[ok] AIDE pr éliminer "HEUR: Trojan.win32.Generic"

[Elina22]

Bonjour à tous,

Voilà ça fait 15 jours que je tente d'éliminer un virus détecté par Kapersky ( j'ai Kaspersky Antivirus 2009 ) il m'affiche à chaque analyse le message suivant "HEUR: Trojan.win32.Generic", pourtant à plusieurs reprises Kapersky me proposait pour l'éliminer de redémarrer mon ordinateur mais cela n'a rien donné, il ne parvient ni à l'éliminer ni à réparer le fichier affecté ni même à le mettre en quarantaine. Selon l'analyse de Kapersky le virus se situerait dans le fichier suivant: "C:\WINDOWS\system32\cbXNFyyy.dll ". De plus, depuis dimanche Kapersky m'affiche comme résultat "C:\WINDOWS\System32\cbXNFyyy.dll, contenant virus ..Monderd.gen" que je n'arrive pas non plus à me débarrasser .
J'ai également Ad-Aware Anniversary Edition, il a également détecté des Malwares qu'il me propose de supprimer mais pourtant à chaque nouvelle analyse ils réapparaissent. Je sais plus quoi faire, j'ai téléchargé "hijackthis" pour faire un scan de mon PC. Le problème c'est que je ne sais pas comment interpréter le rapport obtenu par "hijackthis", si quelqu'un pouvait m'aider à l'interpréter et surtout m'aider à me débarrasser de ce virus, ce serait sympas de votre part.
Merci d'avance.

Mon Log "Hijackthis" est le suivant:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:39, on 10/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\Program Files\Lexmark 3400 Series\ezprint.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Mes documents\Pilotes et drivers de tous les logiciels installés\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0496338B-5BFC-40D7-AA18-3BA583E1C491} - C:\WINDOWS\system32\urqPiFYS.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1C1D98DB-FE0C-4614-9BAA-615B23A449DD} - C:\WINDOWS\system32\cbXNFyyy.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e71d2087dba642859a8432d186c7fac1
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e71d2087dba642859a8432d186c7fac1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O20 - Winlogon Notify: mlJBqOiH - mlJBqOiH.dll (file missing)
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe

--
End of file - 6925 bytes

[nickW]

Bonsoir,

Recherche, création de deux rapports (logs détaillés):

Remarque préliminaire:
Pour pouvoir utiliser les sauvegardes créées par HijackThis, il faut que le programme HijackThis soit installé dans un dossier non système, non temporaire, et qui lui est réservé.
Je te conseille donc
*- de créer un dossier (par exemple: C:\HJT)
*- d'y déplacer le fichier HijackThis.exe


Note: Ces manips doivent être effectuées en ayant ouvert une session avec les "droits Administrateur" (ne pas utiliser le profil utilisateur nommé "Administrateur" visible en mode sans échec)
Sous Windows XP, pour vérifier si un compte a les droits "Administrateur":
Démarrer---->Paramètres---->Panneau de configuration---->Comptes d'utilisateurs
A côté de l'icône représentant certains comptes (hormis celui nommé "Administrateur"), il est indiqué "Administrateur de l'ordinateur"
C'est l'un de ces comptes qu'il faudra utiliser.


Étape 1: Malwarebytes' Anti-Malware, installation
Télécharger Malwarebytes' Anti-Malware depuis l'un des liens ci-dessous:
http://www.besttechie.net/tools/mbam-setup.exe
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Enregistrer ce fichier sur le Bureau.
Faire un double clic sur mbam-setup.exe pour lancer l'installation (Accepter le contrat de licence, puis valider les options par défaut).
Sur le dernier écran de la procédure d'installation, cocher la case située devant "Mettre à jour Malwarebytes' Anti-Malware", puis cliquer sur le bouton "Terminer".


Étape 2: OTListIt2 (de OldTimer), téléchargement
Télécharger OTListIt2.exe depuis http://oldtimer.geekstogo.com/OTListIt2.exe
Enregistrer ce fichier sur le Bureau.


Étape 3: Pas de processus de contrôle en temps réel
Désactiver le module résident de l'antivirus.
Kaspersky: clic droit sur l'icône dans la SysBarre (à coté de l'horloge), puis "Suspension de la protection...", "A la demande de l'utilisateur".


Étape 4: Malwarebytes' Anti-Malware, recherche
Fermer toutes les fenêtres de programme ouvertes.
Lancer Malwarebytes' Anti-Malware via le Menu Démarrer.
Dans l'onglet Paramètres, vérifier que toutes les cases sont cochées sauf "Créer une option dans le menu contextuel pour analyser des fichiers (clic droit)".
Dans l'onglet Mise à jour, cliquer sur le bouton Recherche de mise à jour et installer toutes les mises à jour trouvées.
Dans l'onglet Recherche, cocher le bouton radio situé devant "Exécuter un examen rapide" puis cliquer sur le bouton Rechercher.
Attendre sans rien faire d'autre la fin de la recherche; dans la fenêtre annonçant la fin de l'analyse, cliquer sur OK; puis cliquer sur le bouton "Afficher les résultats".

Cliquer sur le bouton "Enregistrer le rapport", valider la sauvegarde, puis cliquer sur le bouton "Quitter"


Étape 5: Processus de contrôle en temps réel
Important: Réactiver le module résident de l'antivirus.


Étape 6: OTListIt2 (de OldTimer)
Fermer toutes les fenêtres de programme ouvertes.

Faire un double clic sur OTListIt2.exe pour lancer l'outil.

L'écran principal de OTListIt2 s'affiche:


Si ce n'est déjà fait, dans le paragraphe Extra Registry, cocher le bouton-radio Use SafeList

Cocher (en haut) la case située devant Scan All Users:

Puis cliquer sur le bouton Run Scan:

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer le Bloc-notes.
Le second rapport est visible dans la Barre des tâches. Le fermer également.
Fermer la fenêtre de OTListIt2.


Étape 7: Résultats
Envoyer en réponse:
*- le log de Malwarebytes' Anti-Malware (contenu du fichier mbam-log-*-**-**** (**-**-**).txt situé dans le dossier SystemDrive\Documents and Settings\<tonprofil>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs / *-**-**** (**-**-**) représente la date [mois-jour-année] et l'heure [hh-mn-ss])
[SystemDrive représente la partition sur laquelle est installé le système, généralement C:]

Envoyer ensuite en réponse dans deux messages distincts (à cause de la longueur des logs):
*- les deux rapports de OTListIt2 (contenu des fichiers OTListIt.txt et Extras.txt situés sur le Bureau).
Les rapports envoyés sur le forum doivent se terminer par une ligne contenant <End>. Si ce n'est pas le cas, ils sont incomplets, et doivent alors être découpés en plusieurs messages.

Note importante: Pour l'envoi de ta(tes) réponse(s), il ne faut pas créer un nouveau sujet, mais cliquer sur le bouton "Répondre"
pour continuer dans ce fil de discussion.


A suivre,

[Elina22]

Bonjour, Merci de m'avoir répondu. Voici les résultats de Malwarebytes 'anti-malware':

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1761
Windows 5.1.2600 Service Pack 2

14/02/2009 17:41:37
mbam-log-2009-02-14 (17-40-10).txt

Type de recherche: Examen rapide
Eléments examinés: 73974
Temps écoulé: 12 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\cbXNFyyy.dll (Trojan.Vundo.H) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88ea3465-c1e8-4433-a678-0833b836505b} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{88ea3465-c1e8-4433-a678-0833b836505b} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{88ea3465-c1e8-4433-a678-0833b836505b} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d8134e32 (Trojan.Vundo.H) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\cbxnfyyy -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\cbxnfyyy -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\cbXNFyyy.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\yyyFNXbc.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\yyyFNXbc.ini2 (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\iajaouju.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ujuoajai.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\osqxmegi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\igemxqso.ini (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Temporary Internet Files\Content.IE5\WXI7016F\upd105320[1] (Trojan.Vundo) -> No action taken.

[Elina22]

Voici les résultats de OTListIT2.exe:

OTListIt logfile created on: 14/02/2009 17:44:57 - Run
OTListIt2 by OldTimer - Version 2.0.0.11 Folder = C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

511,48 Mb Total Physical Memory | 108,78 Mb Available Physical Memory | 21,27% Memory free
1,21 Gb Paging File | 0,87 Gb Available in Paging File | 71,42% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372,01 Gb Total Space | 332,89 Gb Free Space | 89,48% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ZOGAGHI
Current User Name: ZOGAGHI BOUCHRA
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - [2009/02/06 23:08:00 | 00,950,096 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2007/06/13 14:22:28 | 01,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/03/06 18:48:46 | 00,286,720 | ---- | M] () -- C:\Program Files\Lexmark 3400 Series\lxcymon.exe
PRC - [2006/02/07 06:10:34 | 00,098,304 | ---- | M] (Lexmark International Inc.) -- C:\Program Files\Lexmark 3400 Series\ezprint.exe
PRC - [2007/04/16 15:28:22 | 00,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
PRC - [2008/06/10 04:27:04 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
PRC - [2008/11/18 15:11:59 | 00,185,872 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
PRC - [2009/02/06 23:08:04 | 00,509,784 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2007/01/19 12:55:02 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe
PRC - [2004/08/05 13:00:00 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
PRC - [2004/10/13 17:24:37 | 01,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2004/08/05 13:00:00 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
PRC - [2008/09/30 17:45:02 | 07,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2008/09/30 17:46:14 | 07,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2006/02/20 20:23:08 | 00,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcycoms.exe
PRC - [2004/08/05 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2004/08/05 13:00:00 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2004/08/05 13:00:00 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2008/06/10 04:27:03 | 00,329,104 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
PRC - [2009/02/14 17:22:45 | 00,491,008 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\OTListIt2.exe

========== Win32 Services (SafeList) ==========

SRV - [2005/09/23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009/02/10 14:30:49 | 00,206,088 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe -- (AVP [Auto | Running])
SRV - [2005/09/23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2004/08/05 13:00:00 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009/02/06 23:08:00 | 00,950,096 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [Auto | Running])
SRV - [2006/02/20 20:23:08 | 00,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcycoms.exe -- (lxcy_device [On_Demand | Running])
SRV - [2007/08/24 03:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2007/01/19 12:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped])
SRV - [2006/11/03 09:59:14 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2006/09/28 18:56:14 | 00,055,808 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WudfSvc.dll -- (WudfSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2008/09/24 10:40:22 | 04,122,368 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM [On_Demand | Running])
DRV - [2004/08/04 01:38:44 | 00,701,440 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2004/10/20 14:23:34 | 00,021,344 | ---- | M] (FreeBox SA) -- C:\WINDOWS\system32\drivers\fbxusb32.sys -- (fbxusb [On_Demand | Running])
DRV - [2004/08/05 13:00:00 | 00,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\kbdhid.sys -- (kbdhid [System | Running])
DRV - [2008/07/21 17:34:36 | 00,121,872 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1 [Boot | Running])
DRV - [2009/02/10 14:30:49 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg [Boot | Running])
DRV - [2009/02/10 14:30:49 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF [System | Running])
DRV - [2008/04/30 17:06:48 | 00,024,592 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5 [On_Demand | Running])
DRV - [2009/02/06 23:08:28 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\drivers\Lbd.sys -- (Lbd [Boot | Running])
DRV - [2004/08/05 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008/09/19 22:57:32 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2007/11/13 11:25:54 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\S-1-5-21-1078081533-1580818891-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (790 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {0496338B-5BFC-40D7-AA18-3BA583E1C491} - C:\WINDOWS\system32\urqPiFYS.dll File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {88EA3465-C1E8-4433-A678-0833B836505B} - C:\WINDOWS\system32\cbXNFyyy.dll ()
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\..\Toolbar\ShellBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" (Kaspersky Lab)
O4 - HKLM..\Run: [d8134e32] rundll32.exe "C:\WINDOWS\system32\lvxycvai.dll",b File not found
O4 - HKLM..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe" (Lexmark International Inc.)
O4 - HKLM..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s ()
O4 - HKLM..\Run: [Hold option boob bin] C:\Documents and Settings\All Users\Application Data\ford does hold option\bore bike.exe (Tads fton)
O4 - HKLM..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16 ()
O4 - HKLM..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe" ()
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [purelog] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\INTERN~1\MORE NURB SKIP.exe (Pofbenc)
O4 - HKCU..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (Shareaza Development Team)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (Microsoft Corporation)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [purelog] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\INTERN~1\MORE NURB SKIP.exe (Pofbenc)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (Shareaza Development Team)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\ZOGAGHI BOUCHRA\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e71d2087dba642859a8432d186c7fac1
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e71d2087dba642859a8432d186c7fac1
O9 - Extra 'Tools' menuitem : Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Me ... b56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: () - File not found
O20 - AppInit_DLLs: (c:\progra~1\kasper~1\kasper~1\mzvkbd.dll) - c:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll) - c:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd3.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\mlJBqOiH: DllName - mlJBqOiH.dll - File not found
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O30 - LSA: Authentication Packages - (C:\WINDOWS\system32\cbXNFyyy) - C:\WINDOWS\system32\cbXNFyyy.dll ()
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/11/14 20:48:49 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/11/15 20:43:27 | 00,000,011 | ---- | M] () - C:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{5491adcc-b295-11dd-bf85-0007cb0000ff}\Shell\Auto\command - "" = C:\WINDOWS\system32\cmd.exe -- [2004/08/05 13:00:00 | 00,400,896 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{70921869-b331-11dd-bf8b-0007cb0000ff}\Shell - "" = AutoRun
O33 - MountPoints2\{735ba1c4-b324-11dd-bf8a-0007cb0000ff}\Shell - "" = AutoRun

========== Files/Folders - Created Within 30 Days ==========

[6 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/02/14 17:22:39 | 00,491,008 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\OTListIt2.exe
[2009/02/14 17:19:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Application Data\Malwarebytes
[2009/02/14 17:18:58 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/02/14 17:18:58 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/02/14 17:18:55 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/02/14 17:18:54 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/02/14 17:18:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/02/14 17:17:22 | 02,876,720 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\mbam-setup.exe
[2009/02/14 17:11:10 | 00,000,090 | -HS- | C] () -- C:\WINDOWS\klif.spi
[2009/02/14 14:52:51 | 00,000,000 | ---D | C] -- C:\HIJTHIS
[2009/02/14 14:20:58 | 01,678,488 | -HS- | C] () -- C:\WINDOWS\System32\iavcyxvl.ini
[2009/02/14 00:24:22 | 00,000,290 | -H-- | C] () -- C:\WINDOWS\tasks\A5EB2A3491E8DD68.job
[2009/02/14 00:22:08 | 00,000,000 | ---D | C] -- C:\Program Files\Internetcast
[2009/02/13 20:36:39 | 01,683,081 | -HS- | C] () -- C:\WINDOWS\System32\ujuoajai.ini
[2009/02/13 20:36:38 | 00,083,968 | ---- | C] () -- C:\WINDOWS\System32\iajaouju.dll
[2009/02/12 20:22:11 | 01,683,081 | -HS- | C] () -- C:\WINDOWS\System32\igemxqso.ini
[2009/02/12 20:22:04 | 00,084,992 | ---- | C] () -- C:\WINDOWS\System32\osqxmegi.dll
[2009/02/12 18:43:05 | 01,671,294 | -HS- | C] () -- C:\WINDOWS\System32\lkcrhjya.ini
[2009/02/11 18:40:22 | 01,671,285 | -HS- | C] () -- C:\WINDOWS\System32\fpcbacrv.ini
[2009/02/11 16:05:41 | 01,632,193 | -HS- | C] () -- C:\WINDOWS\System32\nfwjjxka.ini
[2009/02/10 16:03:14 | 01,629,665 | -HS- | C] () -- C:\WINDOWS\System32\dypclrml.ini
[2009/02/10 15:13:28 | 01,629,666 | -HS- | C] () -- C:\WINDOWS\System32\bqcfqpav.ini
[2009/02/09 15:11:42 | 01,659,021 | -HS- | C] () -- C:\WINDOWS\System32\ctrkoclb.ini
[2009/02/08 15:04:10 | 01,659,525 | -HS- | C] () -- C:\WINDOWS\System32\wdfirtnf.ini
[2009/02/08 13:53:18 | 01,659,516 | -HS- | C] () -- C:\WINDOWS\System32\bmcxwboe.ini
[2009/02/08 12:42:32 | 00,000,512 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/02/07 13:52:59 | 01,659,525 | -HS- | C] () -- C:\WINDOWS\System32\ykboacet.ini
[2009/02/06 23:45:22 | 00,015,688 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2009/02/06 23:09:06 | 00,064,160 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2009/02/06 23:01:22 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009/02/06 23:01:18 | 00,000,883 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Ad-Aware.lnk
[2009/02/06 23:01:01 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2009/02/06 13:35:39 | 00,000,120 | -HS- | C] () -- C:\WINDOWS\System32\rllmhyit.ini
[2009/02/05 19:12:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Suis-Je le Gardien de Mon Frère-
[2009/02/05 00:38:24 | 01,636,390 | -HS- | C] () -- C:\WINDOWS\System32\aqgxtgpn.ini
[2009/02/04 23:00:43 | 01,636,390 | -HS- | C] () -- C:\WINDOWS\System32\bknwwpoy.ini
[2009/02/04 20:12:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\JEUX DE NDS
[2009/02/04 14:22:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/02/03 23:00:09 | 01,622,398 | -HS- | C] () -- C:\WINDOWS\System32\jofgblby.ini
[2009/02/03 21:30:06 | 01,622,398 | -HS- | C] () -- C:\WINDOWS\System32\ucqwmhqi.ini
[2009/02/03 13:31:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
[2009/02/01 20:11:32 | 00,034,223 | -HS- | C] () -- C:\WINDOWS\System32\yyyFNXbc.ini2
[2009/02/01 20:11:31 | 00,034,223 | -HS- | C] () -- C:\WINDOWS\System32\yyyFNXbc.ini
[2009/02/01 20:11:18 | 00,247,482 | ---- | C] () -- C:\WINDOWS\System32\cbXNFyyy.dll
[2009/02/01 19:35:47 | 26,888,669 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\chèque.pdf
[2009/01/31 23:19:54 | 00,383,025 | -HS- | C] () -- C:\WINDOWS\System32\SYFiPqru.ini2
[2009/01/31 23:19:54 | 00,383,025 | -HS- | C] () -- C:\WINDOWS\System32\SYFiPqru.ini
[2009/01/31 16:28:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2009/01/31 16:23:30 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2009/01/31 16:22:01 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2009/01/30 19:01:12 | 00,000,336 | ---- | C] () -- C:\WINDOWS\tasks\piflenbw.job
[2009/01/29 00:13:53 | 00,795,960 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\plat zog.JPG
[2009/01/29 00:13:20 | 00,770,028 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6272.JPG
[2009/01/29 00:13:11 | 00,830,100 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6273.JPG
[2009/01/28 22:56:12 | 00,014,158 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\BLAGUE.docx
[2009/01/28 21:57:30 | 00,704,400 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\EmoticonesLove.exe
[2009/01/27 22:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Application Data\Apple Computer
[2009/01/26 13:22:17 | 00,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\QuickTime Player.lnk
[2009/01/26 13:21:30 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009/01/26 13:21:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/01/26 13:20:49 | 00,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/01/26 13:20:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\Apple
[2009/01/26 13:20:32 | 00,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2009/01/26 13:20:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple
[2009/01/26 13:20:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\Apple Computer
[2009/01/25 12:07:55 | 00,000,268 | -H-- | C] () -- C:\sqmdata01.sqm
[2009/01/25 12:07:55 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt01.sqm
[2009/01/22 21:02:48 | 00,016,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2009/01/22 21:00:28 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2009/01/22 20:57:05 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/01/22 20:56:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2009/01/22 20:56:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2009/01/21 22:41:55 | 00,123,874 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0092.jpg
[2009/01/21 22:41:55 | 00,123,165 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0090.jpg
[2009/01/21 22:41:54 | 00,117,564 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Aissa Bo bébé.jpg
[2009/01/21 22:41:53 | 00,085,122 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0094.jpg
[2009/01/21 22:41:41 | 00,091,629 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0099.jpg
[2009/01/19 21:58:34 | 00,011,590 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pour la pute.docx
[2009/01/18 13:31:37 | 00,597,266 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6197.JPG
[2009/01/18 01:08:00 | 00,010,854 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\lettre de motivation.docx
[2009/01/17 19:05:26 | 00,019,498 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Votre transaction a bien été enregistrée.docx
[2009/01/17 19:03:30 | 00,009,026 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\SIPS.htm
[2009/01/17 15:30:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Application Data\com.zipeg
[2009/01/17 15:29:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\com.zipeg
[2009/01/17 15:29:48 | 00,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Zipeg.lnk
[2009/01/17 15:29:48 | 00,000,000 | ---D | C] -- C:\Program Files\Zipeg
[2009/01/16 19:21:13 | 00,011,615 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pouillet.docx
[2009/01/15 20:44:05 | 00,269,171 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00741.JPG
[2009/01/15 20:44:05 | 00,253,775 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00742.JPG
[2009/01/15 20:44:05 | 00,251,286 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00739.JPG
[2009/01/15 20:44:05 | 00,237,774 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00744.JPG
[2009/01/15 20:44:05 | 00,176,013 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00743.JPG
[2009/01/15 20:44:03 | 00,195,253 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00722.JPG
[2009/01/15 20:44:03 | 00,183,597 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00746.JPG
[2009/01/15 20:44:03 | 00,179,819 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00745.JPG
[2009/01/15 20:36:06 | 00,041,259 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00712.JPG
[2009/01/15 20:34:28 | 00,212,341 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00732.JPG
[2009/01/15 20:32:46 | 00,073,280 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\SP_A0259.jpg
[2009/01/15 20:32:40 | 00,046,280 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo 0249.jpg
[2009/01/15 20:32:35 | 00,045,576 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo 0251.jpg
[2009/01/15 20:32:28 | 00,434,533 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Ma creation.jpg
[2009/01/15 20:32:25 | 00,110,985 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Ma creation 2.jpg
[2009/01/15 20:32:21 | 00,435,472 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Ma creation 3.jpg
[2009/01/15 20:31:53 | 00,414,292 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\AISSA ET MOI.jpg
[2009/01/15 20:31:47 | 00,606,068 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\24122007.jpg
[2009/01/15 20:30:37 | 00,302,129 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00559.JPG
[2009/01/15 20:30:28 | 00,277,770 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00703.JPG
[2009/01/15 20:30:20 | 00,014,200 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00736.JPG
[2009/01/15 19:26:32 | 00,011,287 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\parol.docx

========== Files - Modified Within 30 Days ==========

[6 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/02/14 17:46:23 | 00,034,223 | -HS- | M] () -- C:\WINDOWS\System32\yyyFNXbc.ini
[2009/02/14 17:45:48 | 00,034,223 | -HS- | M] () -- C:\WINDOWS\System32\yyyFNXbc.ini2
[2009/02/14 17:22:45 | 00,491,008 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\OTListIt2.exe
[2009/02/14 17:18:58 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/02/14 17:17:22 | 02,876,720 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\mbam-setup.exe
[2009/02/14 17:11:10 | 00,000,090 | -HS- | M] () -- C:\WINDOWS\klif.spi
[2009/02/14 17:10:21 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/02/14 17:09:32 | 00,000,336 | ---- | M] () -- C:\WINDOWS\tasks\piflenbw.job
[2009/02/14 17:09:32 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/02/14 17:09:25 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/02/14 17:09:23 | 53,639,9872 | -HS- | M] () -- C:\hiberfil.sys
[2009/02/14 17:07:34 | 00,557,088 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2009/02/14 17:07:34 | 00,002,984 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
[2009/02/14 17:07:33 | 02,218,528 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2009/02/14 17:07:33 | 00,018,412 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2009/02/14 17:02:31 | 00,000,274 | ---- | M] () -- C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job
[2009/02/14 17:02:23 | 00,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\A5EB2A3491E8DD68.job
[2009/02/14 14:21:54 | 00,000,587 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Mes dossiers de partage.lnk
[2009/02/14 14:21:23 | 01,678,488 | -HS- | M] () -- C:\WINDOWS\System32\iavcyxvl.ini
[2009/02/13 23:11:28 | 00,000,512 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/02/13 20:36:50 | 01,683,081 | -HS- | M] () -- C:\WINDOWS\System32\ujuoajai.ini
[2009/02/13 20:36:38 | 00,083,968 | ---- | M] () -- C:\WINDOWS\System32\iajaouju.dll
[2009/02/13 20:35:43 | 01,683,081 | -HS- | M] () -- C:\WINDOWS\System32\igemxqso.ini
[2009/02/12 20:22:04 | 00,084,992 | ---- | M] () -- C:\WINDOWS\System32\osqxmegi.dll
[2009/02/12 18:57:21 | 01,671,294 | -HS- | M] () -- C:\WINDOWS\System32\lkcrhjya.ini
[2009/02/12 18:41:29 | 01,671,285 | -HS- | M] () -- C:\WINDOWS\System32\fpcbacrv.ini
[2009/02/12 17:51:05 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/02/11 16:05:44 | 01,632,193 | -HS- | M] () -- C:\WINDOWS\System32\nfwjjxka.ini
[2009/02/11 10:19:42 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/02/11 10:19:34 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/02/10 16:03:22 | 01,629,665 | -HS- | M] () -- C:\WINDOWS\System32\dypclrml.ini
[2009/02/10 15:13:31 | 01,629,666 | -HS- | M] () -- C:\WINDOWS\System32\bqcfqpav.ini
[2009/02/10 14:30:49 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2009/02/10 14:30:49 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klbg.sys
[2009/02/09 19:22:03 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/09 15:11:58 | 01,659,021 | -HS- | M] () -- C:\WINDOWS\System32\ctrkoclb.ini
[2009/02/08 17:32:26 | 01,659,525 | -HS- | M] () -- C:\WINDOWS\System32\wdfirtnf.ini
[2009/02/08 13:53:25 | 01,659,516 | -HS- | M] () -- C:\WINDOWS\System32\bmcxwboe.ini
[2009/02/07 14:00:56 | 01,659,525 | -HS- | M] () -- C:\WINDOWS\System32\ykboacet.ini
[2009/02/06 23:08:58 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2009/02/06 23:08:28 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2009/02/06 23:01:18 | 00,000,883 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Ad-Aware.lnk
[2009/02/06 13:35:39 | 00,000,120 | -HS- | M] () -- C:\WINDOWS\System32\rllmhyit.ini
[2009/02/05 00:38:37 | 01,636,390 | -HS- | M] () -- C:\WINDOWS\System32\aqgxtgpn.ini
[2009/02/04 23:00:51 | 01,636,390 | -HS- | M] () -- C:\WINDOWS\System32\bknwwpoy.ini
[2009/02/03 23:00:23 | 01,622,398 | -HS- | M] () -- C:\WINDOWS\System32\jofgblby.ini
[2009/02/03 21:30:22 | 01,622,398 | -HS- | M] () -- C:\WINDOWS\System32\ucqwmhqi.ini
[2009/02/03 18:42:14 | 00,101,287 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2009/02/03 18:42:14 | 00,089,601 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2009/02/01 20:11:28 | 00,247,482 | ---- | M] () -- C:\WINDOWS\System32\cbXNFyyy.dll
[2009/02/01 19:35:50 | 26,888,669 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\chèque.pdf
[2009/02/01 14:48:27 | 00,383,025 | -HS- | M] () -- C:\WINDOWS\System32\SYFiPqru.ini
[2009/02/01 14:45:56 | 00,383,025 | -HS- | M] () -- C:\WINDOWS\System32\SYFiPqru.ini2
[2009/01/31 16:27:24 | 00,885,844 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/01/31 16:27:24 | 00,461,404 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2009/01/31 16:27:24 | 00,395,336 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/01/31 16:27:24 | 00,072,366 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2009/01/31 16:27:24 | 00,059,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/01/28 23:02:17 | 00,014,158 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\BLAGUE.docx
[2009/01/28 21:57:30 | 00,704,400 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\EmoticonesLove.exe
[2009/01/27 13:34:00 | 00,795,960 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\plat zog.JPG
[2009/01/26 13:22:18 | 00,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\QuickTime Player.lnk
[2009/01/26 11:33:02 | 00,830,100 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6273.JPG
[2009/01/26 11:32:48 | 00,770,028 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6272.JPG
[2009/01/26 00:51:03 | 04,844,986 | -H-- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\IconCache.db
[2009/01/25 12:07:55 | 00,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/01/25 12:07:55 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/01/23 15:11:02 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/01/22 21:15:27 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009/01/22 21:15:27 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009/01/22 21:01:12 | 00,000,633 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/01/22 20:58:38 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009/01/22 20:57:05 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/01/20 22:02:24 | 00,117,564 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Aissa Bo bébé.jpg
[2009/01/20 17:27:02 | 00,091,629 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0099.jpg
[2009/01/20 17:26:44 | 00,085,122 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0094.jpg
[2009/01/20 17:26:08 | 00,123,165 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0090.jpg
[2009/01/20 17:25:46 | 00,123,874 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0092.jpg
[2009/01/19 22:56:04 | 00,011,590 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pour la pute.docx
[2009/01/18 21:36:23 | 00,002,738 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2009/01/18 14:56:16 | 04,003,769 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\wyclef jean - ecleftic 2 sides to a book - perfect gentleman.mp3
[2009/01/18 13:51:27 | 00,415,744 | -HS- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Thumbs.db
[2009/01/18 13:33:53 | 00,597,266 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6197.JPG
[2009/01/18 01:08:01 | 00,010,854 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\lettre de motivation.docx
[2009/01/17 19:05:27 | 00,019,498 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Votre transaction a bien été enregistrée.docx
[2009/01/17 19:03:31 | 00,009,026 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\SIPS.htm
[2009/01/17 15:29:48 | 00,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Zipeg.lnk
[2009/01/16 19:33:00 | 00,011,615 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pouillet.docx
[2009/01/15 19:26:34 | 00,011,287 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\parol.docx
[2009/01/15 18:40:32 | 00,183,597 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00746.JPG
[2009/01/15 18:40:22 | 00,179,819 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00745.JPG
[2009/01/15 18:40:10 | 00,237,774 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00744.JPG
[2009/01/15 18:38:40 | 00,176,013 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00743.JPG
[2009/01/15 18:38:24 | 00,253,775 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00742.JPG
[2009/01/15 18:38:12 | 00,269,171 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00741.JPG
[2009/01/15 18:37:46 | 00,251,286 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSC00739.JPG

========== Alternate Data Streams ==========

@Alternate Data Stream - 16 bytes -> C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Shareaza Downloads:Shareaza.GUID
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 0 bytes -> C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Thumbs.db:encryptable
<End>

[Elina22]

Pour finir voici les résultats Extras.txt:

OTListIt Extras logfile created on: 14/02/2009 17:44:57 - Run
OTListIt2 by OldTimer - Version 2.0.0.11 Folder = C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

511,48 Mb Total Physical Memory | 108,78 Mb Available Physical Memory | 21,27% Memory free
1,21 Gb Paging File | 0,87 Gb Available in Paging File | 71,42% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372,01 Gb Total Space | 332,89 Gb Free Space | 89,48% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ZOGAGHI
Current User Name: ZOGAGHI BOUCHRA
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2007/01/19 12:55:02 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
[2007/01/04 16:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2007/01/19 12:55:02 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
[2007/01/04 16:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
File not found -- C:\Program Files\eMule\emule.exe:*:Enabled:eMule
[2008/10/01 12:00:14 | 05,723,136 | ---- | M] (Shareaza Development Team) -- C:\Program Files\Shareaza\Shareaza.exe:*:Enabled:Shareaza
[2008/05/21 04:37:24 | 12,844,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
[2004/10/13 17:24:37 | 01,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
[2008/11/18 15:12:11 | 00,214,536 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05AE605F-3146-46ED-BC52-0A14EBF57962}" = Windows Live Toolbar
"{175B7C4A-CAF8-437A-B597-73E0D2D970FE}" = Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3585ED1C-74C5-43B0-A232-831B96A12A2B}" = Menus intelligents (Windows Live Toolbar)
"{4002F73D-EBB3-4EA1-A2FF-DBCB4529759E}" = Barre d'outils Outlook de Windows Live (Windows Live Toolbar)
"{49672EC2-171B-47B4-8CE7-50D7806360D7}" = Windows Live Sign-in Assistant
"{49E597BA-63D3-4936-9E02-AEDB5D1FE002}" = MP Manager
"{51F366F4-C2E4-429A-866A-59C885ED42FD}" = Bloqueur de fenêtres pop-up (Windows Live Toolbar)
"{6580C5A3-2336-4EC5-85F1-3448C5F6208A}" = Kaspersky Anti-Virus 2009
"{6860B340-530D-46B3-91F8-1AE1F70F7C33}" = OpenOffice.org 3.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0010-040C-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (French) 12
"{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_STANDARD_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_STANDARD_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_STANDARD_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_STANDARD_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_STANDARD_{5A2F65A4-808F-4A1E-973E-92E17824982D}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_STANDARD_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_STANDARD_{B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARD_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_STANDARD_{EC50B538-CBE1-42E6-B7FE-87AA540AADFB}" = Microsoft Office Language Pack 2007 Service Pack 1 (SP1)
"{AC76BA86-7AD7-1036-7B44-A90000000001}" = Adobe Reader 9 - Français
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{D518AD32-C710-4616-BA0D-D4B1FA5F82E8}" = Extension de Windows Live Toolbar (Windows Live Toolbar)
"{DCE65B11-710D-4C54-9DE5-1A6A0BD2186B}" = Windows Live Favorites pour Windows Live Toolbar
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E74559C2-BB47-45AD-83DD-0D66B67E7811}" = Navigation par onglets (Windows Live Toolbar)
"{F242B06B-517F-4D62-B654-16B11564A912}" = OneCare Advisor (Windows Live Toolbar)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}" = Windows Live Messenger
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Free.fr" = Free - Kit de connexion
"HijackThis" = HijackThis 2.0.2
"InstallWIX_{6580C5A3-2336-4EC5-85F1-3448C5F6208A}" = Kaspersky Anti-Virus 2009
"Lexmark 3400 Series" = Lexmark 3400 Series
"Lexmark Fax Solutions" = Solutions de télécopie Lexmark
"Magic Photo Editor_is1" = Magic Photo Editor 4.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live & Sponsor (CiD)
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MsgPlus! Plugin" = Messenger Plus! 3 & Sponsor
"PhotoFiltre" = PhotoFiltre
"PhotoFiltre Studio" = PhotoFiltre Studio
"RealPlayer 6.0" = RealPlayer
"Shareaza_is1" = Shareaza 2.4.0.0
"STANDARD" = Microsoft Office Standard 2007
"Windows Live Toolbar" = Windows Live Toolbar
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Lecteur Windows Media 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Zipeg" = Zipeg

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 13/02/2009 15:35:51 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 13/02/2009 15:45:08 | Computer Name = ZOGAGHI | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.

Error - 13/02/2009 17:06:58 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 13/02/2009 17:17:38 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante iexplore.exe, version 6.0.2900.2180, module
défaillant flash10a.ocx, version 10.0.12.36, adresse de défaillance 0x00129cad.

Error - 13/02/2009 17:30:23 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 14/02/2009 09:20:51 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 14/02/2009 10:59:52 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 14/02/2009 11:03:44 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 14/02/2009 11:09:34 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

Error - 14/02/2009 12:10:03 | Computer Name = ZOGAGHI | Source = Application Error | ID = 1000
Description = Application défaillante shareaza.exe, version 2.4.0.0, module défaillant
shareaza.exe, version 2.4.0.0, adresse de défaillance 0x0008e4af.

[ System Events ]
Error - 12/02/2009 19:02:01 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 07:02:02 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 10:02:01 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 16:02:01 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 18:03:15 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 19:02:11 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 20:02:01 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 13/02/2009 21:02:00 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 14/02/2009 10:02:01 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 14/02/2009 12:02:30 | Computer Name = ZOGAGHI | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service wuauserv
avec les arguments "" pour démarrer le serveur : {E60687F7-01A1-40AA-86AC-DB1CBF673334}


<End>



Merci encore pour votre aide, j'attends votre réponse.

[nickW]

Bonsoir,

Premiers nettoyages:

Note: Ces manips doivent être effectuées en ayant ouvert une session avec les "droits Administrateur" (ne pas utiliser le profil utilisateur nommé "Administrateur" visible en mode sans échec)


Étape 1: Pas de processus de contrôle en temps réel
Désactiver le module résident de l'antivirus.
Kaspersky: clic droit sur l'icône dans la SysBarre (à coté de l'horloge), puis "Suspension de la protection...", "A la demande de l'utilisateur".


Étape 2: Malwarebytes' Anti-Malware, nettoyage
Fermer toutes les fenêtres de programme ouvertes.
Lancer Malwarebytes' Anti-Malware via le Menu Démarrer.
Dans l'onglet Paramètres, vérifier que toutes les cases sont cochées sauf "Créer une option dans le menu contextuel pour analyser des fichiers (clic droit)".
Dans l'onglet Mise à jour, cliquer sur le bouton Recherche de mise à jour et installer toutes les mises à jour trouvées.
Dans l'onglet Recherche, cocher le bouton radio situé devant "Exécuter un examen rapide" puis cliquer sur le bouton Rechercher.
Attendre sans rien faire d'autre la fin de la recherche; dans la fenêtre annonçant la fin de l'analyse, cliquer sur OK; puis cliquer sur le bouton "Afficher les résultats".

Si des éléments nuisibles ont été détectés, cliquer sur le bouton "Supprimer la sélection"
Attendre patiemment sans rien faire d'autre la fin du nettoyage.
Un redémarrage est parfois nécessaire. Accepter.
Une fenêtre du Bloc-notes s'ouvre pour afficher le rapport. Fermer le Bloc-notes.
Cliquer sur le bouton "Quitter" pour fermer Malwarebytes' Anti-Malware.


Étape 3: Processus de contrôle en temps réel
Important: Réactiver le module résident de l'antivirus.


Étape 4: OTListIt2 (de OldTimer)
Fermer toutes les fenêtres de programme ouvertes.

Faire un double clic sur OTListIt2.exe pour lancer l'outil.

L'écran principal de OTListIt2 s'affiche:


Cocher (en haut) la case située devant Scan All Users:

Puis cliquer sur le bouton Run Scan:

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer le Bloc-notes.
Fermer la fenêtre de OTListIt2.


Étape 5: Résultats
Envoyer en réponse:
*- le log de Malwarebytes' Anti-Malware (contenu du fichier mbam-log-*-**-**** (**-**-**).txt situé dans le dossier SystemDrive\Documents and Settings\<tonprofil>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs / *-**-**** (**-**-**) représente la date [mois-jour-année] et l'heure [hh-mn-ss])
[SystemDrive représente la partition sur laquelle est installé le système, généralement C:]

Envoyer ensuite en réponse dans un message distinct (à cause de la longueur du log):
*- le rapport principal de OTListIt2 (contenu du fichier OTListIt.txt situé sur le Bureau).
Le rapport envoyé sur le forum doit se terminer par une ligne contenant <End>. Si ce n'est pas le cas, il est incomplet, et doit alors être découpé en plusieurs messages.

Note importante: Pour l'envoi de ta(tes) réponse(s), il ne faut pas créer un nouveau sujet, mais cliquer sur le bouton "Répondre"
pour continuer dans ce fil de discussion.

A suivre,

[Elina22]

Bonjour, merci pour votre réponse. Voilà les résultats de Malwarebytes et de OTListIT2.

Résultats Malwarebytes 'anti-malware':

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1763
Windows 5.1.2600 Service Pack 2

15/02/2009 15:27:17
mbam-log-2009-02-15 (15-27-17).txt

Type de recherche: Examen rapide
Eléments examinés: 75691
Temps écoulé: 12 minute(s), 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 10

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\cbXNFyyy.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0a6ac9ba-3cb7-48be-a9e0-1aa04d0214d8} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0a6ac9ba-3cb7-48be-a9e0-1aa04d0214d8} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0a6ac9ba-3cb7-48be-a9e0-1aa04d0214d8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\cbxnfyyy -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\cbxnfyyy -> Delete on reboot.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\cbXNFyyy.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yyyFNXbc.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yyyFNXbc.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iajaouju.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ujuoajai.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\osqxmegi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\igemxqso.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rhpmojxa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\axjomphr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Temporary Internet Files\Content.IE5\WXI7016F\upd105320[2] (Trojan.Vundo) -> Quarantined and deleted successfully.

[Elina22]

Voici les résultats de OTListIT2.exe:


OTListIt logfile created on: 15/02/2009 15:42:58 - Run 2
OTListIt2 by OldTimer - Version 2.0.0.11 Folder = C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

511,48 Mb Total Physical Memory | 172,32 Mb Available Physical Memory | 33,69% Memory free
1,21 Gb Paging File | 0,94 Gb Available in Paging File | 77,56% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 372,01 Gb Total Space | 332,84 Gb Free Space | 89,47% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ZOGAGHI
Current User Name: ZOGAGHI BOUCHRA
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - [2009/02/06 23:08:00 | 00,950,096 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2007/06/13 14:22:28 | 01,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/08/05 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2004/08/05 13:00:00 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2004/08/05 13:00:00 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2006/03/06 18:48:46 | 00,286,720 | ---- | M] () -- C:\Program Files\Lexmark 3400 Series\lxcymon.exe
PRC - [2006/02/07 06:10:34 | 00,098,304 | ---- | M] (Lexmark International Inc.) -- C:\Program Files\Lexmark 3400 Series\ezprint.exe
PRC - [2007/04/16 15:28:22 | 00,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
PRC - [2008/06/10 04:27:04 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
PRC - [2008/06/12 02:38:00 | 00,034,672 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
PRC - [2008/11/18 15:11:59 | 00,185,872 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
PRC - [2009/02/06 23:08:04 | 00,509,784 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2007/01/19 12:55:02 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe
PRC - [2004/10/13 17:24:37 | 01,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2004/08/05 13:00:00 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
PRC - [2008/09/30 17:45:02 | 07,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2004/08/05 13:00:00 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
PRC - [2008/09/30 17:46:14 | 07,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2006/02/20 20:23:08 | 00,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcycoms.exe
PRC - [2009/02/14 17:22:45 | 00,491,008 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\OTListIt2.exe

========== Win32 Services (SafeList) ==========

SRV - [2005/09/23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009/02/10 14:30:49 | 00,206,088 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe -- (AVP [Auto | Running])
SRV - [2005/09/23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2004/08/05 13:00:00 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009/02/06 23:08:00 | 00,950,096 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [Auto | Running])
SRV - [2006/02/20 20:23:08 | 00,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcycoms.exe -- (lxcy_device [On_Demand | Running])
SRV - [2007/08/24 03:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2007/01/19 12:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped])
SRV - [2006/11/03 09:59:14 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2006/09/28 18:56:14 | 00,055,808 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WudfSvc.dll -- (WudfSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2008/09/24 10:40:22 | 04,122,368 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM [On_Demand | Running])
DRV - [2004/08/04 01:38:44 | 00,701,440 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2004/10/20 14:23:34 | 00,021,344 | ---- | M] (FreeBox SA) -- C:\WINDOWS\system32\drivers\fbxusb32.sys -- (fbxusb [On_Demand | Running])
DRV - [2004/08/05 13:00:00 | 00,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\kbdhid.sys -- (kbdhid [System | Running])
DRV - [2008/07/21 17:34:36 | 00,121,872 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1 [Boot | Running])
DRV - [2009/02/10 14:30:49 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg [Boot | Running])
DRV - [2009/02/10 14:30:49 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF [System | Running])
DRV - [2008/04/30 17:06:48 | 00,024,592 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5 [On_Demand | Running])
DRV - [2009/02/06 23:08:28 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\drivers\Lbd.sys -- (Lbd [Boot | Running])
DRV - [2004/08/05 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008/09/19 22:57:32 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2007/11/13 11:25:54 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\S-1-5-21-1078081533-1580818891-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (790 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {0496338B-5BFC-40D7-AA18-3BA583E1C491} - C:\WINDOWS\system32\urqPiFYS.dll File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\..\Toolbar\ShellBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" (Kaspersky Lab)
O4 - HKLM..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe" (Lexmark International Inc.)
O4 - HKLM..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s ()
O4 - HKLM..\Run: [Hold option boob bin] C:\Documents and Settings\All Users\Application Data\ford does hold option\bore bike.exe (Tads fton)
O4 - HKLM..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16 ()
O4 - HKLM..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe" ()
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [purelog] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\INTERN~1\MORE NURB SKIP.exe (Pofbenc)
O4 - HKCU..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (Shareaza Development Team)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (Microsoft Corporation)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [purelog] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\INTERN~1\MORE NURB SKIP.exe (Pofbenc)
O4 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (Shareaza Development Team)
O4 - Startup: C:\Documents and Settings\ZOGAGHI BOUCHRA\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1078081533-1580818891-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e71d2087dba642859a8432d186c7fac1
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e71d2087dba642859a8432d186c7fac1
O9 - Extra 'Tools' menuitem : Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Me ... b56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~1\kasper~1\kasper~1\mzvkbd.dll) - c:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll) - c:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd3.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\mlJBqOiH: DllName - mlJBqOiH.dll - File not found
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/11/14 20:48:49 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/11/15 20:43:27 | 00,000,011 | ---- | M] () - C:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{70921869-b331-11dd-bf8b-0007cb0000ff}\Shell - "" = AutoRun
O33 - MountPoints2\{735ba1c4-b324-11dd-bf8a-0007cb0000ff}\Shell - "" = AutoRun

========== Files/Folders - Created Within 30 Days ==========

[6 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/02/14 17:22:39 | 00,491,008 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\OTListIt2.exe
[2009/02/14 17:19:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Application Data\Malwarebytes
[2009/02/14 17:18:58 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/02/14 17:18:58 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/02/14 17:18:55 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/02/14 17:18:54 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/02/14 17:18:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/02/14 17:17:22 | 02,876,720 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\mbam-setup.exe
[2009/02/14 14:52:51 | 00,000,000 | ---D | C] -- C:\HIJTHIS
[2009/02/14 14:20:58 | 01,678,488 | -HS- | C] () -- C:\WINDOWS\System32\iavcyxvl.ini
[2009/02/14 00:24:22 | 00,000,290 | -H-- | C] () -- C:\WINDOWS\tasks\A5EB2A3491E8DD68.job
[2009/02/14 00:22:08 | 00,000,000 | ---D | C] -- C:\Program Files\Internetcast
[2009/02/12 18:43:05 | 01,671,294 | -HS- | C] () -- C:\WINDOWS\System32\lkcrhjya.ini
[2009/02/11 18:40:22 | 01,671,285 | -HS- | C] () -- C:\WINDOWS\System32\fpcbacrv.ini
[2009/02/11 16:05:41 | 01,632,193 | -HS- | C] () -- C:\WINDOWS\System32\nfwjjxka.ini
[2009/02/10 16:03:14 | 01,629,665 | -HS- | C] () -- C:\WINDOWS\System32\dypclrml.ini
[2009/02/10 15:13:28 | 01,629,666 | -HS- | C] () -- C:\WINDOWS\System32\bqcfqpav.ini
[2009/02/09 15:11:42 | 01,659,021 | -HS- | C] () -- C:\WINDOWS\System32\ctrkoclb.ini
[2009/02/08 15:04:10 | 01,659,525 | -HS- | C] () -- C:\WINDOWS\System32\wdfirtnf.ini
[2009/02/08 13:53:18 | 01,659,516 | -HS- | C] () -- C:\WINDOWS\System32\bmcxwboe.ini
[2009/02/08 12:42:32 | 00,000,512 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/02/07 13:52:59 | 01,659,525 | -HS- | C] () -- C:\WINDOWS\System32\ykboacet.ini
[2009/02/06 23:45:22 | 00,015,688 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2009/02/06 23:09:06 | 00,064,160 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2009/02/06 23:01:22 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009/02/06 23:01:18 | 00,000,883 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Ad-Aware.lnk
[2009/02/06 23:01:01 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2009/02/06 13:35:39 | 00,000,120 | -HS- | C] () -- C:\WINDOWS\System32\rllmhyit.ini
[2009/02/05 19:12:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Suis-Je le Gardien de Mon Frère-
[2009/02/05 00:38:24 | 01,636,390 | -HS- | C] () -- C:\WINDOWS\System32\aqgxtgpn.ini
[2009/02/04 23:00:43 | 01,636,390 | -HS- | C] () -- C:\WINDOWS\System32\bknwwpoy.ini
[2009/02/04 20:12:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\JEUX DE NDS
[2009/02/04 14:22:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/02/03 23:00:09 | 01,622,398 | -HS- | C] () -- C:\WINDOWS\System32\jofgblby.ini
[2009/02/03 21:30:06 | 01,622,398 | -HS- | C] () -- C:\WINDOWS\System32\ucqwmhqi.ini
[2009/02/03 13:31:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
[2009/02/01 19:35:47 | 26,888,669 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\chèque.pdf
[2009/01/31 23:19:54 | 00,383,025 | -HS- | C] () -- C:\WINDOWS\System32\SYFiPqru.ini2
[2009/01/31 23:19:54 | 00,383,025 | -HS- | C] () -- C:\WINDOWS\System32\SYFiPqru.ini
[2009/01/31 16:28:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2009/01/31 16:23:30 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2009/01/31 16:22:01 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2009/01/30 19:01:12 | 00,000,336 | ---- | C] () -- C:\WINDOWS\tasks\piflenbw.job
[2009/01/29 00:13:53 | 00,795,960 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\plat zog.JPG
[2009/01/29 00:13:20 | 00,770,028 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6272.JPG
[2009/01/29 00:13:11 | 00,830,100 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6273.JPG
[2009/01/28 22:56:12 | 00,014,158 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\BLAGUE.docx
[2009/01/28 21:57:30 | 00,704,400 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\EmoticonesLove.exe
[2009/01/27 22:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Application Data\Apple Computer
[2009/01/26 13:22:17 | 00,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\QuickTime Player.lnk
[2009/01/26 13:21:30 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009/01/26 13:21:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/01/26 13:20:49 | 00,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/01/26 13:20:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\Apple
[2009/01/26 13:20:32 | 00,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2009/01/26 13:20:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple
[2009/01/26 13:20:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\Apple Computer
[2009/01/25 12:07:55 | 00,000,268 | -H-- | C] () -- C:\sqmdata01.sqm
[2009/01/25 12:07:55 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt01.sqm
[2009/01/22 21:02:48 | 00,016,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2009/01/22 21:00:28 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2009/01/22 20:57:05 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/01/22 20:56:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2009/01/22 20:56:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2009/01/21 22:41:55 | 00,123,874 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0092.jpg
[2009/01/21 22:41:55 | 00,123,165 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0090.jpg
[2009/01/21 22:41:54 | 00,117,564 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Aissa Bo bébé.jpg
[2009/01/21 22:41:53 | 00,085,122 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0094.jpg
[2009/01/21 22:41:41 | 00,091,629 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0099.jpg
[2009/01/19 21:58:34 | 00,011,590 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pour la pute.docx
[2009/01/18 13:31:37 | 00,597,266 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6197.JPG
[2009/01/18 01:08:00 | 00,010,854 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\lettre de motivation.docx
[2009/01/17 19:05:26 | 00,019,498 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Votre transaction a bien été enregistrée.docx
[2009/01/17 19:03:30 | 00,009,026 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\SIPS.htm
[2009/01/17 15:30:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Application Data\com.zipeg
[2009/01/17 15:29:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\com.zipeg
[2009/01/17 15:29:48 | 00,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Zipeg.lnk
[2009/01/17 15:29:48 | 00,000,000 | ---D | C] -- C:\Program Files\Zipeg
[2009/01/16 19:21:13 | 00,011,615 | ---- | C] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pouillet.docx

========== Files - Modified Within 30 Days ==========

[6 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/02/15 15:39:02 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/02/15 15:38:58 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/02/15 15:38:56 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/02/15 15:38:54 | 53,639,9872 | -HS- | M] () -- C:\hiberfil.sys
[2009/02/15 15:36:08 | 02,275,872 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2009/02/15 15:36:08 | 00,557,088 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2009/02/15 15:36:08 | 00,018,860 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2009/02/15 15:36:08 | 00,002,984 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
[2009/02/15 15:35:37 | 00,000,336 | ---- | M] () -- C:\WINDOWS\tasks\piflenbw.job
[2009/02/15 15:02:01 | 00,000,274 | ---- | M] () -- C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job
[2009/02/15 15:00:03 | 00,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\A5EB2A3491E8DD68.job
[2009/02/15 14:44:30 | 00,000,587 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Mes dossiers de partage.lnk
[2009/02/14 17:22:45 | 00,491,008 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\OTListIt2.exe
[2009/02/14 17:18:58 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2009/02/14 17:17:22 | 02,876,720 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Bureau\mbam-setup.exe
[2009/02/14 14:21:23 | 01,678,488 | -HS- | M] () -- C:\WINDOWS\System32\iavcyxvl.ini
[2009/02/13 23:11:28 | 00,000,512 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/02/12 18:57:21 | 01,671,294 | -HS- | M] () -- C:\WINDOWS\System32\lkcrhjya.ini
[2009/02/12 18:41:29 | 01,671,285 | -HS- | M] () -- C:\WINDOWS\System32\fpcbacrv.ini
[2009/02/12 17:51:05 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/02/11 16:05:44 | 01,632,193 | -HS- | M] () -- C:\WINDOWS\System32\nfwjjxka.ini
[2009/02/11 10:19:42 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/02/11 10:19:34 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/02/10 16:03:22 | 01,629,665 | -HS- | M] () -- C:\WINDOWS\System32\dypclrml.ini
[2009/02/10 15:13:31 | 01,629,666 | -HS- | M] () -- C:\WINDOWS\System32\bqcfqpav.ini
[2009/02/10 14:30:49 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2009/02/10 14:30:49 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klbg.sys
[2009/02/09 19:22:03 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/09 15:11:58 | 01,659,021 | -HS- | M] () -- C:\WINDOWS\System32\ctrkoclb.ini
[2009/02/08 17:32:26 | 01,659,525 | -HS- | M] () -- C:\WINDOWS\System32\wdfirtnf.ini
[2009/02/08 13:53:25 | 01,659,516 | -HS- | M] () -- C:\WINDOWS\System32\bmcxwboe.ini
[2009/02/07 14:00:56 | 01,659,525 | -HS- | M] () -- C:\WINDOWS\System32\ykboacet.ini
[2009/02/06 23:08:58 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2009/02/06 23:08:28 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2009/02/06 23:01:18 | 00,000,883 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Ad-Aware.lnk
[2009/02/06 13:35:39 | 00,000,120 | -HS- | M] () -- C:\WINDOWS\System32\rllmhyit.ini
[2009/02/05 00:38:37 | 01,636,390 | -HS- | M] () -- C:\WINDOWS\System32\aqgxtgpn.ini
[2009/02/04 23:00:51 | 01,636,390 | -HS- | M] () -- C:\WINDOWS\System32\bknwwpoy.ini
[2009/02/03 23:00:23 | 01,622,398 | -HS- | M] () -- C:\WINDOWS\System32\jofgblby.ini
[2009/02/03 21:30:22 | 01,622,398 | -HS- | M] () -- C:\WINDOWS\System32\ucqwmhqi.ini
[2009/02/03 18:42:14 | 00,101,287 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2009/02/03 18:42:14 | 00,089,601 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2009/02/01 19:35:50 | 26,888,669 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\chèque.pdf
[2009/02/01 14:48:27 | 00,383,025 | -HS- | M] () -- C:\WINDOWS\System32\SYFiPqru.ini
[2009/02/01 14:45:56 | 00,383,025 | -HS- | M] () -- C:\WINDOWS\System32\SYFiPqru.ini2
[2009/01/31 16:27:24 | 00,885,844 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/01/31 16:27:24 | 00,461,404 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2009/01/31 16:27:24 | 00,395,336 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/01/31 16:27:24 | 00,072,366 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2009/01/31 16:27:24 | 00,059,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/01/28 23:02:17 | 00,014,158 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\BLAGUE.docx
[2009/01/28 21:57:30 | 00,704,400 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\EmoticonesLove.exe
[2009/01/27 13:34:00 | 00,795,960 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\plat zog.JPG
[2009/01/26 13:22:18 | 00,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\QuickTime Player.lnk
[2009/01/26 11:33:02 | 00,830,100 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6273.JPG
[2009/01/26 11:32:48 | 00,770,028 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6272.JPG
[2009/01/26 00:51:03 | 04,844,986 | -H-- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Local Settings\Application Data\IconCache.db
[2009/01/25 12:07:55 | 00,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/01/25 12:07:55 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/01/23 15:11:02 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/01/22 21:15:27 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009/01/22 21:15:27 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009/01/22 21:01:12 | 00,000,633 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/01/22 20:58:38 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009/01/22 20:57:05 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/01/20 22:02:24 | 00,117,564 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Aissa Bo bébé.jpg
[2009/01/20 17:27:02 | 00,091,629 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0099.jpg
[2009/01/20 17:26:44 | 00,085,122 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0094.jpg
[2009/01/20 17:26:08 | 00,123,165 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0090.jpg
[2009/01/20 17:25:46 | 00,123,874 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Photo0092.jpg
[2009/01/19 22:56:04 | 00,011,590 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pour la pute.docx
[2009/01/18 21:36:23 | 00,002,738 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2009/01/18 14:56:16 | 04,003,769 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\wyclef jean - ecleftic 2 sides to a book - perfect gentleman.mp3
[2009/01/18 13:51:27 | 00,415,744 | -HS- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Thumbs.db
[2009/01/18 13:33:53 | 00,597,266 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\DSCN6197.JPG
[2009/01/18 01:08:01 | 00,010,854 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\lettre de motivation.docx
[2009/01/17 19:05:27 | 00,019,498 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Votre transaction a bien été enregistrée.docx
[2009/01/17 19:03:31 | 00,009,026 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\SIPS.htm
[2009/01/17 15:29:48 | 00,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Zipeg.lnk
[2009/01/16 19:33:00 | 00,011,615 | ---- | M] () -- C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\pouillet.docx

========== Alternate Data Streams ==========

@Alternate Data Stream - 16 bytes -> C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Shareaza Downloads:Shareaza.GUID
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 0 bytes -> C:\Documents and Settings\ZOGAGHI BOUCHRA\Mes documents\Thumbs.db:encryptable
<End>


J'attends votre réponse. Merci.

[nickW]

Bonsoir,

Autres nettoyages et autre recherche:


Note: Ces manips doivent être effectuées en ayant ouvert une session avec les "droits Administrateur" (ne pas utiliser le profil utilisateur nommé "Administrateur" visible en mode sans échec).


Étape 1: ERUNT (de Lars Hederer): sauvegarde du Registre
Télécharger ERUNT depuis la page: http://www.larshederer.homepage.t-online.de/erunt/
Sous Download ERUNT:, télécharger erunt-setup.exe
Télécharger également le fichier de langue française: sous French télécharger le fichier erunt-loc_fr.zip

Installer ERUNT en faisant un double clic sur erunt-setup.exe
Décompresser l'archive erunt-loc_fr.zip (sous XP, clic droit puis Extraire tout) et placer les fichiers extraits dans le dossier d'installation de ERUNT.

Lancer ERUNT par un double clic sur ERUNT.EXE
Sur le message de Bienvenue, cliquer sur OK
Dans la fenêtre intitulée "ERU pour Windows NT", cocher toutes les options de sauvegarde (Registre système, Registre utilisateur courant et Autres registres utilisateur)
Cliquer ensuite sur OK
Accepter la création du dossier (dans le dossier Windows\ERDNT\) en cliquant sur Oui.
Attendre la fin de la sauvegarde, signalée par le message "Sauvegarde du registre effectuée", et cliquer sur OK.


Étape 2: Lop S&D (de Angeldark et Eric71)
Télécharger Lop S&D via un clic droit sur le lien: http://eric.71.mespages.googlepages.com/LopSD.exe
Enregistrer ce fichier sur le Bureau.


Étape 3: OTMoveIt3 (de OldTimer)
Télécharger OTMoveIt3 via un clic droit sur le lien ci-dessous:
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Enregistrer le fichier sur le Bureau.

Ouvrir une fenêtre du Bloc-notes, via Démarrer---->Exécuter, taper notepad puis cliquer sur OK
Sélectionner toutes les lignes de la zone blanche située sous "Code:" ci-dessous, puis appuyer simultanément sur les touches Ctrl et C

Code: Tout sélectionner

rien
:Processes
explorer.exe

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0496338B-5BFC-40D7-AA18-3BA583E1C491}]
[HKEY_USERS\S-1-5-21-1078081533-1580818891-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run]
"purelog"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJBqOiH]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70921869-b331-11dd-bf8b-0007cb0000ff}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{735ba1c4-b324-11dd-bf8a-0007cb0000ff}]

:Files
C:\autorun.inf
C:\WINDOWS\System32\iavcyxvl.ini
C:\WINDOWS\System32\lkcrhjya.ini
C:\WINDOWS\System32\fpcbacrv.ini
C:\WINDOWS\System32\nfwjjxka.ini
C:\WINDOWS\System32\dypclrml.ini
C:\WINDOWS\System32\bqcfqpav.ini
C:\WINDOWS\System32\ctrkoclb.ini
C:\WINDOWS\System32\wdfirtnf.ini
C:\WINDOWS\System32\bmcxwboe.ini
C:\WINDOWS\System32\ykboacet.ini
C:\WINDOWS\System32\rllmhyit.ini
C:\WINDOWS\System32\aqgxtgpn.ini
C:\WINDOWS\System32\bknwwpoy.ini
C:\WINDOWS\System32\jofgblby.ini
C:\WINDOWS\System32\ucqwmhqi.ini
C:\WINDOWS\System32\SYFiPqru.ini2
C:\WINDOWS\System32\SYFiPqru.ini

:Commands
[start explorer]
[emptytemp]




Retourner dans la fenêtre du Bloc-notes, faire un clic droit dans la fenêtre et choisir Coller
Vérifier dans le menu Format (en haut) que "Retour automatique à ligne" n'est pas actif (pas coché).
Enregistrer le fichier sous le nom OTMI-1.txt
Fermer le Bloc-notes.
Note: Les lignes de la zone Code ci-dessus ont été créées exclusivement pour CET utilisateur: Elina22.
si vous n'êtes pas CET utilisateur, il ne faut pas les utiliser: elles pourraient endommager votre système.


Étape 4: Pas de processus de contrôle en temps réel
Désactiver le module résident de l'antivirus.
Kaspersky: clic droit sur l'icône dans la SysBarre (à coté de l'horloge), puis "Suspension de la protection...", "A la demande de l'utilisateur".


Étape 5: OTMoveIt3 (de OldTimer)
Faire un double clic sur OTMoveIt3.exe pour lancer l'outil.
Ouvrir le fichier OTMI-1.txt dans le Bloc-notes.
Dans le Bloc-notes, cliquer sur le menu Edition (en haut) et choisir Sélectionner tout.
Dans le Bloc-notes, cliquer sur le menu Edition (en haut) et choisir Copier.

Retourner dans la fenêtre de OTMoveIt3, faire un clic droit dans la fenêtre située sur la gauche nommée "Paste Instructions for Items to be Moved" et choisir Coller.

Cliquer sur le bouton MoveIt!:
Attendre la fin du travail de l'outil puis fermer OTMoveIt3.
Note: Un redémarrage est parfois nécessaire. S'il est demandé, cliquer sur Oui/Yes


Étape 6: Lop S&D (de Angeldark et Eric71), Recherche
Faire un double clic sur LopSD.exe pour lancer l'exécution de l'outil.

Choisir la langue en tapant F puis en appuyant sur Entrée.
Lire l'avertissement, puis cliquer sur OK.

Après l'affichage du menu, taper 1 puis faire Entrée pour rechercher les fichiers responsables de l'infection.
Lorsque la recherche est terminée, une fenêtre du Bloc-notes s'ouvre et affiche le rapport (alias log).

Fermer le Bloc-notes, ce qui termine l'exécution de l'outil.

Note:
Si le Bureau ne réapparaît pas, ouvrir le Gestionnaire des tâches en utilisant simultanément les touches CTRL+ALT+SUPP.
Cliquer en haut sur le Menu Fichier et choisir Nouvelle tâche (Exécuter...).
Dans la nouvelle fenêtre Créer une nouvelle tâche qui s'est ouverte, dans la zone Ouvrir, taper exactement explorer puis cliquer sur le bouton OK. Le Bureau va réapparaître.


Étape 7: Processus de contrôle en temps réel
Important: Réactiver le module résident de l'antivirus.


Étape 8: OTListIt2 (de OldTimer)
Fermer toutes les fenêtres de programme ouvertes.

Faire un double clic sur OTListIt2.exe pour lancer l'outil.

L'écran principal de OTListIt2 s'affiche:


Cocher (en haut) la case située devant Scan All Users:

Puis cliquer sur le bouton Run Scan:

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer le Bloc-notes.
Fermer la fenêtre de OTListIt2.


Étape 9: Résultats
Envoyer en réponse:
*- le rapport de Lop S&D (contenu du fichier SystemDrive\lopR.txt)
[SystemDrive représente la partition sur laquelle est installé le système, généralement C:]
*- le rapport de OTMoveIt3 (contenu du fichier Lecteur\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)
[Lecteur représente la partition depuis laquelle OTMoveIt3 a été lancé, généralement C:]

Envoyer ensuite en réponse dans un message distinct (à cause de la longueur du log):
*- le rapport principal de OTListIt2 (contenu du fichier OTListIt.txt situé sur le Bureau).
Le rapport envoyé sur le forum doit se terminer par une ligne contenant <End>. Si ce n'est pas le cas, il est incomplet, et doit alors être découpé en plusieurs messages.

Note importante: Pour l'envoi de ta(tes) réponse(s), il ne faut pas créer un nouveau sujet, mais cliquer sur le bouton "Répondre"
pour continuer dans ce fil de discussion.

A suivre,

[Elina22]

Bonjour, merci pour votre réponse.

Voici les résultats de Lop S&D:


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : ZOGAGHI BOUCHRA ( Administrator )
BOOT : Normal boot
Antivirus : Kaspersky Anti-Virus 8.0.0.506 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:372 Go (Free:346 Go)
E:\ (CD or DVD)
F:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 18/02/2009|15:11 )

--------------------\\ Listing des dossiers dans APPLIC~1

[06/02/2009|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{83C91755-2546-441D-AC40-9A6B4B860800}
[17/11/2008|11:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[26/01/2009|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[26/01/2009|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[14/11/2008|21:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FaxCtr
[14/02/2009|00:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
[18/02/2009|15:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
[03/02/2009|13:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
[06/02/2009|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[14/02/2009|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[15/11/2008|00:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[05/12/2008|19:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[17/01/2009|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[31/01/2009|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
[04/02/2009|18:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[21/11/2008|18:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[14/11/2008|23:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[17/01/2009|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip

[14/11/2008|20:48] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[22/01/2009|22:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[14/11/2008|20:48] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[18/11/2008|18:00] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Adobe
[27/01/2009|22:43] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Apple Computer
[13/02/2009|23:11] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\com.zipeg
[19/11/2008|21:34] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\DivX
[18/01/2009|14:00] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\FaxCtr
[14/11/2008|20:55] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Identities
[14/02/2009|00:24] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Internetcast
[15/11/2008|14:48] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Macromedia
[14/02/2009|17:19] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Malwarebytes
[27/12/2008|02:58] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Microsoft
[23/11/2008|21:37] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\MPMAN
[16/11/2008|13:59] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\MP-Manager
[15/11/2008|15:57] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\OpenOffice.org
[18/11/2008|15:22] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Real
[15/02/2009|17:54] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Shareaza
[14/11/2008|23:56] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\Sun
[18/02/2009|14:37] C:\DOCUME~1\ZOGAGH~1\APPLIC~1\WinRAR

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[18/02/2009 15:00][--ah-----] C:\WINDOWS\tasks\A5EB2A3491E8DD68.job
[13/02/2009 23:11][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[18/02/2009 15:07][--a------] C:\WINDOWS\tasks\piflenbw.job
[12/02/2009 17:51][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[18/02/2009 15:02][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[18/02/2009 15:07][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( A5EB2A3491E8DD68.job )=( c:\docume~1\zogagh~1\applic~1\intern~1\DARTLIESCORN.exe )

--------------------\\ MsgPlus SPONSOR INSTALLED !

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MsgPlus! Plugin]
"DisplayName"="Messenger Plus! 3 & Sponsor"
"SponsorInstalled"=dword:00000000


--------------------\\ Listing des dossiers dans C:\Program Files

[08/12/2008|15:42] C:\Program Files\Abbyy FineReader 6.0 Sprint
[17/11/2008|11:56] C:\Program Files\Adobe
[26/01/2009|13:20] C:\Program Files\Apple Software Update
[15/02/2009|16:12] C:\Program Files\Circle Developement
[14/11/2008|20:45] C:\Program Files\ComPlus Applications
[18/11/2008|17:05] C:\Program Files\DivX
[15/11/2008|22:00] C:\Program Files\eMule
[18/02/2009|14:39] C:\Program Files\ERUNT
[06/02/2009|23:00] C:\Program Files\Fichiers communs
[14/11/2008|21:03] C:\Program Files\Free.fr
[14/11/2008|22:39] C:\Program Files\InstallShield Installation Information
[31/01/2009|16:22] C:\Program Files\Internet Explorer
[14/02/2009|00:22] C:\Program Files\Internetcast
[14/11/2008|23:57] C:\Program Files\Java
[14/11/2008|23:57] C:\Program Files\JRE
[15/11/2008|20:37] C:\Program Files\Kaspersky Lab
[06/02/2009|23:01] C:\Program Files\Lavasoft
[14/11/2008|21:12] C:\Program Files\Lexmark 3400 Series
[14/11/2008|21:12] C:\Program Files\Lexmark Fax Solutions
[14/11/2008|21:11] C:\Program Files\Lexmark Toolbar
[18/02/2009|15:08] C:\Program Files\lx_cats
[07/01/2009|22:04] C:\Program Files\Magic Photo Editor
[14/02/2009|17:19] C:\Program Files\Malwarebytes' Anti-Malware
[13/01/2009|17:28] C:\Program Files\Messenger
[14/02/2009|00:21] C:\Program Files\Messenger Plus! Live
[14/11/2008|22:59] C:\Program Files\MessengerPlus! 3
[14/11/2008|20:49] C:\Program Files\microsoft frontpage
[05/12/2008|19:48] C:\Program Files\Microsoft Office
[05/12/2008|19:48] C:\Program Files\Microsoft Visual Studio
[05/12/2008|19:48] C:\Program Files\Microsoft Works
[14/11/2008|20:46] C:\Program Files\Movie Maker
[16/11/2008|13:58] C:\Program Files\MPMAN
[14/11/2008|20:44] C:\Program Files\MSN
[14/11/2008|20:44] C:\Program Files\MSN Gaming Zone
[14/02/2009|00:21] C:\Program Files\MSN Messenger
[14/11/2008|20:46] C:\Program Files\NetMeeting
[14/11/2008|20:45] C:\Program Files\Online Services
[14/11/2008|23:57] C:\Program Files\OpenOffice.org 3
[13/01/2009|17:26] C:\Program Files\Outlook Express
[14/11/2008|23:25] C:\Program Files\PhotoFiltre
[07/01/2009|22:48] C:\Program Files\PhotoFiltre Studio
[26/01/2009|13:23] C:\Program Files\QuickTime
[18/11/2008|15:12] C:\Program Files\Real
[14/11/2008|22:39] C:\Program Files\Realtek AC97
[14/11/2008|20:47] C:\Program Files\Services en ligne
[15/02/2009|17:54] C:\Program Files\Shareaza
[14/11/2008|20:55] C:\Program Files\Uninstall Information
[14/11/2008|23:12] C:\Program Files\Windows Live
[14/11/2008|23:09] C:\Program Files\Windows Live Favorites
[14/11/2008|23:09] C:\Program Files\Windows Live Toolbar
[22/01/2009|21:00] C:\Program Files\Windows Media Connect 2
[22/01/2009|21:14] C:\Program Files\Windows Media Player
[14/11/2008|20:44] C:\Program Files\Windows NT
[14/11/2008|20:47] C:\Program Files\WindowsUpdate
[18/02/2009|13:11] C:\Program Files\WinRAR
[14/11/2008|20:49] C:\Program Files\xerox
[17/01/2009|15:29] C:\Program Files\Zipeg

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[17/11/2008|11:57] C:\Program Files\Fichiers communs\Adobe
[05/12/2008|19:48] C:\Program Files\Fichiers communs\DESIGNER
[14/11/2008|22:38] C:\Program Files\Fichiers communs\InstallShield
[14/11/2008|23:56] C:\Program Files\Fichiers communs\Java
[17/01/2009|20:02] C:\Program Files\Fichiers communs\Microsoft Shared
[14/11/2008|20:46] C:\Program Files\Fichiers communs\MSSoap
[14/11/2008|21:34] C:\Program Files\Fichiers communs\ODBC
[18/11/2008|15:13] C:\Program Files\Fichiers communs\Real
[14/11/2008|20:46] C:\Program Files\Fichiers communs\Services
[14/11/2008|21:34] C:\Program Files\Fichiers communs\SpeechEngines
[13/01/2009|17:26] C:\Program Files\Fichiers communs\System
[18/11/2008|15:14] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 37 Processes )

iexplore.exe ~ [PID:2108]
iexplore.exe ~ [PID:3012]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\bore bike.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option\bore bike.exe
C:\DOCUME~1\ZOGAGH~1\APPLIC~1\intern~1
C:\DOCUME~1\ZOGAGH~1\APPLIC~1\intern~1\Army Keep Delete Atom.exe
C:\DOCUME~1\ZOGAGH~1\APPLIC~1\intern~1\DART LIES CORN.exe
C:\DOCUME~1\ZOGAGH~1\APPLIC~1\intern~1\MORE NURB SKIP.exe
C:\Program Files\intern~1
C:\Program Files\intern~1\Connection Wizard
C:\Program Files\intern~1\HMMAPI.DLL
C:\Program Files\intern~1\iedw.exe
C:\Program Files\intern~1\IEXPLORE.EXE
C:\Program Files\intern~1\MUI
C:\Program Files\intern~1\PLUGINS
C:\Program Files\intern~1\SIGNUP
C:\Program Files\Circle Developement
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@fr.seafight.bigpoint[2].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@fr.seafight.bigpoint[3].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@banner.cotedazurpalace[2].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@fr.seafight.bigpoint[2].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@fr.seafight.bigpoint[3].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@banner.32vegas[1].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@2xmoinscher[1].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@2xmoinscher[2].txt
C:\DOCUME~1\ZOGAGH~1\Cookies\zogaghi bouchra@www.2xmoinscher[2].txt
C:\WINDOWS\Tasks\A5EB2A3491E8DD68.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Hold option boob bin"="C:\\Documents and Settings\\All Users\\Application Data\\ford does hold option\\bore bike.exe"

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-18 15:15:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 215

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:1][D:2]-> C:\DOCUME~1\ZOGAGH~1\LOCALS~1\Temp
[F:1577][D:0]-> C:\DOCUME~1\ZOGAGH~1\Cookies
[F:269][D:37]-> C:\DOCUME~1\ZOGAGH~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 18/02/2009|15:17 - Option : [1]







Et voilà les résultats de OTMoveIT3:

Error: Unable to interpret <rien> in the current context!
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0496338B-5BFC-40D7-AA18-3BA583E1C491}\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1078081533-1580818891-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\purelog deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJBqOiH\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70921869-b331-11dd-bf8b-0007cb0000ff}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{735ba1c4-b324-11dd-bf8a-0007cb0000ff}\\ deleted successfully.
========== FILES ==========
C:\autorun.inf moved successfully.
C:\WINDOWS\System32\iavcyxvl.ini moved successfully.
C:\WINDOWS\System32\lkcrhjya.ini moved successfully.
C:\WINDOWS\System32\fpcbacrv.ini moved successfully.
C:\WINDOWS\System32\nfwjjxka.ini moved successfully.
C:\WINDOWS\System32\dypclrml.ini moved successfully.
C:\WINDOWS\System32\bqcfqpav.ini moved successfully.
C:\WINDOWS\System32\ctrkoclb.ini moved successfully.
C:\WINDOWS\System32\wdfirtnf.ini moved successfully.
C:\WINDOWS\System32\bmcxwboe.ini moved successfully.
C:\WINDOWS\System32\ykboacet.ini moved successfully.
C:\WINDOWS\System32\rllmhyit.ini moved successfully.
C:\WINDOWS\System32\aqgxtgpn.ini moved successfully.
C:\WINDOWS\System32\bknwwpoy.ini moved successfully.
C:\WINDOWS\System32\jofgblby.ini moved successfully.
C:\WINDOWS\System32\ucqwmhqi.ini moved successfully.
C:\WINDOWS\System32\SYFiPqru.ini2 moved successfully.
C:\WINDOWS\System32\SYFiPqru.ini moved successfully.
========== COMMANDS ==========
Explorer started successfully
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02182009_150212