdrm.sys -- (incdrm [System | Running])
[2004/03/12 18:23:56 | 00,845,092 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\Ctxs51.sys -- (Intels51 [On_Demand | Running])
[2008/05/03 05:46:00 | 06,554,496 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv [On_Demand | Running])
[2001/08/28 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink [On_Demand | Running])
[2007/03/08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\pxhelp20.sys -- (PxHelp20 [Boot | Running])
[2001/08/17 22:05:16 | 00,028,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\OVCD.sys -- (QCDonner [On_Demand | Running])
[2004/08/03 22:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139 [On_Demand | Running])
[2001/10/22 14:33:46 | 00,031,728 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\drivers\SCUSPAC.SYS -- (SCUSMFP1 [Auto | Running])
[2001/10/22 14:33:46 | 00,022,796 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\drivers\SCUSPRO.SYS -- (SCUSMFP2 [Auto | Running])
[2001/10/22 14:33:58 | 00,025,768 | ---- | M] (Sharp Corporation) -- C:\WINDOWS\system32\drivers\SCUSUSB.SYS -- (SCUSUSB [On_Demand | Stopped])
[2005/04/20 17:15:52 | 00,163,644 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv [Auto | Running])
[2005/08/10 13:44:04 | 00,050,688 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01 [Boot | Running])
[2005/05/16 14:20:39 | 00,006,656 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02 [Boot | Running])
[2005/04/14 13:12:32 | 00,019,968 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02 [Boot | Running])
[2005/11/03 15:40:07 | 00,063,488 | ---- | M] (Protection Technology) -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02 [Boot | Running])
[2001/08/17 21:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\drivers\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped])
[2005/12/22 12:24:50 | 00,080,272 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\sscdbus.sys -- (sscdbus [On_Demand | Stopped])
[2005/12/22 12:24:52 | 00,010,864 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys -- (sscdmdfl [On_Demand | Stopped])
[2005/12/22 12:24:52 | 00,137,884 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\sscdmdm.sys -- (sscdmdm [On_Demand | Stopped])
[2009/02/07 10:02:09 | 00,102,664 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm [Auto | Running])
[2001/08/28 13:00:00 | 00,012,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\ws2ifsl.sys -- (WS2IFSL [System | Running])
[2006/10/18 09:23:40 | 00,391,866 | ---- | M] (ZSMC Corporation) -- C:\WINDOWS\system32\drivers\ZS211.sys -- (ZSMC211 [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions =
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://windowsupdate.microsoft.com/
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions =
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://windowsupdate.microsoft.com/
HKU\S-1-5-21-1177238915-1409082233-839522115-1003\S-1-5-21-1177238915-1409082233-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (23 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (dcads) - {b9a85eaa-c89c-66bd-46c6-097f778c6d43} - C:\WINDOWS\system32\nso8.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Reg Error: Key does not exist or could not be opened. File not found
O3 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\..\Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Reg Error: Key does not exist or could not be opened. File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP (GRISOFT, s.r.o.)
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe ()
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /install ()
O4 - HKLM..\Run: [SCUSAPI] SCUSAPI.exe (Sharp Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe (ZSMCSNAP)
O4 - HKCU..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (GRISOFT, s.r.o.)
O4 - HKU\S-1-5-18..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (GRISOFT, s.r.o.)
O4 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk = C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe (Sony Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe (Sony Corporation.)
O4 - Startup: C:\Documents and Settings\Cathy\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Léa\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Pascal\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Thomas\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ShutdownWithoutLogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLastUserName = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 0
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 0
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Sites: 41 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Sites: 39 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Sites: 40 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Sites: 40 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1177238915-1409082233-839522115-1003\..Trusted Sites: 39 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} http://messenger.zone.msn.com/binary/ms ... b31267.cab (Checkers Class)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} http://messenger.zone.msn.com/binary/Me ... b31267.cab (MessengerStatsClient Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... mv9dmo.cab (Reg Error: Key does not exist or could not be opened.)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} http://messenger.zone.msn.com/binary/Me ... b31267.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: DirectAnimation Java Classes (Reg Error: Key does not exist or could not be opened.)
O16 - DPF: Microsoft XML Parser for Java (Reg Error: Key does not exist or could not be opened.)
O18 - Protocol\Handler: - ipp - No CLSID value found
O18 - Protocol\Handler: - ipp\0x00000001 - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler: - livecall - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler: - msdaipp - No CLSID value found
O18 - Protocol\Handler: - msdaipp\0x00000001 - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler: - msdaipp\oledb - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler: - msnim - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O20 - See sections below for AppInitDlls and Winlogon settings

========== Shell Execute Hooks ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" (HKLM) -- C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" (HKLM) -- Reg Error: Key does not exist or could not be opened. File not found

========== Safeboot Options ==========

"AlternateShell" = cmd.exe

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []
[2004/11/18 16:08:40 | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT -- [ NTFS ]

========== Files/Folders - Created Within 60 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/02/07 20:20:26 | 00,419,328 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTListIt2.exe
[2009/02/07 20:17:54 | 00,000,000 | ---D | C] -- C:\HJThis
[2009/02/07 17:57:07 | 00,000,000 | ---D | C] -- C:\WINDOWS\BDOSCAN8
[2009/02/07 10:04:48 | 00,102,664 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/02/07 09:36:41 | 00,002,120 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2009/02/07 09:36:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\SmitfraudFix
[2009/02/07 09:18:55 | 00,000,000 | ---D | C] -- C:\VundoFix Backups
[2009/02/07 08:47:43 | 00,001,548 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\CCleaner.lnk
[2009/02/07 08:47:42 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/02/07 08:37:33 | 00,576,868 | ---- | C] (IL-MAFIOSO ) -- C:\Documents and Settings\Pascal\Bureau\Navilog1.exe
[2009/02/07 08:36:46 | 01,661,793 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\SmitfraudFix.exe
[2009/02/07 08:36:32 | 00,096,978 | ---- | C] (Business Information Solutions) -- C:\Documents and Settings\Pascal\Bureau\VirtumundoBeGone.exe
[2009/02/07 00:27:40 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro
[2009/02/07 00:27:32 | 00,000,000 | ---D | C] -- C:\rsit
[2009/02/07 00:15:15 | 00,781,851 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\RSIT.exe
[2009/02/06 22:58:58 | 00,000,000 | ---D | C] -- C:\_OTMoveIt
[2009/02/06 22:55:41 | 00,348,160 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTMoveIt3.exe
[2009/02/06 21:32:50 | 00,000,000 | ---D | C] -- C:\ToolBar SD
[2009/02/06 21:32:08 | 00,343,017 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\ToolBarSD.exe
[2009/02/06 20:27:46 | 00,000,080 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\fix.reg
[2009/02/03 09:15:35 | 00,085,664 | ---- | C] () -- C:\WINDOWS\System32\98a5e3ff-62f9-4650-087a-5f2f16a23de3.exe
[2009/02/03 03:13:29 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009/02/02 23:31:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\backups
[2009/02/02 22:55:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\GenProc
[2009/01/30 01:09:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Application Data\SUPERAntiSpyware.com
[2009/01/30 01:09:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2009/01/30 00:21:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Application Data\Malwarebytes
[2009/01/30 00:21:44 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/01/30 00:21:43 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/01/30 00:21:40 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/01/30 00:21:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/01/30 00:21:38 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/01/29 23:54:00 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/01/29 23:10:25 | 00,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 8.lnk
[2009/01/29 22:24:51 | 00,000,212 | ---- | C] () -- C:\Boot.bak
[2009/01/29 22:24:49 | 00,263,488 | ---- | C] () -- C:\cmldr
[2009/01/29 22:24:41 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/01/29 22:23:37 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/01/29 22:23:37 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/01/29 22:23:37 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/01/29 22:23:37 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/01/29 22:23:37 | 00,089,504 | ---- | C] (Smallfrogs Studio) -- C:\WINDOWS\fdsv.exe
[2009/01/29 22:23:37 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/01/29 22:23:37 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/01/29 22:23:37 | 00,049,152 | ---- | C] () -- C:\WINDOWS\VFIND.exe
[2009/01/29 22:23:37 | 00,029,696 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009/01/29 22:23:32 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/01/29 22:22:48 | 03,048,418 | R--- | C] () -- C:\Documents and Settings\Pascal\Bureau\ComboFix.exe
[2009/01/29 21:32:54 | 00,132,597 | ---- | C] () -- C:\Documents and Settings\Pascal\Bureau\Flash_Disinfector.exe
[2009/01/29 16:20:56 | 00,669,696 | ---- | C] () -- C:\WINDOWS\System32\nso8.dll
[2009/01/29 00:18:03 | 00,009,668 | ---- | C] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090129_001800.reg
[2009/01/28 23:05:32 | 00,038,748 | ---- | C] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090128_230526.reg
[2009/01/23 20:17:45 | 00,000,512 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily).job
[2009/01/23 18:35:01 | 00,010,760 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgclean.sys
[2009/01/23 18:35:01 | 00,001,532 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\AVG 7.5.lnk
[2009/01/23 18:35:00 | 00,026,952 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/01/23 18:35:00 | 00,004,960 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdi.sys
[2009/01/23 18:34:58 | 00,027,776 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsxp.sys
[2009/01/23 18:34:58 | 00,004,224 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsw.sys
[2009/01/23 18:34:56 | 00,821,856 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7core.sys
[2009/01/06 16:31:29 | 00,000,000 | RH-D | C] -- C:\$VAULT$.AVG
[2008/12/26 15:59:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2008/12/26 15:59:30 | 00,008,192 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\E_DCINST.DLL
[2008/12/26 15:59:25 | 00,078,848 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FD4BEDE.DLL
[2008/12/26 15:59:24 | 00,086,528 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FLBEDE.DLL
[2008/12/15 15:04:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Bureau\2008 PHOTOS MAISON CATHY
[2008/12/12 17:59:57 | 00,000,664 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Winamp.lnk
[2008/12/12 17:57:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Pascal\Application Data\Winamp

========== Files - Modified Within 60 Days ==========

[1 C:\WINDOWS\*.tmp files]
[2009/02/08 23:09:09 | 00,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/02/08 23:09:09 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/02/08 23:08:32 | 00,176,754 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009/02/08 23:07:48 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/02/08 23:05:38 | 04,302,902 | -H-- | M] () -- C:\Documents and Settings\Pascal\Local Settings\Application Data\IconCache.db
[2009/02/08 22:42:39 | 00,000,211 | ---- | M] () -- C:\WINDOWS\spnutmp.ini
[2009/02/08 22:36:53 | 00,085,664 | ---- | M] () -- C:\WINDOWS\System32\98a5e3ff-62f9-4650-087a-5f2f16a23de3.exe
[2009/02/08 16:02:55 | 00,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/02/08 16:02:55 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/02/08 10:01:35 | 00,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/02/08 10:01:35 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/02/07 22:46:35 | 00,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/02/07 22:46:34 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/02/07 22:10:22 | 00,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/02/07 22:10:22 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/02/07 21:15:24 | 00,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/02/07 21:15:24 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/02/07 20:27:22 | 01,661,793 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\SmitfraudFix.exe
[2009/02/07 20:20:33 | 00,419,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTListIt2.exe
[2009/02/07 20:12:59 | 00,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/02/07 20:12:58 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/02/07 17:51:24 | 00,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/02/07 17:51:24 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/02/07 17:33:00 | 00,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/02/07 17:33:00 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/02/07 17:31:27 | 00,000,512 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily).job
[2009/02/07 17:31:27 | 00,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2009/02/07 15:42:11 | 00,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
[2009/02/07 15:42:11 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2009/02/07 15:00:46 | 00,000,838 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/02/07 15:00:46 | 00,000,282 | RHS- | M] () -- C:\boot.ini
[2009/02/07 15:00:46 | 00,000,280 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/02/07 14:16:45 | 00,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2009/02/07 14:16:45 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2009/02/07 14:02:16 | 00,002,120 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2009/02/07 11:53:45 | 00,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
[2009/02/07 11:53:44 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2009/02/07 11:37:26 | 00,000,268 | -H-- | M] () -- C:\sqmdata16.sqm
[2009/02/07 11:37:26 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2009/02/07 10:02:09 | 00,102,664 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/02/07 09:46:19 | 00,000,268 | -H-- | M] () -- C:\sqmdata15.sqm
[2009/02/07 09:46:19 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2009/02/07 08:47:43 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\CCleaner.lnk
[2009/02/07 08:37:38 | 00,576,868 | ---- | M] (IL-MAFIOSO ) -- C:\Documents and Settings\Pascal\Bureau\Navilog1.exe
[2009/02/07 08:36:36 | 00,096,978 | ---- | M] (Business Information Solutions) -- C:\Documents and Settings\Pascal\Bureau\VirtumundoBeGone.exe
[2009/02/07 01:03:31 | 00,000,268 | -H-- | M] () -- C:\sqmdata14.sqm
[2009/02/07 01:03:30 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2009/02/07 00:55:35 | 00,000,268 | -H-- | M] () -- C:\sqmdata13.sqm
[2009/02/07 00:55:35 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2009/02/07 00:15:48 | 00,781,851 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\RSIT.exe
[2009/02/06 23:43:09 | 00,000,268 | -H-- | M] () -- C:\sqmdata12.sqm
[2009/02/06 23:43:09 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2009/02/06 23:41:20 | 00,161,936 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/02/06 23:37:27 | 00,033,112 | ---- | M] () -- C:\Documents and Settings\Pascal\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/02/06 23:02:22 | 00,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2009/02/06 23:02:22 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2009/02/06 22:55:46 | 00,348,160 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pascal\Bureau\OTMoveIt3.exe
[2009/02/06 22:40:41 | 00,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2009/02/06 22:40:40 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2009/02/06 22:05:37 | 00,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2009/02/06 22:05:36 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2009/02/06 21:32:13 | 00,343,017 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\ToolBarSD.exe
[2009/02/06 20:27:46 | 00,000,080 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\fix.reg
[2009/02/01 14:24:30 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/01/30 01:27:29 | 00,049,152 | ---- | M] () -- C:\WINDOWS\Domino.EXE
[2009/01/30 00:21:44 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/01/29 23:10:25 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 8.lnk
[2009/01/29 22:21:14 | 03,048,418 | R--- | M] () -- C:\Documents and Settings\Pascal\Bureau\ComboFix.exe
[2009/01/29 21:32:59 | 00,132,597 | ---- | M] () -- C:\Documents and Settings\Pascal\Bureau\Flash_Disinfector.exe
[2009/01/29 19:51:22 | 00,000,584 | ---- | M] () -- C:\Documents and Settings\Pascal\Mes documents\Mes dossiers de partage.lnk
[2009/01/29 16:20:56 | 00,669,696 | ---- | M] () -- C:\WINDOWS\System32\nso8.dll
[2009/01/29 00:18:44 | 00,009,668 | ---- | M] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090129_001800.reg
[2009/01/28 23:05:55 | 00,038,748 | ---- | M] () -- C:\Documents and Settings\Pascal\Mes documents\cc_20090128_230526.reg
[2009/01/28 20:45:50 | 00,000,664 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Winamp.lnk
[2009/01/26 08:57:03 | 00,143,872 | ---- | M] () -- C:\Documents and Settings\Pascal\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/23 18:39:47 | 00,010,760 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgclean.sys
[2009/01/23 18:39:37 | 00,821,856 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7core.sys
[2009/01/23 18:39:37 | 00,026,952 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/01/23 18:35:01 | 00,001,532 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\AVG 7.5.lnk
[2009/01/23 18:35:00 | 00,004,960 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdi.sys
[2009/01/23 18:34:58 | 00,027,776 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsxp.sys
[2009/01/23 18:34:58 | 00,004,224 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\avg7rsw.sys
[2009/01/14 16:11:32 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/01/14 16:11:28 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2008/12/15 15:02:50 | 00,000,836 | ---- | M] () -- C:\Documents and Settings\Pascal\Application Data\ViewerApp.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> %SystemRoot%\Domino.EXE:SummaryInformation
@Alternate Data Stream - 0 bytes -> %SystemRoot%\Domino.EXE:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
<End>

Assiste.Forums

Gros soucis sur le pc

Gros soucis sur le pc

Qui est en ligne