Se connecter / S'enregistrer
Votre question

[Résolu] Infection apyware aider moi

Tags :
  • Sécurité
Dernière réponse : dans Sécurité et virus
13 Août 2009 16:35:16

Bonjour, J'ai un message qui s'affiche en bas a droite de l'écran qui dit : ''Windows has detected spyware unfection! " Ques que je dois faire??:'( 

Autres pages sur : resolu infection apyware aider

a c 273 8 Sécurité
13 Août 2009 17:00:47

Bonjour,

  • Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
  • Double-clique sur RSIT.exe afin de lancer le programme.
    (Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
  • Clique sur Continue à l'écran Disclaimer.
  • Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
  • Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

    Note : les rapports sont sauvegardés dans le dossier C:\rsit.
    13 Août 2009 17:07:47

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by Alex et Marc at 2009-08-13 11:01:42
    Microsoft Windows XP Édition familiale Service Pack 3
    System drive C: has 111 GB (74%) free of 150 GB
    Total RAM: 510 MB (27% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:02:12, on 2009-08-13
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdnserv.exe
    C:\WINDOWS\system32\lxdncoms.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\msword98.exe
    C:\WINDOWS\system32\msword98.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Documents and Settings\Alex et Marc\msword98.exe
    C:\Documents and Settings\Alex et Marc\msword98.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\braviax.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Documents and Settings\Alex et Marc\Bureau\RSIT.exe
    C:\Program Files\trend micro\Alex et Marc.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.app-zilla.com/search.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    R3 - URLSearchHook: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspe0.dll
    R3 - URLSearchHook: forumswatcher.com Toolbar - {50d0cd27-d4ef-4a21-917e-a1573771def4} - C:\Program Files\forumswatcher.com\tbfor0.dll
    R3 - URLSearchHook: USARadioNow Toolbar - {669163c1-c4b9-46de-ad62-a0271d3a0a75} - C:\Program Files\USARadioNow\tbUSA0.dll
    R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (file missing)
    F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspe0.dll
    O3 - Toolbar: forumswatcher.com Toolbar - {50d0cd27-d4ef-4a21-917e-a1573771def4} - C:\Program Files\forumswatcher.com\tbfor0.dll
    O3 - Toolbar: USARadioNow Toolbar - {669163c1-c4b9-46de-ad62-a0271d3a0a75} - C:\Program Files\USARadioNow\tbUSA0.dll
    O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
    O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [axis love poll lite] C:\Documents and Settings\All Users\Application Data\each new axis love\DATE 01.exe
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Documents and Settings\Alex et Marc\Bureau\Nouveau dossier\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [msword98] C:\WINDOWS\system32\msword98.exe
    O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [WindowsHiderPro] C:\Program Files\WHidePro\whpro.exe
    O4 - HKCU\..\Run: [IEPR] C:\DOCUME~1\ALEXET~1\LOCALS~1\TempImages\IS109.exe
    O4 - HKCU\..\Run: [iOmem] C:\DOCUME~1\ALEXET~1\LOCALS~1\TempImages\iOmm100.exe
    O4 - HKCU\..\Run: [WeatherEye] C:\MétéoMédia\MétéoÉclair\WeatherEye.exe
    O4 - HKCU\..\Run: [msword98] C:\Documents and Settings\Alex et Marc\msword98.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: ikowin32.exe
    O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
    O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll/206 (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.ca...
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
    O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - http://play.battlefield-heroes.com/static/updater/BFHUp...
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
    O23 - Service: lxdn_device - - C:\WINDOWS\system32\lxdncoms.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 12033 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-07-07 439872]
    {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - speedapps Toolbar - C:\Program Files\speedapps\tbspe0.dll [2009-07-05 2215960]
    {50d0cd27-d4ef-4a21-917e-a1573771def4} - forumswatcher.com Toolbar - C:\Program Files\forumswatcher.com\tbfor0.dll [2009-07-05 2215960]
    {669163c1-c4b9-46de-ad62-a0271d3a0a75} - USARadioNow Toolbar - C:\Program Files\USARadioNow\tbUSA0.dll [2009-07-05 2215960]
    {EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll []

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "IntelMeM"=C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe [2003-09-03 221184]
    "CTSysVol"=C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe [2003-09-17 57344]
    "P17Helper"=Rundll32 P17.dll,P17Helper []
    "UpdReg"=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]
    "DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-10-12 57344]
    "UpdateManager"=C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
    "dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-12-06 127035]
    "DMXLauncher"=C:\Program Files\Dell\Media Experience\DMXLauncher.exe [2005-01-27 86016]
    "lxdnmon.exe"=C:\Program Files\Lexmark 2600 Series\lxdnmon.exe [2007-12-17 660136]
    "lxdnamon"=C:\Program Files\Lexmark 2600 Series\lxdnamon.exe [2007-12-17 16040]
    "igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-09-20 94208]
    "igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-09-20 77824]
    "igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-09-20 114688]
    "Symantec PIF AlertEng"=C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
    "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
    "WinampAgent"=C:\Program Files\Winamp\winampa.exe []
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
    "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-06-05 292136]
    "axis love poll lite"=C:\Documents and Settings\All Users\Application Data\each new axis love\DATE 01.exe []
    "SweetIM"=C:\Program Files\SweetIM\Messenger\SweetIM.exe []
    "UnlockerAssistant"=C:\Documents and Settings\Alex et Marc\Bureau\Nouveau dossier\Unlocker\UnlockerAssistant.exe []
    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]
    "msword98"=C:\WINDOWS\system32\msword98.exe [2009-08-12 26686]
    "braviax"= []
    "Regedit32"=C:\WINDOWS\system32\regedit.exe []

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
    "WindowsHiderPro"=C:\Program Files\WHidePro\whpro.exe []
    "IEPR"=C:\DOCUME~1\ALEXET~1\LOCALS~1\TempImages\IS109.exe []
    "iOmem"=C:\DOCUME~1\ALEXET~1\LOCALS~1\TempImages\iOmm100.exe []
    "WeatherEye"=C:\MétéoMédia\MétéoÉclair\WeatherEye.exe [2009-01-16 4519832]
    "msword98"=C:\Documents and Settings\Alex et Marc\msword98.exe [2009-08-12 26686]
    "braviax"= []
    "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]

    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
    Post-it® Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe

    C:\Documents and Settings\Alex et Marc\Menu Démarrer\Programmes\Démarrage
    ikowin32.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\WINDOWS\system32\igfxdev.dll [2005-09-20 135168]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=145

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "HonorAutoRunSetting"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\WINDOWS\SYSTEM32\lxdncoms.exe"="C:\WINDOWS\SYSTEM32\lxdncoms.exe:*:Enabled:Lexmark Communications System"
    "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"="C:\Program Files\Lexmark 2600 Series\lxdnamon.exe:*:Enabled:Lexmark Device Monitor"
    "C:\Program Files\Lexmark 2600 Series\frun.exe"="C:\Program Files\Lexmark 2600 Series\frun.exe:*:Enabled:Lexmark Productivity Studio"
    "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"="C:\Program Files\Lexmark 2600 Series\lxdnmon.exe:*:Enabled:p rinter Device Monitor"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnpswx.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnpswx.exe:*:Enabled:p rinter Status Window Interface"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdntime.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdntime.exe:*:Enabled:Lexmark Connect Time Executable"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnjswx.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnjswx.exe:*:Enabled:Job Status Window Interface"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\Program Files\Lexmark 2600 Series\Diagnostics\LXDNdiag.exe"="C:\Program Files\Lexmark 2600 Series\Diagnostics\LXDNdiag.exe:*:Enabled: "
    "C:\Program Files\Lexmark 2600 Series\lxdnlscn.exe"="C:\Program Files\Lexmark 2600 Series\lxdnlscn.exe:*:Enabled: "
    "C:\Documents and Settings\All Users\Application Data\IJJIGame\PLauncher.exe"="C:\Documents and Settings\All Users\Application Data\IJJIGame\PLauncher.exe:*:D isabled:p Launcher Application"
    "C:\WINDOWS\Downloaded Program Files\PurpleBean.exe"="C:\WINDOWS\Downloaded Program Files\PurpleBean.exe:*:Enabled:p urpleBean.exe"
    "C:\ijji\ENGLISH\u_sf\soldierfront.exe"="C:\ijji\ENGLISH\u_sf\soldierfront.exe:*:D isabled:soldierfront"
    "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\Program Files\Counter-Strike 1.6\hl.exe"="C:\Program Files\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
    "C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
    "C:\WINDOWS\SYSTEM32\java.exe"="C:\WINDOWS\SYSTEM32\java.exe:*:Enabled:Java(TM) Platform SE binary"
    "C:\Program Files\aMSN\bin\wish.exe"="C:\Program Files\aMSN\bin\wish.exe:*:Enabled:Wish Application"
    "C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe"
    "C:\WINDOWS\SYSTEM32\PnkBstrA.exe"="C:\WINDOWS\SYSTEM32\PnkBstrA.exe:*:Enabled:p nkBstrA"
    "C:\WINDOWS\SYSTEM32\PnkBstrB.exe"="C:\WINDOWS\SYSTEM32\PnkBstrB.exe:*:Enabled:p nkBstrB"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnwbgw.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnwbgw.exe:*:Enabled:Lexmark Web Gateway"
    "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{484623d6-f908-11dd-8869-0013203f8cd7}]
    shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\m.exe /s

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bad07667-f7e3-11dd-8863-0013203f8cd7}]
    shell\AutoRun\command - E:\setupSNK.exe


    ======List of files/folders created in the last 1 months======

    2009-08-13 11:01:43 ----D---- C:\Program Files\trend micro
    2009-08-13 11:01:42 ----D---- C:\rsit
    2009-08-13 10:48:47 ----A---- C:\WINDOWS\system32\d3dx9.dll
    2009-08-13 10:48:47 ----A---- C:\WINDOWS\system32\D3DX81ab.dll
    2009-08-12 23:14:14 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
    2009-08-12 23:14:08 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
    2009-08-12 23:14:03 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
    2009-08-12 23:13:57 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
    2009-08-12 23:13:51 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
    2009-08-12 23:13:45 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
    2009-08-12 23:13:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
    2009-08-12 23:13:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
    2009-08-12 23:13:02 ----A---- C:\WINDOWS\system32\MRT.INI
    2009-08-12 23:10:41 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
    2009-08-12 13:22:39 ----A---- C:\WINDOWS\system32\delself.bat
    2009-08-12 13:21:35 ----D---- C:\WINDOWS\LastGood
    2009-08-12 12:49:08 ----A---- C:\WINDOWS\system32\braviax.exe
    2009-08-12 12:48:29 ----A---- C:\WINDOWS\system32\msword98.exe
    2009-08-09 21:14:42 ----SHD---- C:\Config.Msi
    2009-08-09 20:54:24 ----D---- C:\Program Files\Circle Develoement
    2009-08-06 13:08:06 ----D---- C:\Program Files\Lame for Audacity
    2009-08-06 12:55:06 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Audacity
    2009-08-05 11:47:09 ----A---- C:\WINDOWS\system32\javaws.exe
    2009-08-05 11:47:09 ----A---- C:\WINDOWS\system32\javaw.exe
    2009-08-05 11:47:09 ----A---- C:\WINDOWS\system32\java.exe
    2009-07-31 21:53:01 ----A---- C:\WINDOWS\IFinst27.exe
    2009-07-29 04:32:58 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$
    2009-07-28 15:52:19 ----D---- C:\WINDOWS\Minidump
    2009-07-28 15:19:59 ----A---- C:\WINDOWS\LD.INI
    2009-07-28 15:19:57 ----D---- C:\TERRASSE
    2009-07-28 15:14:02 ----A---- C:\WINDOWS\viewer.ini
    2009-07-28 15:14:00 ----N---- C:\WINDOWS\system32\SNWValid.dll
    2009-07-28 15:13:59 ----N---- C:\WINDOWS\system32\SierraNW.dll
    2009-07-28 15:13:31 ----D---- C:\Program Files\Sierra On-Line
    2009-07-28 15:13:23 ----A---- C:\WINDOWS\SIERRA.INI
    2009-07-28 15:13:23 ----A---- C:\WINDOWS\IsUninst.exe
    2009-07-28 14:25:10 ----D---- C:\Program Files\Realtime Landscaping Photo 5 Trial
    2009-07-27 13:47:28 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\MSNInstaller
    2009-07-24 12:51:29 ----D---- C:\Program Files\gPotato.eu
    2009-07-24 11:29:02 ----D---- C:\Program Files\BestGameEver
    2009-07-21 14:18:48 ----D---- C:\Program Files\PartyGaming
    2009-07-19 00:16:34 ----D---- C:\Program Files\Risk II
    2009-07-19 00:15:22 ----D---- C:\Program Files\ReflexiveArcade
    2009-07-17 15:03:33 ----A---- C:\WINDOWS\system32\SET143.tmp
    2009-07-16 15:38:06 ----A---- C:\WINDOWS\MythwarII Uninstall Log.txt
    2009-07-16 12:10:16 ----D---- C:\WINDOWS\MythwarII
    2009-07-16 03:03:59 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
    2009-07-16 03:03:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
    2009-07-16 03:00:54 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
    2009-07-16 01:20:15 ----A---- C:\WINDOWS\MythwarII Setup Log.txt
    2009-07-15 23:40:03 ----D---- C:\Program Files\Common Files
    2009-07-15 23:24:27 ----D---- C:\Program Files\Gpotato
    2009-07-15 11:07:47 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Desktopicon
    2009-07-15 10:30:21 ----D---- C:\Program Files\Microsoft

    ======List of files/folders modified in the last 1 months======

    2009-08-13 11:01:47 ----D---- C:\WINDOWS\Prefetch
    2009-08-13 11:01:43 ----D---- C:\Program Files
    2009-08-13 10:51:55 ----D---- C:\Program Files\Cheat Engine
    2009-08-13 10:48:48 ----D---- C:\WINDOWS\SYSTEM32
    2009-08-13 10:45:23 ----D---- C:\Program Files\Mozilla Firefox
    2009-08-13 10:18:10 ----RSHD---- C:\WINDOWS\system32\DLLCACHE
    2009-08-13 10:18:06 ----D---- C:\WINDOWS\Temp
    2009-08-13 10:16:47 ----HD---- C:\WINDOWS\INF
    2009-08-13 10:15:46 ----D---- C:\WINDOWS\system32\CatRoot2
    2009-08-13 10:15:31 ----A---- C:\WINDOWS\ModemLog_Intel(R) 537EP V9x DF PCI Modem.txt
    2009-08-12 23:14:34 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-08-12 23:14:16 ----D---- C:\WINDOWS
    2009-08-12 23:14:11 ----A---- C:\WINDOWS\imsins.BAK
    2009-08-12 23:13:57 ----HD---- C:\WINDOWS\$hf_mig$
    2009-08-12 23:13:41 ----D---- C:\Program Files\Outlook Express
    2009-08-12 14:23:27 ----SHD---- C:\WINDOWS\Installer
    2009-08-12 14:22:13 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\LimeWire
    2009-08-09 20:52:38 ----D---- C:\Program Files\Messenger Plus! Live
    2009-08-09 14:56:26 ----D---- C:\WINDOWS\system32\FxsTmp
    2009-08-07 11:46:50 ----D---- C:\WINDOWS\system32\DRIVERS
    2009-08-05 11:47:03 ----D---- C:\Program Files\Java
    2009-08-05 05:00:38 ----A---- C:\WINDOWS\system32\mswebdvd.dll
    2009-07-31 17:53:31 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Apple Computer
    2009-07-31 17:53:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
    2009-07-29 20:49:14 ----A---- C:\WINDOWS\system32\MRT.exe
    2009-07-29 04:32:42 ----D---- C:\WINDOWS\WinSxS
    2009-07-28 15:20:09 ----A---- C:\WINDOWS\WIN.INI
    2009-07-27 13:47:30 ----D---- C:\Program Files\MSN
    2009-07-26 21:41:07 ----D---- C:\Documents and Settings
    2009-07-26 12:46:54 ----HD---- C:\Program Files\InstallShield Installation Information
    2009-07-26 12:46:53 ----SD---- C:\WINDOWS\Downloaded Program Files
    2009-07-26 12:46:39 ----D---- C:\Documents and Settings\All Users\Application Data\IJJIGame
    2009-07-25 05:23:00 ----A---- C:\WINDOWS\system32\deploytk.dll
    2009-07-24 11:09:00 ----D---- C:\Program Files\BitComet
    2009-07-24 10:57:52 ----D---- C:\Downloads
    2009-07-19 00:22:12 ----D---- C:\Program Files\EA Games
    2009-07-18 12:03:49 ----A---- C:\WINDOWS\system32\shdocvw.dll
    2009-07-18 12:03:49 ----A---- C:\WINDOWS\system32\mshtml.dll
    2009-07-17 07:44:00 ----D---- C:\Program Files\WinRAR
    2009-07-16 20:03:36 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
    2009-07-16 20:03:22 ----A---- C:\WINDOWS\system32\pbsvc.exe
    2009-07-15 10:30:15 ----D---- C:\Program Files\Windows Live
    2009-07-15 10:23:02 ----D---- C:\Documents and Settings\All Users\Application Data\WindSolutions

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
    R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
    R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\eeCtrl.sys []
    R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
    R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
    R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
    R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-13 28520]
    R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
    R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-06-18 281760]
    R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
    R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-11-23 40480]
    R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-06-18 25888]
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
    R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-12-06 25883]
    R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-12-06 34843]
    R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-12-06 4123]
    R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-12-06 2271]
    R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-12-06 86586]
    R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-12-06 15227]
    R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-12-06 6363]
    R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-12-06 98714]
    R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-12-06 100603]
    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2003-09-22 130192]
    R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
    R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
    R3 IntelC51;IntelC51; C:\WINDOWS\system32\DRIVERS\IntelC51.sys [2004-03-05 1233525]
    R3 IntelC52;IntelC52; C:\WINDOWS\system32\DRIVERS\IntelC52.sys [2004-03-05 647929]
    R3 IntelC53;IntelC53; C:\WINDOWS\system32\DRIVERS\IntelC53.sys [2004-06-15 61157]
    R3 MODEMCSA;Périphérique de filtrage de flux Unimodem; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    R3 mohfilt;mohfilt; C:\WINDOWS\system32\DRIVERS\mohfilt.sys [2004-03-05 37048]
    R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2003-09-22 178672]
    R3 P17;Sound Blaster Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2004-06-09 840960]
    R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
    R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
    S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
    S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-06-05 39424]
    S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-07-13 108289]
    R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-13 185089]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
    R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.EXE [1999-12-13 44032]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]
    R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
    R2 lxdn_device;lxdn_device; C:\WINDOWS\system32\lxdncoms.exe [2007-12-05 594600]
    R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]
    R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-23 75064]
    R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2000-06-26 53520]
    R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
    R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-06-05 541992]
    S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe /h ccCommon []
    S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 268800]
    S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe /h ccCommon []
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
    S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2003-12-17 143360]
    S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-02-16 2736890]

    -----------------EOF-----------------
    Contenus similaires
    a c 273 8 Sécurité
    13 Août 2009 17:12:00

    Tu as plusieurs infections.

  • Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
  • Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
  • Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
  • Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
  • Sélectionne Exécuter un examen rapide.
  • Clique sur Rechercher. L'analyse démarre.
  • A la fin de l'analyse, un message s'affiche :
    Citation :
    L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  • Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  • Ferme tes navigateurs.
  • Si des malwares ont été détectés, clique sur Afficher les résultats.
  • Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
  • MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
    13 Août 2009 17:43:18

    Malwarebytes' Anti-Malware 1.40
    Version de la base de données: 2615
    Windows 5.1.2600 Service Pack 3

    2009-08-13 11:38:42
    mbam-log-2009-08-13 (11-38-42).txt

    Type de recherche: Examen rapide
    Eléments examinés: 96397
    Temps écoulé: 16 minute(s), 53 second(s)

    Processus mémoire infecté(s): 1
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 7
    Valeur(s) du Registre infectée(s): 9
    Elément(s) de données du Registre infecté(s): 6
    Dossier(s) infecté(s): 5
    Fichier(s) infecté(s): 36

    Processus mémoire infecté(s):
    C:\WINDOWS\SYSTEM32\braviax.exe (Trojan.FakeAlert) -> Unloaded process successfully.

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\CLSID\{021446aa-2867-4068-ab9a-a4cb2297c026} (Adware.SpeedApps) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57} (Adware.SpeedApps) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57} (Adware.SpeedApps) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Speedapps (Adware.Speedapps) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\speedapps Toolbar (Adware.Speedapps) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Speedapps (Adware.Speedapps) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57} (Adware.SpeedApps) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57} (Adware.SpeedApps) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57} (Adware.SpeedApps) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IEPR (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iOmem (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Dossier(s) infecté(s):
    C:\Documents and Settings\All Users\Application Data\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.
    C:\Program Files\Seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps (Adware.SpeedApps) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    C:\Documents and Settings\Alex et Marc\msword98.exe (Trojan.FakeAlert.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\msword98.exe (Trojan.FakeAlert.H) -> Delete on reboot.
    C:\Program Files\speedapps\tbspe0.dll (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\nsc70.tmp\seekapp.exe (Adware.SeekApp) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Seekapp\seekapp122.exe (Adware.Seekapp) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps\INSTALL.LOG (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps\speedappsToolbarHelper.exe (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps\tbspe1.dll (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps\tbspee.dll (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps\toolbar.cfg (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Program Files\speedapps\UNWISE.EXE (Adware.SpeedApps) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\braviax.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\Temp\BN2A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN1C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN1D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN1E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN1F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN20.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN21.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN22.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN23.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN24.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN25.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN26.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BN27.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\Local Settings\Temp\BNEA.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\Temp\wpv631250024935.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\daniel dufour\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Alex et Marc\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
    C:\Documents and Settings\daniel dufour\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
    a c 273 8 Sécurité
    13 Août 2009 18:16:43

  • Relance MBAM, va dans Quarantaine et supprime tout.

  • Télécharge Lop S&D sur ton Bureau.
  • Double-clique dessus pour lancer l'installation.
  • Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
    (Sous Vista, il faut cliquer droit sur le raccourci Lop S&D et choisir Exécuter en tant qu'administrateur)
  • Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche) .
  • Patiente jusqu'à la fin du scan.
  • Poste le rapport généré (C:\lopR.txt).
    13 Août 2009 18:23:04


    --------------------\\ Lop S&D 4.2.5-0 XP/Vista

    Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
    X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
    BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
    USER : Alex et Marc ( Administrator )
    BOOT : Normal boot
    Antivirus : AntiVir Desktop 9.0.1.30 (Activated)
    A:\ (USB)
    C:\ (Local Disk) - NTFS - Total:146 Go (Free:107 Go)
    D:\ (CD or DVD)

    "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
    Option : [1] ( 2009-08-13|12:20 )

    --------------------\\ Listing des dossiers dans APPLIC~1

    [2009-05-04|16:21] C:\DOCUME~1\ALEXET~1\APPLIC~1\3M
    [2009-02-15|13:54] C:\DOCUME~1\ALEXET~1\APPLIC~1\Adobe
    [2009-07-31|17:53] C:\DOCUME~1\ALEXET~1\APPLIC~1\Apple Computer
    [2009-08-06|13:08] C:\DOCUME~1\ALEXET~1\APPLIC~1\Audacity
    [2009-06-20|10:09] C:\DOCUME~1\ALEXET~1\APPLIC~1\CopyTrans
    [2009-04-30|16:45] C:\DOCUME~1\ALEXET~1\APPLIC~1\CopyTransControlCenter
    [2005-05-07|08:04] C:\DOCUME~1\ALEXET~1\APPLIC~1\Creative
    [2009-04-24|14:42] C:\DOCUME~1\ALEXET~1\APPLIC~1\CyberLink
    [2009-07-15|11:07] C:\DOCUME~1\ALEXET~1\APPLIC~1\Desktopicon
    [2009-07-09|12:32] C:\DOCUME~1\ALEXET~1\APPLIC~1\Help
    [2005-05-07|07:36] C:\DOCUME~1\ALEXET~1\APPLIC~1\Identities
    [2009-03-27|21:23] C:\DOCUME~1\ALEXET~1\APPLIC~1\ijjigame
    [2009-03-15|00:34] C:\DOCUME~1\ALEXET~1\APPLIC~1\InstallShield
    [2009-03-25|07:47] C:\DOCUME~1\ALEXET~1\APPLIC~1\Leadertech
    [2009-05-15|21:08] C:\DOCUME~1\ALEXET~1\APPLIC~1\Lexmark Productivity Studio
    [2009-08-12|14:22] C:\DOCUME~1\ALEXET~1\APPLIC~1\LimeWire
    [2009-02-27|18:09] C:\DOCUME~1\ALEXET~1\APPLIC~1\Macromedia
    [2009-08-13|11:17] C:\DOCUME~1\ALEXET~1\APPLIC~1\Malwarebytes
    [2009-06-22|22:41] C:\DOCUME~1\ALEXET~1\APPLIC~1\Media Player Classic
    [2009-04-17|22:10] C:\DOCUME~1\ALEXET~1\APPLIC~1\Microsoft
    [2009-02-11|17:31] C:\DOCUME~1\ALEXET~1\APPLIC~1\Mozilla
    [2009-07-27|13:47] C:\DOCUME~1\ALEXET~1\APPLIC~1\MSNInstaller
    [2009-03-02|13:45] C:\DOCUME~1\ALEXET~1\APPLIC~1\OpenOffice.org
    [2009-03-25|07:47] C:\DOCUME~1\ALEXET~1\APPLIC~1\Sonic
    [2005-05-07|07:59] C:\DOCUME~1\ALEXET~1\APPLIC~1\Sun
    [2005-05-07|08:06] C:\DOCUME~1\ALEXET~1\APPLIC~1\Symantec
    [2009-06-20|10:08] C:\DOCUME~1\ALEXET~1\APPLIC~1\WindSolutions
    [2009-03-24|07:05] C:\DOCUME~1\ALEXET~1\APPLIC~1\WinRAR

    [2009-04-04|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    [2009-04-21|22:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2005-05-07|08:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [2009-07-31|17:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
    [2009-02-11|17:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [2009-05-15|15:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
    [2009-03-01|19:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Awem
    [2005-05-07|08:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
    [2009-07-03|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Chat Republic Games
    [2009-06-20|10:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CopyTransControlCenter
    [2009-07-12|14:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\each new axis love
    [2009-05-07|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fugazo
    [2009-03-01|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GameHouse
    [2009-03-19|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
    [2009-07-26|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IJJIGame
    [2009-02-24|23:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lexmark 2600 Series
    [2009-08-13|11:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
    [2009-06-29|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [2009-05-10|16:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [2009-03-21|00:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo
    [2009-05-12|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NeptunesAdve
    [2009-03-19|21:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
    [2009-03-05|23:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Playrix Entertainment
    [2009-04-13|20:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pure Networks
    [2005-05-07|07:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
    [2009-05-12|23:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpinTop Games
    [2009-07-13|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
    [2009-02-23|08:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
    [2009-05-27|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ThumbnailCache4R
    [2009-05-15|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
    [2009-02-11|18:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [2009-07-15|10:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindSolutions
    [2009-06-28|09:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
    [2009-02-24|23:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
    [2009-03-01|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom


    [2005-05-07|08:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Creative
    [2005-05-07|07:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
    [2005-05-07|07:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
    [2005-05-07|08:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sonic
    [2005-05-07|07:59] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
    [2005-05-07|08:06] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

    [2009-02-11|20:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [2005-05-07|07:36] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft



    --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

    [2009-08-10 07:48][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2009-08-13 11:40][--ah-----] C:\WINDOWS\tasks\SA.DAT
    [2004-08-05 13:00][-r-h-----] C:\WINDOWS\tasks\DESKTOP.INI

    --------------------\\ Listing des dossiers dans C:\Program Files

    [2009-05-04|10:54] C:\Program Files\3M
    [2005-05-07|08:08] C:\Program Files\Adobe
    [2009-02-11|17:38] C:\Program Files\Apple Software Update
    [2009-07-04|12:22] C:\Program Files\Audible
    [2009-05-15|15:34] C:\Program Files\Avira
    [2009-07-24|11:29] C:\Program Files\BestGameEver
    [2009-07-24|11:09] C:\Program Files\BitComet
    [2009-04-04|17:51] C:\Program Files\Bonjour
    [2009-08-13|11:55] C:\Program Files\Cheat Engine
    [2009-08-09|20:54] C:\Program Files\Circle Develoement
    [2009-06-28|11:21] C:\Program Files\Cirle Developement
    [2009-07-15|23:40] C:\Program Files\Common Files
    [2009-06-20|10:06] C:\Program Files\Conduit
    [2005-05-07|08:01] C:\Program Files\Creative
    [2005-05-07|08:02] C:\Program Files\CyberLink
    [2005-05-07|08:04] C:\Program Files\Dell
    [2005-05-07|08:02] C:\Program Files\Dell Computer
    [2009-06-23|12:29] C:\Program Files\DirectX
    [2009-07-19|00:22] C:\Program Files\EA Games
    [2009-03-31|08:17] C:\Program Files\ElastoManiaRegistered
    [2009-08-13|11:49] C:\Program Files\Fichiers communs
    [2009-07-05|10:33] C:\Program Files\forumswatcher.com
    [2009-03-15|00:34] C:\Program Files\GamersFirst
    [2009-07-31|21:53] C:\Program Files\Gpotato
    [2009-07-24|12:51] C:\Program Files\gPotato.eu
    [2009-05-31|22:06] C:\Program Files\Hidden Expedition Titanic
    [2009-05-13|14:44] C:\Program Files\Hidden Wonders
    [2009-07-26|12:46] C:\Program Files\InstallShield Installation Information
    [2005-05-07|08:00] C:\Program Files\Intel
    [2009-05-01|23:20] C:\Program Files\Internet Explorer
    [2009-06-22|22:17] C:\Program Files\iPod
    [2009-06-22|22:17] C:\Program Files\iTunes
    [2005-05-07|08:02] C:\Program Files\Jasc Software Inc
    [2009-08-05|11:47] C:\Program Files\Java
    [2009-02-24|20:43] C:\Program Files\JRE
    [2009-08-06|13:08] C:\Program Files\Lame for Audacity
    [2009-02-11|11:34] C:\Program Files\Lexmark 2600 Series
    [2009-02-11|11:28] C:\Program Files\Lexmark Toolbar
    [2009-02-15|16:19] C:\Program Files\LimeWire
    [2009-08-13|11:17] C:\Program Files\Malwarebytes' Anti-Malware
    [2009-02-22|19:54] C:\Program Files\Messenger
    [2009-08-09|20:52] C:\Program Files\Messenger Plus! Live
    [2009-03-14|18:58] C:\Program Files\M‚t‚oM‚dia
    [2009-07-15|10:30] C:\Program Files\Microsoft
    [2009-02-12|00:04] C:\Program Files\Microsoft CAPICOM 2.1.0.2
    [2005-05-07|07:36] C:\Program Files\microsoft frontpage
    [2005-05-07|08:00] C:\Program Files\Modem Helper
    [2005-05-07|08:00] C:\Program Files\Modem On Hold
    [2009-02-22|18:15] C:\Program Files\Movie Maker
    [2009-08-13|11:57] C:\Program Files\Mozilla Firefox
    [2009-07-27|13:47] C:\Program Files\MSN
    [2005-05-07|07:36] C:\Program Files\MSN Gaming Zone
    [2009-05-12|17:11] C:\Program Files\Mystery P.I. Vegas Deluxe
    [2009-05-28|07:44] C:\Program Files\Neptune's Secret
    [2009-02-22|18:12] C:\Program Files\NetMeeting
    [2009-02-23|08:23] C:\Program Files\Norton AntiVirus
    [2005-05-07|08:03] C:\Program Files\Nullsoft
    [2005-05-07|07:36] C:\Program Files\Online Services
    [2009-02-24|20:43] C:\Program Files\OpenOffice.org 3
    [2009-08-12|23:13] C:\Program Files\Outlook Express
    [2009-07-22|10:28] C:\Program Files\PartyGaming
    [2009-08-13|11:49] C:\Program Files\PC_Antispyware2010
    [2009-05-12|17:11] C:\Program Files\Pirateville
    [2009-06-22|22:14] C:\Program Files\QuickTime
    [2005-05-07|08:03] C:\Program Files\Real
    [2009-07-28|14:26] C:\Program Files\Realtime Landscaping Photo 5 Trial
    [2009-07-19|00:15] C:\Program Files\ReflexiveArcade
    [2009-07-20|23:16] C:\Program Files\Risk II
    [2005-05-07|07:36] C:\Program Files\Services en ligne
    [2009-07-28|15:13] C:\Program Files\Sierra On-Line
    [2005-05-07|08:05] C:\Program Files\Sonic
    [2009-08-13|11:02] C:\Program Files\trend micro
    [2005-05-07|07:36] C:\Program Files\Uninstall Information
    [2009-07-05|10:33] C:\Program Files\USARadioNow
    [2005-05-07|08:03] C:\Program Files\Viewpoint
    [2009-05-29|15:13] C:\Program Files\WHidePro
    [2009-06-20|10:49] C:\Program Files\Winamp
    [2009-07-15|10:30] C:\Program Files\Windows Live
    [2009-02-11|11:56] C:\Program Files\Windows Live SkyDrive
    [2009-02-11|18:25] C:\Program Files\Windows Media Connect 2
    [2009-02-22|18:12] C:\Program Files\Windows Media Player
    [2009-02-22|18:12] C:\Program Files\Windows NT
    [2005-05-07|07:36] C:\Program Files\WindowsUpdate
    [2009-07-17|07:44] C:\Program Files\WinRAR
    [2005-05-07|08:09] C:\Program Files\WordPerfect Office 12
    [2005-05-07|07:36] C:\Program Files\XEROX
    [2009-02-22|23:57] C:\Program Files\Yahoo!
    [2009-05-07|21:54] C:\Program Files\Zylom Games

    --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

    [2009-02-12|19:56] C:\Program Files\Fichiers communs\Adobe
    [2005-05-07|08:03] C:\Program Files\Fichiers communs\AOL
    [2009-06-22|22:17] C:\Program Files\Fichiers communs\Apple
    [2005-05-07|08:09] C:\Program Files\Fichiers communs\Borland Shared
    [2005-05-07|08:09] C:\Program Files\Fichiers communs\Corel
    [2005-05-07|08:09] C:\Program Files\Fichiers communs\InstallShield
    [2005-05-07|07:59] C:\Program Files\Fichiers communs\Java
    [2009-05-15|15:29] C:\Program Files\Fichiers communs\Microsoft Shared
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\MSSoap
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\ODBC
    [2005-05-07|08:03] C:\Program Files\Fichiers communs\Real
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\Services
    [2005-05-07|08:04] C:\Program Files\Fichiers communs\Sonic
    [2005-05-07|08:05] C:\Program Files\Fichiers communs\Sonic Shared
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\SpeechEngines
    [2009-02-23|08:23] C:\Program Files\Fichiers communs\Symantec Shared
    [2009-02-22|18:12] C:\Program Files\Fichiers communs\System
    [2009-02-11|11:53] C:\Program Files\Fichiers communs\Windows Live
    [2009-06-28|09:42] C:\Program Files\Fichiers communs\WindowsLiveInstaller

    --------------------\\ Process

    ( 52 Processes )

    ... OK !

    --------------------\\ Recherche avec S_Lop

    Aucun fichier / dossier Lop trouvé !

    --------------------\\ Recherche de Fichiers / Dossiers Lop

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Each New Axis Love
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Each New Axis Love\DATE 01.dat
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\msgpl_0ee5.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\msgpl_d5c9.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsc6E.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsc70.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nss5C.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nst1C9.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsvE3.tmp
    C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsy2D.tmp
    C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@www.adserver5[1].txt
    C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@advertising[1].txt
    C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@partygaming.122.2o7[2].txt
    C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@partypoker[1].txt

    --------------------\\ Verification du Registre

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "axis love poll lite"="C:\\Documents and Settings\\All Users\\Application Data\\each new axis love\\DATE 01.exe"

    --------------------\\ Verification du fichier Hosts

    Fichier Hosts PROPRE


    --------------------\\ Recherche de fichiers avec Catchme

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-13 12:21:30
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    C:\WINDOWS\System32\userinit.exe 89600 bytes executable
    C:\WINDOWS\System32\DRIVERS\win32x.sys 21408 bytes executable
    C:\WINDOWS\System32\win32x.exe 26624 bytes executable
    scan completed successfully
    hidden processes: 0
    hidden files: 3

    --------------------\\ Recherche d'autres infections

    --------------------\\ Cracks & Keygens ..

    C:\DOCUME~1\ALEXET~1\Mes documents\Ma musique\Nouveau dossier\Eminem ft. Dr. Dre & 50 Cent - Crack A Bottle.mp3


    [F:2410][D:156]-> C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp
    [F:112][D:0]-> C:\DOCUME~1\ALEXET~1\Cookies
    [F:728][D:4]-> C:\DOCUME~1\ALEXET~1\LOCALS~1\TEMPOR~1\content.IE5

    1 - "C:\Lop SD\LopR_1.txt" - 2009-08-13|12:22 - Option : [1]

    --------------------\\ Fin du rapport a 12:22:39
    a c 273 8 Sécurité
    13 Août 2009 18:33:46

  • Relance Lop S&D.
    (Sous Vista, il faut cliquer droit sur le raccourci Lop S&D et choisir Exécuter en tant qu'administrateur)
  • Choisis cette fois-ci l'option 2 (Suppression).
  • Ne ferme pas la fenêtre lors de la suppression !
  • Poste le rapport généré (C:\lopR.txt).

    (Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)
    13 Août 2009 18:44:58


    --------------------\\ Lop S&D 4.2.5-0 XP/Vista

    Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
    X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
    BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
    USER : Alex et Marc ( Administrator )
    BOOT : Normal boot
    Antivirus : AntiVir Desktop 9.0.1.30 (Activated)
    A:\ (USB)
    C:\ (Local Disk) - NTFS - Total:146 Go (Free:107 Go)
    D:\ (CD or DVD)

    "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
    Option : [2] ( 2009-08-13|12:35 )


    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

    Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Each New Axis Love\DATE 01.dat
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\msgpl_0ee5.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\msgpl_d5c9.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsc6E.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsc70.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nss5C.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nst1C9.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsvE3.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp\nsy2D.tmp
    Supprime! - C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@www.adserver5[1].txt
    Supprime! - C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@advertising[1].txt
    Supprime! - C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@partygaming.122.2o7[2].txt
    Supprime! - C:\DOCUME~1\ALEXET~1\Cookies\alex et marc@partypoker[1].txt
    Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Each New Axis Love

    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

    Supprime! - C:\Program Files\Viewpoint

    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


    --------------------\\ Listing des dossiers dans APPLIC~1

    [2009-05-04|16:21] C:\DOCUME~1\ALEXET~1\APPLIC~1\3M
    [2009-02-15|13:54] C:\DOCUME~1\ALEXET~1\APPLIC~1\Adobe
    [2009-07-31|17:53] C:\DOCUME~1\ALEXET~1\APPLIC~1\Apple Computer
    [2009-08-06|13:08] C:\DOCUME~1\ALEXET~1\APPLIC~1\Audacity
    [2009-06-20|10:09] C:\DOCUME~1\ALEXET~1\APPLIC~1\CopyTrans
    [2009-04-30|16:45] C:\DOCUME~1\ALEXET~1\APPLIC~1\CopyTransControlCenter
    [2005-05-07|08:04] C:\DOCUME~1\ALEXET~1\APPLIC~1\Creative
    [2009-04-24|14:42] C:\DOCUME~1\ALEXET~1\APPLIC~1\CyberLink
    [2009-07-15|11:07] C:\DOCUME~1\ALEXET~1\APPLIC~1\Desktopicon
    [2009-07-09|12:32] C:\DOCUME~1\ALEXET~1\APPLIC~1\Help
    [2005-05-07|07:36] C:\DOCUME~1\ALEXET~1\APPLIC~1\Identities
    [2009-03-27|21:23] C:\DOCUME~1\ALEXET~1\APPLIC~1\ijjigame
    [2009-03-15|00:34] C:\DOCUME~1\ALEXET~1\APPLIC~1\InstallShield
    [2009-03-25|07:47] C:\DOCUME~1\ALEXET~1\APPLIC~1\Leadertech
    [2009-05-15|21:08] C:\DOCUME~1\ALEXET~1\APPLIC~1\Lexmark Productivity Studio
    [2009-08-12|14:22] C:\DOCUME~1\ALEXET~1\APPLIC~1\LimeWire
    [2009-02-27|18:09] C:\DOCUME~1\ALEXET~1\APPLIC~1\Macromedia
    [2009-08-13|11:17] C:\DOCUME~1\ALEXET~1\APPLIC~1\Malwarebytes
    [2009-06-22|22:41] C:\DOCUME~1\ALEXET~1\APPLIC~1\Media Player Classic
    [2009-04-17|22:10] C:\DOCUME~1\ALEXET~1\APPLIC~1\Microsoft
    [2009-02-11|17:31] C:\DOCUME~1\ALEXET~1\APPLIC~1\Mozilla
    [2009-07-27|13:47] C:\DOCUME~1\ALEXET~1\APPLIC~1\MSNInstaller
    [2009-03-02|13:45] C:\DOCUME~1\ALEXET~1\APPLIC~1\OpenOffice.org
    [2009-03-25|07:47] C:\DOCUME~1\ALEXET~1\APPLIC~1\Sonic
    [2005-05-07|07:59] C:\DOCUME~1\ALEXET~1\APPLIC~1\Sun
    [2005-05-07|08:06] C:\DOCUME~1\ALEXET~1\APPLIC~1\Symantec
    [2009-06-20|10:08] C:\DOCUME~1\ALEXET~1\APPLIC~1\WindSolutions
    [2009-03-24|07:05] C:\DOCUME~1\ALEXET~1\APPLIC~1\WinRAR

    [2009-04-04|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    [2009-04-21|22:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2005-05-07|08:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [2009-07-31|17:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
    [2009-02-11|17:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [2009-05-15|15:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
    [2009-03-01|19:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Awem
    [2005-05-07|08:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
    [2009-07-03|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Chat Republic Games
    [2009-06-20|10:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CopyTransControlCenter
    [2009-05-07|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fugazo
    [2009-03-01|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GameHouse
    [2009-03-19|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
    [2009-07-26|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IJJIGame
    [2009-02-24|23:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lexmark 2600 Series
    [2009-08-13|11:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
    [2009-06-29|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [2009-05-10|16:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [2009-03-21|00:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo
    [2009-05-12|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NeptunesAdve
    [2009-03-19|21:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
    [2009-03-05|23:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Playrix Entertainment
    [2009-04-13|20:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pure Networks
    [2005-05-07|07:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
    [2009-05-12|23:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpinTop Games
    [2009-07-13|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
    [2009-02-23|08:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
    [2009-05-27|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ThumbnailCache4R
    [2009-05-15|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
    [2009-02-11|18:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [2009-07-15|10:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindSolutions
    [2009-06-28|09:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
    [2009-02-24|23:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
    [2009-03-01|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom


    [2005-05-07|08:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Creative
    [2005-05-07|07:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
    [2005-05-07|07:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
    [2005-05-07|08:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sonic
    [2005-05-07|07:59] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
    [2005-05-07|08:06] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

    [2009-02-11|20:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [2005-05-07|07:36] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft



    --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

    [2009-08-10 07:48][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2009-08-13 11:40][--ah-----] C:\WINDOWS\tasks\SA.DAT
    [2004-08-05 13:00][-r-h-----] C:\WINDOWS\tasks\DESKTOP.INI

    --------------------\\ Listing des dossiers dans C:\Program Files

    [2009-05-04|10:54] C:\Program Files\3M
    [2005-05-07|08:08] C:\Program Files\Adobe
    [2009-02-11|17:38] C:\Program Files\Apple Software Update
    [2009-07-04|12:22] C:\Program Files\Audible
    [2009-05-15|15:34] C:\Program Files\Avira
    [2009-07-24|11:29] C:\Program Files\BestGameEver
    [2009-07-24|11:09] C:\Program Files\BitComet
    [2009-04-04|17:51] C:\Program Files\Bonjour
    [2009-08-13|11:55] C:\Program Files\Cheat Engine
    [2009-08-09|20:54] C:\Program Files\Circle Develoement
    [2009-06-28|11:21] C:\Program Files\Cirle Developement
    [2009-07-15|23:40] C:\Program Files\Common Files
    [2009-06-20|10:06] C:\Program Files\Conduit
    [2005-05-07|08:01] C:\Program Files\Creative
    [2005-05-07|08:02] C:\Program Files\CyberLink
    [2005-05-07|08:04] C:\Program Files\Dell
    [2005-05-07|08:02] C:\Program Files\Dell Computer
    [2009-06-23|12:29] C:\Program Files\DirectX
    [2009-07-19|00:22] C:\Program Files\EA Games
    [2009-03-31|08:17] C:\Program Files\ElastoManiaRegistered
    [2009-08-13|11:49] C:\Program Files\Fichiers communs
    [2009-07-05|10:33] C:\Program Files\forumswatcher.com
    [2009-03-15|00:34] C:\Program Files\GamersFirst
    [2009-07-31|21:53] C:\Program Files\Gpotato
    [2009-07-24|12:51] C:\Program Files\gPotato.eu
    [2009-05-31|22:06] C:\Program Files\Hidden Expedition Titanic
    [2009-05-13|14:44] C:\Program Files\Hidden Wonders
    [2009-07-26|12:46] C:\Program Files\InstallShield Installation Information
    [2005-05-07|08:00] C:\Program Files\Intel
    [2009-05-01|23:20] C:\Program Files\Internet Explorer
    [2009-06-22|22:17] C:\Program Files\iPod
    [2009-06-22|22:17] C:\Program Files\iTunes
    [2005-05-07|08:02] C:\Program Files\Jasc Software Inc
    [2009-08-05|11:47] C:\Program Files\Java
    [2009-02-24|20:43] C:\Program Files\JRE
    [2009-08-06|13:08] C:\Program Files\Lame for Audacity
    [2009-02-11|11:34] C:\Program Files\Lexmark 2600 Series
    [2009-02-11|11:28] C:\Program Files\Lexmark Toolbar
    [2009-02-15|16:19] C:\Program Files\LimeWire
    [2009-08-13|11:17] C:\Program Files\Malwarebytes' Anti-Malware
    [2009-02-22|19:54] C:\Program Files\Messenger
    [2009-08-09|20:52] C:\Program Files\Messenger Plus! Live
    [2009-03-14|18:58] C:\Program Files\M‚t‚oM‚dia
    [2009-07-15|10:30] C:\Program Files\Microsoft
    [2009-02-12|00:04] C:\Program Files\Microsoft CAPICOM 2.1.0.2
    [2005-05-07|07:36] C:\Program Files\microsoft frontpage
    [2005-05-07|08:00] C:\Program Files\Modem Helper
    [2005-05-07|08:00] C:\Program Files\Modem On Hold
    [2009-02-22|18:15] C:\Program Files\Movie Maker
    [2009-08-13|12:31] C:\Program Files\Mozilla Firefox
    [2009-07-27|13:47] C:\Program Files\MSN
    [2005-05-07|07:36] C:\Program Files\MSN Gaming Zone
    [2009-05-12|17:11] C:\Program Files\Mystery P.I. Vegas Deluxe
    [2009-05-28|07:44] C:\Program Files\Neptune's Secret
    [2009-02-22|18:12] C:\Program Files\NetMeeting
    [2009-02-23|08:23] C:\Program Files\Norton AntiVirus
    [2005-05-07|08:03] C:\Program Files\Nullsoft
    [2005-05-07|07:36] C:\Program Files\Online Services
    [2009-02-24|20:43] C:\Program Files\OpenOffice.org 3
    [2009-08-12|23:13] C:\Program Files\Outlook Express
    [2009-07-22|10:28] C:\Program Files\PartyGaming
    [2009-08-13|11:49] C:\Program Files\PC_Antispyware2010
    [2009-05-12|17:11] C:\Program Files\Pirateville
    [2009-06-22|22:14] C:\Program Files\QuickTime
    [2005-05-07|08:03] C:\Program Files\Real
    [2009-07-28|14:26] C:\Program Files\Realtime Landscaping Photo 5 Trial
    [2009-07-19|00:15] C:\Program Files\ReflexiveArcade
    [2009-07-20|23:16] C:\Program Files\Risk II
    [2005-05-07|07:36] C:\Program Files\Services en ligne
    [2009-07-28|15:13] C:\Program Files\Sierra On-Line
    [2005-05-07|08:05] C:\Program Files\Sonic
    [2009-08-13|11:02] C:\Program Files\trend micro
    [2005-05-07|07:36] C:\Program Files\Uninstall Information
    [2009-07-05|10:33] C:\Program Files\USARadioNow
    [2009-05-29|15:13] C:\Program Files\WHidePro
    [2009-06-20|10:49] C:\Program Files\Winamp
    [2009-07-15|10:30] C:\Program Files\Windows Live
    [2009-02-11|11:56] C:\Program Files\Windows Live SkyDrive
    [2009-02-11|18:25] C:\Program Files\Windows Media Connect 2
    [2009-02-22|18:12] C:\Program Files\Windows Media Player
    [2009-02-22|18:12] C:\Program Files\Windows NT
    [2005-05-07|07:36] C:\Program Files\WindowsUpdate
    [2009-07-17|07:44] C:\Program Files\WinRAR
    [2005-05-07|08:09] C:\Program Files\WordPerfect Office 12
    [2005-05-07|07:36] C:\Program Files\XEROX
    [2009-02-22|23:57] C:\Program Files\Yahoo!
    [2009-05-07|21:54] C:\Program Files\Zylom Games

    --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

    [2009-02-12|19:56] C:\Program Files\Fichiers communs\Adobe
    [2005-05-07|08:03] C:\Program Files\Fichiers communs\AOL
    [2009-06-22|22:17] C:\Program Files\Fichiers communs\Apple
    [2005-05-07|08:09] C:\Program Files\Fichiers communs\Borland Shared
    [2005-05-07|08:09] C:\Program Files\Fichiers communs\Corel
    [2005-05-07|08:09] C:\Program Files\Fichiers communs\InstallShield
    [2005-05-07|07:59] C:\Program Files\Fichiers communs\Java
    [2009-05-15|15:29] C:\Program Files\Fichiers communs\Microsoft Shared
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\MSSoap
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\ODBC
    [2005-05-07|08:03] C:\Program Files\Fichiers communs\Real
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\Services
    [2005-05-07|08:04] C:\Program Files\Fichiers communs\Sonic
    [2005-05-07|08:05] C:\Program Files\Fichiers communs\Sonic Shared
    [2005-05-07|07:36] C:\Program Files\Fichiers communs\SpeechEngines
    [2009-02-23|08:23] C:\Program Files\Fichiers communs\Symantec Shared
    [2009-02-22|18:12] C:\Program Files\Fichiers communs\System
    [2009-02-11|11:53] C:\Program Files\Fichiers communs\Windows Live
    [2009-06-28|09:42] C:\Program Files\Fichiers communs\WindowsLiveInstaller

    --------------------\\ Process

    ( 48 Processes )

    ... OK !

    --------------------\\ Recherche avec S_Lop

    Aucun fichier / dossier Lop trouvé !

    --------------------\\ Recherche de Fichiers / Dossiers Lop

    Aucun fichier / dossier Lop trouvé !

    --------------------\\ Verification du Registre

    ..... OK !

    --------------------\\ Verification du fichier Hosts

    Fichier Hosts PROPRE


    --------------------\\ Recherche de fichiers avec Catchme

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-13 12:36:26
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    C:\WINDOWS\System32\userinit.exe 89600 bytes executable
    C:\WINDOWS\System32\DRIVERS\win32x.sys 21408 bytes executable
    C:\WINDOWS\System32\win32x.exe 26624 bytes executable
    scan completed successfully
    hidden processes: 0
    hidden files: 3

    --------------------\\ Recherche d'autres infections

    --------------------\\ Cracks & Keygens ..

    C:\DOCUME~1\ALEXET~1\Mes documents\Ma musique\Nouveau dossier\Eminem ft. Dr. Dre & 50 Cent - Crack A Bottle.mp3


    [F:2388][D:152]-> C:\DOCUME~1\ALEXET~1\LOCALS~1\Temp
    [F:108][D:0]-> C:\DOCUME~1\ALEXET~1\Cookies
    [F:728][D:4]-> C:\DOCUME~1\ALEXET~1\LOCALS~1\TEMPOR~1\content.IE5

    1 - "C:\Lop SD\LopR_1.txt" - 2009-08-13|12:22 - Option : [1]
    2 - "C:\Lop SD\LopR_2.txt" - 2009-08-13|12:37 - Option : [2]

    --------------------\\ Fin du rapport a 12:37:09
    a c 273 8 Sécurité
    13 Août 2009 18:50:06

    Bien.

  • Télécharge UsbFix (de Chiquitine29 & C_XX) sur ton Bureau.
  • Lance l'installation avec les paramètres par défaut.
  • Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
  • Double-clique sur le raccourci UsbFix sur ton Bureau.
  • Choisis l'option 1 (Recherche).
  • Laisse travailler l'outil.
  • Poste le rapport UsbFix.txt.

    Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

    "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
    13 Août 2009 19:02:00


    ############################## | UsbFix V6.017 |

    User : Alex et Marc (Administrateurs) # DANIEL
    Update on 12/08/09 by Chiquitine29 & C_XX
    Start at: 13:00:41 | 2009-08-13
    Website : http://pagesperso-orange.fr/NosTools/index.html

    Intel(R) Pentium(R) 4 CPU 2.80GHz
    Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 6.0.2900.5512
    Windows Firewall Status : Enabled
    AV : AntiVir Desktop 9.0.1.30 [ Enabled | Updated ]

    A:\ -> Lecteur de disquettes 3 ½ pouces
    C:\ -> Disque fixe local # 146,22 Go (107,95 Go free) # NTFS
    D:\ -> Disque CD-ROM
    E:\ -> Disque amovible # 3,6 Go (1,02 Go free) [IPOD ALEX] # FAT32
    F:\ -> Disque amovible # 7,5 Go (4,16 Go free) [KINGSTON] # FAT32

    ############################## | Processus actifs |

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdnserv.exe
    C:\WINDOWS\system32\lxdncoms.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Windows Media Player\WMPNetwk.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\braviax.exe
    C:\Program Files\PC_Antispyware2010\PC_Antispyware2010.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    ################## | Fichiers # Dossiers infectieux |

    Présent ! F:\m.exe
    Présent ! F:\autorun.inf

    ################## | Suspect ! ... | http://www.virustotal.com |


    ################## | Registre # Clés Run infectieuses |

    Présent ! HKLM\software\microsoft\security center "AntiVirusDisableNotify" ( 0x1 )
    Présent ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )
    Présent ! HKLM\software\microsoft\security center "FirewallDisableNotify" ( 0x1 )
    Présent ! HKLM\software\microsoft\security center "UpdatesDisableNotify" ( 0x1 )

    ################## | Registre # Mountpoints2 |

    HKCU\..\..\Explorer\MountPoints2\{484623d6-f908-11dd-8869-0013203f8cd7}
    shell\autorun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\m.exe /s

    HKCU\..\..\Explorer\MountPoints2\{bad07667-f7e3-11dd-8863-0013203f8cd7}
    Shell\AutoRun\command =E:\setupSNK.exe

    ################## | Cracks / Keygens / Serials |


    ################## | ! Fin du rapport # UsbFix V6.017 ! |

    a c 273 8 Sécurité
    13 Août 2009 19:04:30

    Le disque amovible F est infecté.

  • Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
  • Double-clique sur le raccourci UsbFix présent sur ton Bureau pour le lancer.
    (Sous Vista, il faut cliquer droit sur le raccourci UsbFix et choisir Exécuter en tant qu'administrateur)
  • Choisis l'option 2 (Suppression).
  • Ton Bureau disparaîtra et le PC redémarrera.
  • Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.
  • Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

    Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).
    13 Août 2009 19:12:05


    ############################## | UsbFix V6.017 |

    User : Alex et Marc (Administrateurs) # DANIEL
    Update on 12/08/09 by Chiquitine29 & C_XX
    Start at: 13:07:31 | 2009-08-13
    Website : http://pagesperso-orange.fr/NosTools/index.html

    Intel(R) Pentium(R) 4 CPU 2.80GHz
    Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 6.0.2900.5512
    Windows Firewall Status : Enabled
    AV : AntiVir Desktop 9.0.1.30 [ Enabled | Updated ]

    A:\ -> Lecteur de disquettes 3 ½ pouces
    C:\ -> Disque fixe local # 146,22 Go (107,92 Go free) # NTFS
    D:\ -> Disque CD-ROM
    E:\ -> Disque amovible # 3,6 Go (1,02 Go free) [IPOD ALEX] # FAT32
    F:\ -> Disque amovible # 7,5 Go (4,16 Go free) [KINGSTON] # FAT32

    ############################## | Processus actifs |

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\logonui.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\Explorer.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdnserv.exe
    C:\WINDOWS\system32\lxdncoms.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Windows Media Player\WMPNetwk.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    ################## | Fichiers # Dossiers infectieux |

    Supprimé ! F:\m.exe
    Supprimé ! F:\autorun.inf

    ################## | Autres |


    ################## | Suspect ! ... | http://www.virustotal.com |


    ################## | Registre # Clés Run infectieuses |

    # HKLM\software\microsoft\security center "AntiVirusDisableNotify" # -> Reset sucessfully !
    # HKLM\software\microsoft\security center "AntiVirusOverride" # -> Reset sucessfully !
    # HKLM\software\microsoft\security center "FirewallDisableNotify" # -> Reset sucessfully !
    # HKLM\software\microsoft\security center "UpdatesDisableNotify" # -> Reset sucessfully !

    ################## | Registre # Mountpoints2 |

    Supprimé ! HKCU\...\Explorer\MountPoints2\{bad07667-f7e3-11dd-8863-0013203f8cd7}\Shell\AutoRun\Command

    ################## | Listing des fichiers présent |

    [2004-08-20 11:37|--a------|0] -> C:\AUTOEXEC.BAT
    [2009-02-10 21:50|-rahs----|216] -> C:\BOOT.INI
    [2004-08-05 13:00|-rahs----|4952] -> C:\Bootfont.bin
    [2004-08-20 11:37|--a------|0] -> C:\CONFIG.SYS
    [2005-05-07 07:40|-rah-----|4389] -> C:\DELL.SDR
    [?|?|?] -> C:\hiberfil.sys
    [2004-08-20 11:48|--a------|4128] -> C:\INFCACHE.1
    [2004-08-20 11:37|--ah-----|0] -> C:\IO.SYS
    [2005-05-07 07:48|--a------|6597] -> C:\IO96BC~.TMP
    [2005-05-07 08:03|--ah-----|462] -> C:\IPH.PH
    [2009-08-13 12:37|--a------|14345] -> C:\lopR.txt
    [2004-08-20 11:37|--ah-----|0] -> C:\MSDOS.SYS
    [2004-08-05 13:00|-rahs----|47564] -> C:\NTDETECT.COM
    [2009-02-22 18:09|-rahs----|252240] -> C:\NTLDR
    [?|?|?] -> C:\pagefile.sys
    [2009-08-13 13:10|--a------|3527] -> C:\UsbFix.txt
    [2063-10-18 09:47|---------|0] -> E:\.metadata_never_index
    [2009-01-21 22:38|--a------|244382] -> F:\GrandCanyon03.jpg
    [2005-11-26 09:43|--a------|10660] -> F:\Pere Noel(Grandan)1.2.JPG
    [2004-08-10 01:04|--a------|23377] -> F:\Pompier23.jpg
    [2007-02-03 23:15|--a------|24882] -> F:\maman2.jpg
    [2005-09-11 19:20|--a------|47113] -> F:\11-09-2005-01.jpg
    [2007-02-03 23:14|--a------|95926] -> F:\papa2.jpg
    [2005-11-26 09:28|--a------|31957] -> F:\Pere Noel(Grandan) 2.1.JPG
    [2005-12-12 00:00|--ah-----|161140736] -> F:\.HPIMAGE.VFS
    [2008-02-16 18:27|--a------|1572745] -> F:\100_0336.jpg
    [2008-02-16 18:27|--a------|1342051] -> F:\100_0337.jpg
    [2008-02-16 18:27|--a------|1166724] -> F:\100_0338.jpg
    [2008-02-16 18:27|--a------|1298074] -> F:\100_0341.jpg
    [2008-12-01 07:40|--a------|4763648] -> F:\Belles_frimousses.pps
    [2009-03-19 10:18|--ah-----|14] -> F:\ixdb.dat
    [2009-08-07 13:28|--a------|14328] -> F:\rue pekans floraison.odt
    [2009-08-13 13:07|--a------|1282] -> F:\BOOTEX.LOG

    ################## | Cracks / Keygens / Serials |


    ################## | Upload |

    Veuillez envoyer le fichier : C:\DOCUME~1\ALEXET~1\Bureau\UsbFix_Upload_Me_DANIEL.zip : http://forum-aide-contre-virus.be/usbfix/choix_fichier....
    Merci pour votre contribution .

    ################## | ! Fin du rapport # UsbFix V6.017 ! |

    a c 273 8 Sécurité
    13 Août 2009 19:23:27

  • Désinstalle UsbFix.

    Je te fais une autre procédure après manger.
    a c 273 8 Sécurité
    13 Août 2009 20:10:43

    Citation :
    F:\ixdb.dat

    --> Ce fichier te dit quelque chose ?
    a c 273 8 Sécurité
    13 Août 2009 20:31:06

  • Télécharge OTM (OldTimer) sur ton Bureau.
  • Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
  • Double-clique sur OTM.exe afin de le lancer.
  • Copie (Ctrl+C) le texte suivant ci-dessous :

    :processes
    explorer.exe

    :files
    C:\Program Files\Circle Develoement
    C:\Program Files\Cirle Developement
    C:\Program Files\PC_Antispyware2010
    F:\ixdb.dat

    :commands
    [purity]
    [emptytemp]
    [reboot]

  • Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
  • Clique maintenant sur le bouton MoveIt! puis ferme OTM.

    ---> Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
    Accepte en cliquant sur YES.

  • Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
    ---> Le nom du rapport correspond au moment de sa création : date_heure.log
    13 Août 2009 21:51:22

    All processes killed
    Error: Unable to interpret <[emptytemp]> in the current context!
    Error: Unable to interpret <[reboot]> in the current context!

    OTM by OldTimer - Version 3.0.0.6 log created on 08132009_154710
    ->Temp folder emptied: 17429 bytes
    ->Temporary Internet Files folder emptied: 52483 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 9388238 bytes

    User: All Users

    User: daniel dufour

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Noella

    User: Propriétaire

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    Windows Temp folder emptied: 48128 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 9,13 mb


    OTM by OldTimer - Version 3.0.0.6 log created on 08132009_154710

    Files moved on Reboot...

    Registry entries deleted on Reboot...
    a c 273 8 Sécurité
    13 Août 2009 23:22:31

    Je crois que tu as mal copié-collé le script.
    14 Août 2009 02:04:12

    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== FILES ==========
    C:\Program Files\Circle Develoement moved successfully.
    C:\Program Files\Cirle Developement moved successfully.
    C:\Program Files\PC_Antispyware2010\Microsoft.VC80.CRT moved successfully.
    C:\Program Files\PC_Antispyware2010\data moved successfully.
    C:\Program Files\PC_Antispyware2010 moved successfully.
    F:\ixdb.dat moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Alex et Marc
    ->Temp folder emptied: 362406 bytes
    ->Temporary Internet Files folder emptied: 5566364 bytes
    ->Java cache emptied: 22351440 bytes
    ->FireFox cache emptied: 49125366 bytes

    User: All Users

    User: daniel dufour

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32768 bytes

    User: LocalService
    ->Temp folder emptied: 65984 bytes
    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 3477032 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Noella

    User: Propriétaire

    %systemdrive% .tmp files removed: 6597 bytes
    %systemroot% .tmp files removed: 19569 bytes
    %systemroot%\System32 .tmp files removed: 2992128 bytes
    Windows Temp folder emptied: 129024 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 80,26 mb


    OTM by OldTimer - Version 3.0.0.6 log created on 08132009_143323

    OTM by OldTimer - Version 3.0.0.6 log created on 08132009_143323

    OTM by OldTimer - Version 3.0.0.6 log created on 08132009_143319

    Files moved on Reboot...

    Registry entries deleted on Reboot...
    a c 273 8 Sécurité
    14 Août 2009 12:52:43

  • Supprime les traces de Norton avec ceci.

  • Refais un scan RSIT et poste le rapport log.
    14 Août 2009 17:02:05

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by Alex et Marc at 2009-08-14 11:01:06
    Microsoft Windows XP Édition familiale Service Pack 3
    System drive C: has 111 GB (74%) free of 150 GB
    Total RAM: 510 MB (27% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:01:20, on 2009-08-14
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdnserv.exe
    C:\WINDOWS\system32\lxdncoms.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\PC_Antispyware2010\PC_Antispyware2010.exe
    C:\WINDOWS\system32\braviax.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Alex et Marc\Bureau\RSIT.exe
    C:\Program Files\trend micro\Alex et Marc.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.app-zilla.com/search.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    R3 - URLSearchHook: forumswatcher.com Toolbar - {50d0cd27-d4ef-4a21-917e-a1573771def4} - C:\Program Files\forumswatcher.com\tbfor0.dll
    R3 - URLSearchHook: USARadioNow Toolbar - {669163c1-c4b9-46de-ad62-a0271d3a0a75} - C:\Program Files\USARadioNow\tbUSA0.dll
    R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: forumswatcher.com Toolbar - {50d0cd27-d4ef-4a21-917e-a1573771def4} - C:\Program Files\forumswatcher.com\tbfor0.dll
    O3 - Toolbar: USARadioNow Toolbar - {669163c1-c4b9-46de-ad62-a0271d3a0a75} - C:\Program Files\USARadioNow\tbUSA0.dll
    O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
    O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Documents and Settings\Alex et Marc\Bureau\Nouveau dossier\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
    O4 - HKLM\..\Run: [PC Antispyware 2010] "C:\Program Files\PC_Antispyware2010\PC_Antispyware2010.exe" /hide
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [WindowsHiderPro] C:\Program Files\WHidePro\whpro.exe
    O4 - HKCU\..\Run: [WeatherEye] C:\MétéoMédia\MétéoÉclair\WeatherEye.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
    O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll/206 (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.ca...
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
    O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - http://play.battlefield-heroes.com/static/updater/BFHUp...
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O20 - AppInit_DLLs: cru629.dat
    O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
    O23 - Service: lxdn_device - - C:\WINDOWS\system32\lxdncoms.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 10146 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-07-07 439872]
    {50d0cd27-d4ef-4a21-917e-a1573771def4} - forumswatcher.com Toolbar - C:\Program Files\forumswatcher.com\tbfor0.dll [2009-07-05 2215960]
    {669163c1-c4b9-46de-ad62-a0271d3a0a75} - USARadioNow Toolbar - C:\Program Files\USARadioNow\tbUSA0.dll [2009-07-05 2215960]
    {EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll []

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "IntelMeM"=C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe [2003-09-03 221184]
    "CTSysVol"=C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe [2003-09-17 57344]
    "P17Helper"=Rundll32 P17.dll,P17Helper []
    "UpdReg"=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]
    "DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-10-12 57344]
    "UpdateManager"=C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
    "dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2004-12-06 127035]
    "DMXLauncher"=C:\Program Files\Dell\Media Experience\DMXLauncher.exe [2005-01-27 86016]
    "lxdnmon.exe"=C:\Program Files\Lexmark 2600 Series\lxdnmon.exe [2007-12-17 660136]
    "lxdnamon"=C:\Program Files\Lexmark 2600 Series\lxdnamon.exe [2007-12-17 16040]
    "igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-09-20 94208]
    "igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-09-20 77824]
    "igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-09-20 114688]
    "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
    "WinampAgent"=C:\Program Files\Winamp\winampa.exe []
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
    "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-06-05 292136]
    "SweetIM"=C:\Program Files\SweetIM\Messenger\SweetIM.exe []
    "UnlockerAssistant"=C:\Documents and Settings\Alex et Marc\Bureau\Nouveau dossier\Unlocker\UnlockerAssistant.exe []
    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]
    "Regedit32"=C:\WINDOWS\system32\regedit.exe []
    "PC Antispyware 2010"=C:\Program Files\PC_Antispyware2010\PC_Antispyware2010.exe [2009-08-13 588886]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
    "WindowsHiderPro"=C:\Program Files\WHidePro\whpro.exe []
    "WeatherEye"=C:\MétéoMédia\MétéoÉclair\WeatherEye.exe [2009-01-16 4519832]
    "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]

    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
    Post-it® Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS"="cru629.dat"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\WINDOWS\system32\igfxdev.dll [2005-09-20 135168]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=255
    "NoDriveAutoRun"=FFFFFFFF
    "HonorAutoRunSetting"=1
    "ForceClassicControlPanel"=1

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "HonorAutoRunSetting"=
    "NoDriveAutoRun"=
    "NoDriveTypeAutoRun"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\WINDOWS\SYSTEM32\lxdncoms.exe"="C:\WINDOWS\SYSTEM32\lxdncoms.exe:*:Enabled:Lexmark Communications System"
    "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"="C:\Program Files\Lexmark 2600 Series\lxdnamon.exe:*:Enabled:Lexmark Device Monitor"
    "C:\Program Files\Lexmark 2600 Series\frun.exe"="C:\Program Files\Lexmark 2600 Series\frun.exe:*:Enabled:Lexmark Productivity Studio"
    "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"="C:\Program Files\Lexmark 2600 Series\lxdnmon.exe:*:Enabled:p rinter Device Monitor"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnpswx.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnpswx.exe:*:Enabled:p rinter Status Window Interface"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdntime.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdntime.exe:*:Enabled:Lexmark Connect Time Executable"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnjswx.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnjswx.exe:*:Enabled:Job Status Window Interface"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\Documents and Settings\All Users\Application Data\IJJIGame\PLauncher.exe"="C:\Documents and Settings\All Users\Application Data\IJJIGame\PLauncher.exe:*:D isabled:p Launcher Application"
    "C:\ijji\ENGLISH\u_sf\soldierfront.exe"="C:\ijji\ENGLISH\u_sf\soldierfront.exe:*:D isabled:soldierfront"
    "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\Program Files\Counter-Strike 1.6\hl.exe"="C:\Program Files\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
    "C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
    "C:\WINDOWS\SYSTEM32\java.exe"="C:\WINDOWS\SYSTEM32\java.exe:*:Enabled:Java(TM) Platform SE binary"
    "C:\Program Files\aMSN\bin\wish.exe"="C:\Program Files\aMSN\bin\wish.exe:*:Enabled:Wish Application"
    "C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe"
    "C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnwbgw.exe"="C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnwbgw.exe:*:Enabled:Lexmark Web Gateway"
    "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\Program Files\Lexmark 2600 Series\lxdnlscn.exe"="C:\Program Files\Lexmark 2600 Series\lxdnlscn.exe:*:D isabled: "
    "C:\Program Files\Lexmark 2600 Series\Diagnostics\LXDNdiag.exe"="C:\Program Files\Lexmark 2600 Series\Diagnostics\LXDNdiag.exe:*:D isabled: "
    "C:\WINDOWS\SYSTEM32\PnkBstrA.exe"="C:\WINDOWS\SYSTEM32\PnkBstrA.exe:*:D isabled:p nkBstrA"
    "C:\WINDOWS\SYSTEM32\PnkBstrB.exe"="C:\WINDOWS\SYSTEM32\PnkBstrB.exe:*:D isabled:p nkBstrB"
    "C:\WINDOWS\Downloaded Program Files\PurpleBean.exe"="C:\WINDOWS\Downloaded Program Files\PurpleBean.exe:*:D isabled:p urpleBean.exe"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

    ======List of files/folders created in the last 1 months======

    2009-08-14 10:53:06 ----D---- C:\Documents and Settings\All Users\Application Data\NortonInstaller
    2009-08-14 03:33:56 ----D---- C:\WINDOWS\system32\XPSViewer
    2009-08-14 03:32:37 ----D---- C:\Program Files\MSBuild
    2009-08-14 03:32:23 ----D---- C:\WINDOWS\system32\en-US
    2009-08-14 03:31:58 ----D---- C:\Program Files\Reference Assemblies
    2009-08-14 03:29:45 ----N---- C:\WINDOWS\system32\xpssvcs.dll
    2009-08-14 03:29:45 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
    2009-08-14 03:29:45 ----N---- C:\WINDOWS\system32\prntvpt.dll
    2009-08-14 03:29:45 ----D---- C:\7a3737d4833bcd543f028a
    2009-08-14 01:18:25 ----A---- C:\WINDOWS\ejuwon.exe
    2009-08-14 01:18:25 ----A---- C:\Program Files\Fichiers communs\ukuwo.exe
    2009-08-14 01:18:25 ----A---- C:\Documents and Settings\All Users\Application Data\amocadod.com
    2009-08-14 01:18:24 ----A---- C:\WINDOWS\ekoxiguh.com
    2009-08-14 01:18:24 ----A---- C:\WINDOWS\bigem.com
    2009-08-14 01:17:19 ----D---- C:\Program Files\PC_Antispyware2010
    2009-08-13 21:47:58 ----A---- C:\WINDOWS\ymol.exe
    2009-08-13 21:47:58 ----A---- C:\WINDOWS\ipuxuca.com
    2009-08-13 21:47:58 ----A---- C:\WINDOWS\eravimugo.dll
    2009-08-13 21:47:58 ----A---- C:\WINDOWS\dizirad.bat
    2009-08-13 21:47:58 ----A---- C:\Program Files\Fichiers communs\xypopeg.vbs
    2009-08-13 21:47:58 ----A---- C:\Documents and Settings\All Users\Application Data\vaxumezup.dll
    2009-08-13 21:47:58 ----A---- C:\Documents and Settings\All Users\Application Data\subunafyq.exe
    2009-08-13 21:39:47 ----A---- C:\UsbFix.txt
    2009-08-13 20:13:55 ----A---- C:\WINDOWS\system32\pokavyg.com
    2009-08-13 20:13:55 ----A---- C:\WINDOWS\system32\omazicih.vbs
    2009-08-13 20:13:55 ----A---- C:\WINDOWS\gucilocova.bat
    2009-08-13 20:13:55 ----A---- C:\Documents and Settings\All Users\Application Data\agodahywew.exe
    2009-08-13 18:31:46 ----A---- C:\WINDOWS\notojyt.dll
    2009-08-13 18:31:46 ----A---- C:\WINDOWS\hogapuz.com
    2009-08-13 18:31:46 ----A---- C:\WINDOWS\fofa.com
    2009-08-13 18:31:46 ----A---- C:\WINDOWS\fakuzenuti.bat
    2009-08-13 18:31:46 ----A---- C:\Program Files\Fichiers communs\ucyzu.vbs
    2009-08-13 18:31:46 ----A---- C:\Documents and Settings\All Users\Application Data\sulapuwe.vbs
    2009-08-13 14:33:19 ----D---- C:\_OTM
    2009-08-13 13:06:28 ----A---- C:\WINDOWS\braviax.exe
    2009-08-13 12:54:18 ----D---- C:\UsbFix
    2009-08-13 12:20:13 ----A---- C:\lopR.txt
    2009-08-13 12:19:39 ----D---- C:\Lop SD
    2009-08-13 11:49:38 ----A---- C:\WINDOWS\system32\minod.dll
    2009-08-13 11:49:38 ----A---- C:\WINDOWS\nypemac.bat
    2009-08-13 11:49:38 ----A---- C:\WINDOWS\kysoliba.exe
    2009-08-13 11:49:38 ----A---- C:\WINDOWS\bijiqaxed.dll
    2009-08-13 11:49:37 ----A---- C:\WINDOWS\system32\itijud.vbs
    2009-08-13 11:49:37 ----A---- C:\WINDOWS\system32\etuhuvari.exe
    2009-08-13 11:44:13 ----A---- C:\WINDOWS\system32\wisdstr.exe
    2009-08-13 11:44:11 ----A---- C:\WINDOWS\system32\braviax.exe
    2009-08-13 11:17:18 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Malwarebytes
    2009-08-13 11:17:06 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-08-13 11:17:06 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-08-13 11:01:43 ----D---- C:\Program Files\trend micro
    2009-08-13 11:01:42 ----D---- C:\rsit
    2009-08-12 23:14:14 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
    2009-08-12 23:14:08 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
    2009-08-12 23:14:03 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
    2009-08-12 23:13:57 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
    2009-08-12 23:13:51 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
    2009-08-12 23:13:45 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
    2009-08-12 23:13:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
    2009-08-12 23:13:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
    2009-08-12 23:13:02 ----A---- C:\WINDOWS\system32\MRT.INI
    2009-08-12 23:10:41 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
    2009-08-09 21:14:42 ----SHD---- C:\Config.Msi
    2009-08-06 13:08:06 ----D---- C:\Program Files\Lame for Audacity
    2009-08-06 12:55:06 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Audacity
    2009-08-05 11:47:09 ----A---- C:\WINDOWS\system32\javaws.exe
    2009-08-05 11:47:09 ----A---- C:\WINDOWS\system32\javaw.exe
    2009-08-05 11:47:09 ----A---- C:\WINDOWS\system32\java.exe
    2009-07-31 21:53:01 ----A---- C:\WINDOWS\IFinst27.exe
    2009-07-29 04:32:58 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$
    2009-07-28 15:52:19 ----D---- C:\WINDOWS\Minidump
    2009-07-28 15:19:59 ----A---- C:\WINDOWS\LD.INI
    2009-07-28 15:19:57 ----D---- C:\TERRASSE
    2009-07-28 15:14:02 ----A---- C:\WINDOWS\viewer.ini
    2009-07-28 15:14:00 ----N---- C:\WINDOWS\system32\SNWValid.dll
    2009-07-28 15:13:59 ----N---- C:\WINDOWS\system32\SierraNW.dll
    2009-07-28 15:13:31 ----D---- C:\Program Files\Sierra On-Line
    2009-07-28 15:13:23 ----A---- C:\WINDOWS\SIERRA.INI
    2009-07-28 15:13:23 ----A---- C:\WINDOWS\IsUninst.exe
    2009-07-28 14:25:10 ----D---- C:\Program Files\Realtime Landscaping Photo 5 Trial
    2009-07-27 13:47:28 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\MSNInstaller
    2009-07-24 12:51:29 ----D---- C:\Program Files\gPotato.eu
    2009-07-24 11:29:02 ----D---- C:\Program Files\BestGameEver
    2009-07-21 14:18:48 ----D---- C:\Program Files\PartyGaming
    2009-07-19 00:16:34 ----D---- C:\Program Files\Risk II
    2009-07-19 00:15:22 ----D---- C:\Program Files\ReflexiveArcade
    2009-07-16 15:38:06 ----A---- C:\WINDOWS\MythwarII Uninstall Log.txt
    2009-07-16 12:10:16 ----D---- C:\WINDOWS\MythwarII
    2009-07-16 03:03:59 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
    2009-07-16 03:03:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
    2009-07-16 03:00:54 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
    2009-07-16 01:20:15 ----A---- C:\WINDOWS\MythwarII Setup Log.txt
    2009-07-15 23:40:03 ----D---- C:\Program Files\Common Files
    2009-07-15 23:24:27 ----D---- C:\Program Files\Gpotato
    2009-07-15 11:07:47 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Desktopicon
    2009-07-15 10:30:21 ----D---- C:\Program Files\Microsoft

    ======List of files/folders modified in the last 1 months======

    2009-08-14 11:00:04 ----D---- C:\Program Files
    2009-08-14 10:59:59 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
    2009-08-14 10:55:42 ----SHD---- C:\WINDOWS\Installer
    2009-08-14 10:46:45 ----D---- C:\Program Files\Mozilla Firefox
    2009-08-14 09:21:26 ----D---- C:\WINDOWS\Microsoft.NET
    2009-08-14 09:21:03 ----RSD---- C:\WINDOWS\ASSEMBLY
    2009-08-14 09:16:05 ----D---- C:\WINDOWS\Prefetch
    2009-08-14 09:16:02 ----D---- C:\WINDOWS\Temp
    2009-08-14 09:14:28 ----D---- C:\WINDOWS
    2009-08-14 09:13:13 ----A---- C:\WINDOWS\ModemLog_Intel(R) 537EP V9x DF PCI Modem.txt
    2009-08-14 09:13:11 ----D---- C:\WINDOWS\system32\CatRoot2
    2009-08-14 03:47:12 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-08-14 03:41:43 ----D---- C:\WINDOWS\SYSTEM32
    2009-08-14 03:41:43 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
    2009-08-14 03:32:18 ----RSD---- C:\WINDOWS\Fonts
    2009-08-14 03:31:00 ----HD---- C:\WINDOWS\INF
    2009-08-14 03:30:52 ----D---- C:\WINDOWS\system32\SPOOL
    2009-08-14 03:30:40 ----RSHD---- C:\WINDOWS\system32\DLLCACHE
    2009-08-14 03:26:15 ----D---- C:\WINDOWS\WinSxS
    2009-08-14 01:18:25 ----D---- C:\Program Files\Fichiers communs
    2009-08-13 22:38:25 ----D---- C:\WINDOWS\system32\DRIVERS
    2009-08-13 21:42:23 ----SHD---- C:\RECYCLER
    2009-08-13 18:58:05 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\LimeWire
    2009-08-13 13:22:40 ----D---- C:\WINDOWS\system32\CatRoot
    2009-08-13 11:55:10 ----D---- C:\Program Files\Cheat Engine
    2009-08-13 11:19:53 ----D---- C:\WINDOWS\system32\FxsTmp
    2009-08-12 23:14:11 ----A---- C:\WINDOWS\imsins.BAK
    2009-08-12 23:13:57 ----HD---- C:\WINDOWS\$hf_mig$
    2009-08-12 23:13:41 ----D---- C:\Program Files\Outlook Express
    2009-08-09 20:52:38 ----D---- C:\Program Files\Messenger Plus! Live
    2009-08-05 11:47:03 ----D---- C:\Program Files\Java
    2009-08-05 05:00:38 ----A---- C:\WINDOWS\system32\mswebdvd.dll
    2009-07-31 17:53:31 ----D---- C:\Documents and Settings\Alex et Marc\Application Data\Apple Computer
    2009-07-31 17:53:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
    2009-07-29 20:49:14 ----A---- C:\WINDOWS\system32\MRT.exe
    2009-07-28 15:20:09 ----A---- C:\WINDOWS\WIN.INI
    2009-07-27 13:47:30 ----D---- C:\Program Files\MSN
    2009-07-26 21:41:07 ----D---- C:\Documents and Settings
    2009-07-26 12:46:54 ----HD---- C:\Program Files\InstallShield Installation Information
    2009-07-26 12:46:53 ----SD---- C:\WINDOWS\Downloaded Program Files
    2009-07-26 12:46:39 ----D---- C:\Documents and Settings\All Users\Application Data\IJJIGame
    2009-07-25 05:23:00 ----A---- C:\WINDOWS\system32\deploytk.dll
    2009-07-24 11:09:00 ----D---- C:\Program Files\BitComet
    2009-07-24 10:57:52 ----D---- C:\Downloads
    2009-07-19 00:22:12 ----D---- C:\Program Files\EA Games
    2009-07-18 12:03:49 ----A---- C:\WINDOWS\system32\shdocvw.dll
    2009-07-18 12:03:49 ----A---- C:\WINDOWS\system32\mshtml.dll
    2009-07-17 15:03:33 ----A---- C:\WINDOWS\system32\atl.dll
    2009-07-17 07:44:00 ----D---- C:\Program Files\WinRAR
    2009-07-16 20:03:36 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
    2009-07-16 20:03:22 ----A---- C:\WINDOWS\system32\pbsvc.exe
    2009-07-15 10:30:15 ----D---- C:\Program Files\Windows Live
    2009-07-15 10:23:02 ----D---- C:\Documents and Settings\All Users\Application Data\WindSolutions

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
    R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
    R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
    R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
    R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
    R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-13 28520]
    R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
    R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-06-18 281760]
    R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
    R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-11-23 40480]
    R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-06-18 25888]
    R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
    R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-12-06 25883]
    R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-12-06 34843]
    R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-12-06 4123]
    R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-12-06 2271]
    R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-12-06 86586]
    R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-12-06 15227]
    R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-12-06 6363]
    R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-12-06 98714]
    R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-12-06 100603]
    R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2003-09-22 130192]
    R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
    R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
    R3 IntelC51;IntelC51; C:\WINDOWS\system32\DRIVERS\IntelC51.sys [2004-03-05 1233525]
    R3 IntelC52;IntelC52; C:\WINDOWS\system32\DRIVERS\IntelC52.sys [2004-03-05 647929]
    R3 IntelC53;IntelC53; C:\WINDOWS\system32\DRIVERS\IntelC53.sys [2004-06-15 61157]
    R3 MODEMCSA;Périphérique de filtrage de flux Unimodem; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    R3 mohfilt;mohfilt; C:\WINDOWS\system32\DRIVERS\mohfilt.sys [2004-03-05 37048]
    R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
    R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2003-09-22 178672]
    R3 P17;Sound Blaster Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2004-06-09 840960]
    R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
    R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    S1 902fdf0d;902fdf0d; C:\WINDOWS\System32\drivers\902fdf0d.sys []
    S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
    S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
    S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-06-05 39424]
    S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-07-13 108289]
    R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-13 185089]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
    R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
    R2 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
    R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.EXE [1999-12-13 44032]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]
    R2 lxdn_device;lxdn_device; C:\WINDOWS\system32\lxdncoms.exe [2007-12-05 594600]
    R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]
    R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-23 75064]
    R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2000-06-26 53520]
    R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
    R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-06-05 541992]
    S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 268800]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
    S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
    S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
    S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2003-12-17 143360]
    S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-02-16 2736890]
    S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

    -----------------EOF-----------------
    a c 273 8 Sécurité
    14 Août 2009 19:44:48

    Les infections sont revenues...

    [#ff0000]/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\[/#f]

  • Télécharge ComboFix ([#ff0000]sUBs[/#f]) sur ton Bureau.
  • Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
  • Il va te demander d'installer la console de récupération : accepte.
  • Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

    Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
    15 Août 2009 01:36:54

    Je ne suis pas capable de lancer le logiciel je clique et rien ne se passe.
    a c 273 8 Sécurité
    15 Août 2009 01:39:07

    Renomme-le en IDN puis essaie de le lancer.
    15 Août 2009 05:59:04

    ComboFix 09-08-10.06 - Alex et Marc 2009-08-14 23:41.1.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.510.253 [GMT -4:00]
    Running from: c:\documents and settings\Alex et Marc\Bureau\IDN.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\ALEXET~1\LOCALS~1\Temp\catchme.dll
    c:\documents and settings\Alex et Marc\Application Data\wiaserva.log
    c:\documents and settings\Alex et Marc\Local Settings\Temp\catchme.dll
    c:\documents and settings\Alex et Marc\Local Settings\Temporary Internet Files\edawuneda.ban
    c:\documents and settings\Alex et Marc\Local Settings\Temporary Internet Files\igedemum.vbs
    c:\documents and settings\Alex et Marc\Local Settings\Temporary Internet Files\pexyb.inf
    c:\documents and settings\Alex et Marc\Local Settings\Temporary Internet Files\tixusu.dll
    c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
    c:\windows\braviax.exe
    c:\windows\cru629.dat
    c:\windows\Downloaded Program Files\PurpleBean.exe
    c:\windows\Installer\8a3168.msp
    c:\windows\system32\_000006_.tmp.dll
    c:\windows\system32\_scui.cpl
    c:\windows\system32\braviax.exe
    c:\windows\system32\cru629.dat
    c:\windows\system32\Data
    c:\windows\system32\drivers\win32x.sys
    c:\windows\system32\wisdstr.exe

    Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected
    Restored copy from - c:\system volume information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP206\A0111739.sys


    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_win32x
    -------\Service_win32x


    ((((((((((((((((((((((((( Files Created from 2009-07-15 to 2009-08-15 )))))))))))))))))))))))))))))))
    .

    2009-08-14 14:53 . 2009-08-14 14:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
    2009-08-14 13:19 . 2009-08-14 13:19 -------- d-----w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\PCHealth
    2009-08-14 07:33 . 2009-08-14 07:33 -------- d-----w- c:\windows\system32\XPSViewer
    2009-08-14 07:32 . 2009-08-14 07:32 -------- d-----w- c:\program files\MSBuild
    2009-08-14 07:31 . 2009-08-14 07:31 -------- d-----w- c:\program files\Reference Assemblies
    2009-08-14 07:29 . 2009-08-14 07:31 -------- d-----w- C:\7a3737d4833bcd543f028a
    2009-08-14 07:29 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-08-14 07:29 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
    2009-08-14 07:29 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-08-14 07:29 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
    2009-08-14 07:29 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-08-14 07:29 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
    2009-08-14 07:29 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-08-14 05:18 . 2009-08-14 05:18 17788 ----a-w- c:\program files\Fichiers communs\ukuwo.exe
    2009-08-14 05:18 . 2009-08-14 05:18 14426 ----a-w- c:\documents and settings\All Users\Application Data\amocadod.com
    2009-08-14 05:18 . 2009-08-14 05:18 13209 ----a-w- c:\windows\ejuwon.exe
    2009-08-14 05:18 . 2009-08-14 05:18 11247 ----a-w- c:\program files\Fichiers communs\netex.sys
    2009-08-14 05:18 . 2009-08-14 05:18 10589 ----a-w- c:\windows\system32\hisu.dat
    2009-08-14 05:18 . 2009-08-14 05:18 10161 ----a-w- c:\windows\system32\etohob.scr
    2009-08-14 05:18 . 2009-08-14 05:18 16148 ----a-w- c:\windows\ekoxiguh.com
    2009-08-14 05:18 . 2009-08-14 05:18 12968 ----a-w- c:\windows\bigem.com
    2009-08-14 05:17 . 2009-08-14 05:17 -------- d-----w- c:\program files\PC_Antispyware2010
    2009-08-14 00:13 . 2009-08-14 00:13 12460 ----a-w- c:\program files\Fichiers communs\tykor.reg
    2009-08-14 00:13 . 2009-08-14 00:13 19244 ----a-w- c:\windows\system32\pokavyg.com
    2009-08-14 00:13 . 2009-08-14 00:13 18568 ----a-w- c:\windows\gyjifeme.reg
    2009-08-14 00:13 . 2009-08-14 00:13 18404 ----a-w- c:\documents and settings\All Users\Application Data\agodahywew.exe
    2009-08-14 00:13 . 2009-08-14 00:13 14936 ----a-w- c:\windows\gucilocova.bat
    2009-08-14 00:13 . 2009-08-14 00:13 14533 ----a-w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\ogipo.bin
    2009-08-14 00:13 . 2009-08-14 00:13 12348 ----a-w- c:\program files\Fichiers communs\navoty.pif
    2009-08-14 00:13 . 2009-08-14 00:13 11837 ----a-w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\fojid.dat
    2009-08-14 00:13 . 2009-08-14 00:13 10865 ----a-w- c:\windows\system32\omazicih.vbs
    2009-08-14 00:13 . 2009-08-14 00:13 10782 ----a-w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\qonaxuq.dat
    2009-08-13 18:33 . 2009-08-13 18:33 -------- d-----w- C:\_OTM
    2009-08-13 16:54 . 2009-08-14 01:42 -------- d-----w- C:\UsbFix
    2009-08-13 16:19 . 2009-08-13 16:37 -------- d-----w- C:\Lop SD
    2009-08-13 15:49 . 2009-08-13 15:49 19443 ----a-w- c:\windows\kysoliba.exe
    2009-08-13 15:49 . 2009-08-13 15:49 19130 ----a-w- c:\windows\bijiqaxed.dll
    2009-08-13 15:49 . 2009-08-13 15:49 15325 ----a-w- c:\windows\system32\minod.dll
    2009-08-13 15:49 . 2009-08-13 15:49 13028 ----a-w- c:\documents and settings\LocalService\Application Data\cupajici.sys
    2009-08-13 15:49 . 2009-08-13 15:49 12765 ----a-w- c:\windows\nypemac.bat
    2009-08-13 15:49 . 2009-08-13 15:49 15094 ----a-w- c:\windows\system32\etuhuvari.exe
    2009-08-13 15:49 . 2009-08-13 15:49 14963 ----a-w- c:\windows\system32\ewil.scr
    2009-08-13 15:49 . 2009-08-13 15:49 12255 ----a-w- c:\windows\system32\itijud.vbs
    2009-08-13 15:41 . 2009-08-13 18:34 0 ----a-w- c:\windows\system32\drivers\902fdf0d.sys
    2009-08-13 15:17 . 2009-08-13 15:17 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Malwarebytes
    2009-08-13 15:17 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-13 15:17 . 2009-08-13 15:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-13 15:17 . 2009-08-13 15:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-13 15:17 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-13 15:01 . 2009-08-14 15:01 -------- d-----w- c:\program files\trend micro
    2009-08-13 15:01 . 2009-08-13 15:02 -------- d-----w- C:\rsit
    2009-08-12 17:21 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
    2009-08-12 16:56 . 2009-08-12 16:56 192203 ----a-w- c:\windows\system32\wisdstr.VIR
    2009-08-12 16:48 . 2009-08-12 16:48 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys
    2009-08-06 17:08 . 2009-08-06 17:08 -------- d-----w- c:\program files\Lame for Audacity
    2009-08-06 16:55 . 2009-08-06 17:08 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Audacity
    2009-08-05 15:46 . 2009-08-05 15:46 152576 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
    2009-08-01 01:53 . 2009-08-01 01:53 65536 ----a-w- c:\windows\IFinst27.exe
    2009-07-28 19:19 . 2009-07-28 19:19 -------- d-----w- C:\TERRASSE
    2009-07-28 19:14 . 1998-03-05 15:34 231936 ------w- c:\windows\system32\SNWValid.dll
    2009-07-28 19:13 . 1998-03-05 15:25 1022976 ------w- c:\windows\system32\SierraNW.dll
    2009-07-28 19:13 . 2009-07-28 19:13 -------- d-----w- c:\program files\Sierra On-Line
    2009-07-28 19:13 . 1998-01-23 16:22 304128 ----a-w- c:\windows\IsUninst.exe
    2009-07-28 18:25 . 2009-07-28 18:26 -------- d-----w- c:\program files\Realtime Landscaping Photo 5 Trial
    2009-07-27 17:47 . 2009-07-27 17:47 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\MSNInstaller
    2009-07-27 01:41 . 2009-07-27 01:41 -------- d-----w- c:\documents and settings\Propriétaire
    2009-07-24 16:51 . 2009-07-24 16:51 -------- d-----w- c:\program files\gPotato.eu
    2009-07-24 15:29 . 2009-07-24 15:29 -------- d-----w- c:\program files\BestGameEver
    2009-07-21 18:18 . 2009-07-22 14:28 -------- d-----w- c:\program files\PartyGaming
    2009-07-19 04:16 . 2009-07-21 03:16 -------- d-----w- c:\program files\Risk II
    2009-07-19 04:15 . 2009-07-19 04:15 -------- d-----w- c:\program files\ReflexiveArcade
    2009-07-17 19:03 . 2009-07-17 19:03 58880 ------w- c:\windows\system32\dllcache\atl.dll
    2009-07-16 16:10 . 2009-07-16 16:10 -------- d-----w- c:\windows\MythwarII

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-15 03:55 . 2009-08-15 03:55 192158 ----a-w- c:\windows\system32\wisdstr.exe
    2009-08-15 03:55 . 2009-08-15 03:55 11264 ----a-w- c:\windows\system32\braviax.exe
    2009-08-15 03:55 . 2004-08-05 17:00 29184 ----a-w- c:\windows\system32\drivers\beep.sys
    2009-08-15 03:20 . 2009-03-02 17:46 1 ----a-w- c:\documents and settings\Alex et Marc\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2009-08-14 16:42 . 2005-05-07 11:51 85396 ----a-w- c:\windows\system32\perfc00C.dat
    2009-08-14 16:42 . 2005-05-07 11:51 511874 ----a-w- c:\windows\system32\perfh00C.dat
    2009-08-14 14:59 . 2005-05-07 12:05 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
    2009-08-14 13:15 . 2009-02-17 23:38 46504 ----a-w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-14 00:13 . 2009-08-14 00:13 15217 ----a-w- c:\documents and settings\All Users\Application Data\xogafyjin.reg
    2009-08-14 00:13 . 2009-08-14 00:13 13218 ----a-w- c:\program files\Fichiers communs\xelogawevu._dl
    2009-08-13 22:58 . 2009-02-15 20:20 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\LimeWire
    2009-08-13 15:55 . 2009-02-15 03:46 -------- d-----w- c:\program files\Cheat Engine
    2009-08-13 15:49 . 2009-08-13 15:49 17353 ----a-w- c:\program files\Fichiers communs\niruhyfybu.inf
    2009-08-13 15:49 . 2009-08-13 15:49 17122 ----a-w- c:\documents and settings\All Users\Application Data\lujahopys.bin
    2009-08-13 15:49 . 2009-08-13 15:49 16843 ----a-w- c:\program files\Fichiers communs\xidyhi.dl
    2009-08-13 15:41 . 2004-08-05 17:00 89600 ----a-w- c:\windows\system32\userinit.exe
    2009-08-12 16:48 . 2004-08-05 17:00 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2009-08-10 00:52 . 2009-06-28 15:21 -------- d-----w- c:\program files\Messenger Plus! Live
    2009-08-05 15:47 . 2005-05-07 11:59 -------- d-----w- c:\program files\Java
    2009-08-05 09:00 . 2004-08-05 17:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-08-01 01:53 . 2009-07-16 03:24 -------- d-----w- c:\program files\Gpotato
    2009-07-31 21:53 . 2009-02-11 21:39 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Apple Computer
    2009-07-31 21:53 . 2009-02-11 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2009-07-26 16:46 . 2005-05-07 12:00 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-26 16:46 . 2009-03-28 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\IJJIGame
    2009-07-25 09:23 . 2009-02-15 20:19 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-24 15:09 . 2009-06-09 23:37 -------- d-----w- c:\program files\BitComet
    2009-07-19 04:22 . 2009-02-19 22:52 -------- d-----w- c:\program files\EA Games
    2009-07-17 19:03 . 2004-08-05 17:00 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-17 00:03 . 2009-06-23 16:29 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2009-07-17 00:03 . 2009-06-23 16:29 139152 ----a-w- c:\documents and settings\Alex et Marc\Application Data\PnkBstrK.sys
    2009-07-17 00:03 . 2009-06-23 16:29 139152 ----a-w- c:\documents and settings\Alex et Marc\Application Data\PnkBstrK.sys
    2009-07-17 00:03 . 2009-06-23 16:29 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
    2009-07-17 00:03 . 2009-06-23 16:29 794408 ----a-w- c:\windows\system32\pbsvc.exe
    2009-07-16 03:40 . 2009-07-16 03:40 -------- d-----w- c:\program files\Common Files
    2009-07-15 15:07 . 2009-07-15 15:07 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Desktopicon
    2009-07-15 14:30 . 2009-07-15 14:30 -------- d-----w- c:\program files\Microsoft
    2009-07-15 14:30 . 2009-06-28 13:41 -------- d-----w- c:\program files\Windows Live
    2009-07-15 14:23 . 2009-06-19 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\WindSolutions
    2009-07-14 03:43 . 2004-08-05 17:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-13 17:20 . 2009-07-13 17:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SweetIM
    2009-07-05 14:33 . 2009-06-20 14:07 -------- d-----w- c:\program files\USARadioNow
    2009-07-05 14:33 . 2009-06-20 14:06 -------- d-----w- c:\program files\forumswatcher.com
    2009-07-04 16:22 . 2009-07-04 16:19 -------- d-----w- c:\program files\Audible
    2009-07-03 15:26 . 2009-07-03 15:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Chat Republic Games
    2009-06-29 20:14 . 2009-06-28 17:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
    2009-06-28 13:42 . 2009-06-28 13:41 -------- dcsh--w- c:\program files\Fichiers communs\WindowsLiveInstaller
    2009-06-28 13:41 . 2009-06-28 13:41 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
    2009-06-26 16:50 . 2004-08-05 17:00 670720 ----a-w- c:\windows\system32\wininet.dll
    2009-06-26 16:50 . 2004-08-05 17:00 81920 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-25 20:36 . 2009-07-15 14:14 1291640 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
    2009-06-25 20:36 . 2009-07-15 14:14 729088 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
    2009-06-23 16:29 . 2009-02-28 23:19 -------- d-----w- c:\program files\DirectX
    2009-06-23 16:29 . 2009-06-23 16:29 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
    2009-06-23 02:41 . 2009-06-23 02:41 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Media Player Classic
    2009-06-23 02:17 . 2009-06-23 02:16 -------- d-----w- c:\program files\iTunes
    2009-06-23 02:17 . 2009-06-23 02:17 -------- d-----w- c:\program files\iPod
    2009-06-23 02:17 . 2009-02-11 21:37 -------- d-----w- c:\program files\Fichiers communs\Apple
    2009-06-23 02:14 . 2009-06-23 02:14 -------- d-----w- c:\program files\QuickTime
    2009-06-23 02:08 . 2009-06-23 02:08 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-06-20 14:49 . 2009-06-20 14:41 -------- d-----w- c:\program files\Winamp
    2009-06-20 14:09 . 2009-04-30 20:46 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\CopyTrans
    2009-06-20 14:08 . 2009-06-19 21:49 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\WindSolutions
    2009-06-20 14:06 . 2009-06-20 14:06 -------- d-----w- c:\program files\Conduit
    2009-06-20 14:04 . 2009-04-30 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\CopyTransControlCenter
    2009-06-18 22:02 . 2009-06-18 22:02 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys
    2009-06-18 22:02 . 2009-06-18 22:02 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
    2009-06-16 14:40 . 2004-08-05 17:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:40 . 2004-08-05 17:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-15 10:44 . 2004-08-05 17:00 78848 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:14 . 2004-08-05 17:00 85504 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 13:21 . 2004-08-05 17:00 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:15 . 2004-08-05 17:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-09 23:37 . 2009-06-09 23:37 1048576 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
    2009-06-06 18:06 . 2009-03-28 01:15 337197168 ----a-w- c:\documents and settings\Alex et Marc\Application Data\ijjigame\U_SFInstaller.exe
    2009-06-05 15:42 . 2009-04-04 21:56 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-06-05 15:42 . 2009-02-11 21:37 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-06-03 19:10 . 2004-08-05 17:00 1297408 ----a-w- c:\windows\system32\quartz.dll
    .

    ------- Sigcheck -------

    [7] 2004-08-05 17:00 25088 D6D65EA32B190401B57EDB6706F29669 c:\windows\$NtServicePackUninstall$\userinit.exe
    [7] 2008-04-14 02:34 26624 E74DDB12188C2FF57A78624DBF7332FC c:\windows\ServicePackFiles\i386\userinit.exe
    [-] 2009-08-13 15:41 89600 C0E8A5778DAC0152B3A02E262715F48A c:\windows\SYSTEM32\userinit.exe


    [-] 2009-08-15 03:55 29184 C4000A48F953D36167A7DF84F98A2634 c:\windows\SYSTEM32\DLLCACHE\beep.sys
    [-] 2009-08-15 03:55 29184 C4000A48F953D36167A7DF84F98A2634 c:\windows\SYSTEM32\DRIVERS\beep.sys

    [7] 2004-08-05 17:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtServicePackUninstall$\ntfs.sys
    [7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
    [-] 2009-08-12 16:48 619584 4DFB45D14330ACE7FD32EE8DBCF50C97 c:\windows\SYSTEM32\DLLCACHE\ntfs.sys
    [-] 2009-08-12 16:48 619584 4DFB45D14330ACE7FD32EE8DBCF50C97 c:\windows\SYSTEM32\DRIVERS\ntfs.sys

    c:\windows\system32\appmgmts.dll ... is missing !!
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{50d0cd27-d4ef-4a21-917e-a1573771def4}"= "c:\program files\forumswatcher.com\tbfor0.dll" [2009-07-05 2215960]
    "{669163c1-c4b9-46de-ad62-a0271d3a0a75}"= "c:\program files\USARadioNow\tbUSA0.dll" [2009-07-05 2215960]

    [HKEY_CLASSES_ROOT\clsid\{50d0cd27-d4ef-4a21-917e-a1573771def4}]

    [HKEY_CLASSES_ROOT\clsid\{669163c1-c4b9-46de-ad62-a0271d3a0a75}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{50d0cd27-d4ef-4a21-917e-a1573771def4}"= "c:\program files\forumswatcher.com\tbfor0.dll" [2009-07-05 2215960]
    "{669163c1-c4b9-46de-ad62-a0271d3a0a75}"= "c:\program files\USARadioNow\tbUSA0.dll" [2009-07-05 2215960]

    [HKEY_CLASSES_ROOT\clsid\{50d0cd27-d4ef-4a21-917e-a1573771def4}]

    [HKEY_CLASSES_ROOT\clsid\{669163c1-c4b9-46de-ad62-a0271d3a0a75}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{50D0CD27-D4EF-4A21-917E-A1573771DEF4}"= "c:\program files\forumswatcher.com\tbfor0.dll" [2009-07-05 2215960]
    "{669163C1-C4B9-46DE-AD62-A0271D3A0A75}"= "c:\program files\USARadioNow\tbUSA0.dll" [2009-07-05 2215960]

    [HKEY_CLASSES_ROOT\clsid\{50d0cd27-d4ef-4a21-917e-a1573771def4}]

    [HKEY_CLASSES_ROOT\clsid\{669163c1-c4b9-46de-ad62-a0271d3a0a75}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
    "WeatherEye"="c:\météomédia\MétéoÉclair\WeatherEye.exe" [2009-01-16 4519832]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
    "UpdateManager"="c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
    "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
    "lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
    "lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "P17Helper"="P17.dll" - c:\windows\SYSTEM32\P17.dll [2004-06-10 60928]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Post-it© Software Notes Lite.lnk - c:\program files\3M\PSNLite\PsnLite.exe [2004-10-15 2080768]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "FirewallDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\SYSTEM32\\lxdncoms.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\frun.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdnpswx.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdntime.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdnjswx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
    "c:\\WINDOWS\\SYSTEM32\\java.exe"=
    "c:\\Program Files\\BitComet\\BitComet.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdnwbgw.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\Diagnostics\\LXDNdiag.exe"=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "23366:TCP"= 23366:TCP:BitComet 23366 TCP
    "23366:UDP"= 23366:UDP:BitComet 23366 UDP

    R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-15 108289]
    R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]
    R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnserv.exe [2009-02-11 98984]
    S1 902fdf0d;902fdf0d;c:\windows\SYSTEM32\DRIVERS\902fdf0d.sys [2009-08-13 0]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
    .
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
    Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    HKCU-Run-WindowsHiderPro - c:\program files\WHidePro\whpro.exe
    HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
    HKLM-Run-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
    HKLM-Run-UnlockerAssistant - c:\documents and settings\Alex et Marc\Bureau\Nouveau dossier\Unlocker\UnlockerAssistant.exe
    HKLM-Run-PC Antispyware 2010 - c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe
    HKLM-Run-braviax - (no file)
    HKU-Default-Run-braviax - (no file)


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mDefault_Search_URL = hxxp://www.google.com/ie
    mSearch Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.app-zilla.com/search.htm
    mSearchAssistant = hxxp://www.google.com
    IE: Tout télécharger avec BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: Télécharger avec BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: Télécharger toutes les vidéos avec BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
    DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
    FF - ProfilePath - c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
    FF - component: c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
    FF - component: c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
    FF - plugin: c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiCHPlugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll

    ---- FIREFOX POLICIES ----

    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-14 23:53
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\windows\system32\wisdstr.exe 192158 bytes executable
    c:\windows\system32\braviax.exe 11264 bytes executable

    scan completed successfully
    hidden files: 2

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2328)
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Avira\AntiVir Desktop\avguard.exe
    c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\SYSTEM32\CTSVCCDA.EXE
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\SYSTEM32\lxdncoms.exe
    c:\windows\SYSTEM32\rundll32.exe
    c:\program files\Lexmark 2600 Series\lxdnmsdmon.exe
    c:\windows\SYSTEM32\PnkBstrA.exe
    c:\windows\SYSTEM32\MsPMSPSv.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\SYSTEM32\braviax.exe
    .
    **************************************************************************
    .
    Completion time: 2009-08-15 23:57 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-08-15 03:57

    Pre-Run: 116 241 760 256 octets libres
    Post-Run: 116 202 561 536 octets libres

    384 --- E O F --- 2009-08-14 16:44
    a c 273 8 Sécurité
    15 Août 2009 14:41:48

    /!\ Seul j-alex93 peut suivre cette procédure /!\

    Désactive toute protection résidente (Antivirus...) !

    ---> Copie (CTRL+C) le texte se situant dans le cadre ci-dessous :

    KillAll::

    Driver::
    902fdf0d

    File::
    c:\program files\Fichiers communs\ukuwo.exe
    c:\documents and settings\All Users\Application Data\amocadod.com
    c:\windows\ejuwon.exe
    c:\program files\Fichiers communs\netex.sys
    c:\windows\system32\hisu.dat
    c:\windows\system32\etohob.scr
    c:\windows\ekoxiguh.com
    c:\windows\bigem.com
    c:\program files\Fichiers communs\tykor.reg
    c:\windows\system32\pokavyg.com
    c:\windows\gyjifeme.reg
    c:\documents and settings\All Users\Application Data\agodahywew.exe
    c:\windows\gucilocova.bat
    c:\documents and settings\Alex et Marc\Local Settings\Application Data\ogipo.bin
    c:\program files\Fichiers communs\navoty.pif
    c:\documents and settings\Alex et Marc\Local Settings\Application Data\fojid.dat
    c:\windows\system32\omazicih.vbs
    c:\documents and settings\Alex et Marc\Local Settings\Application Data\qonaxuq.dat
    c:\windows\kysoliba.exe
    c:\windows\bijiqaxed.dll
    c:\windows\system32\minod.dll
    c:\documents and settings\LocalService\Application Data\cupajici.sys
    c:\windows\nypemac.bat
    c:\windows\system32\etuhuvari.exe
    c:\windows\system32\ewil.scr
    c:\windows\system32\itijud.vbs
    c:\windows\system32\drivers\902fdf0d.sys
    c:\windows\IFinst27.exe
    c:\windows\system32\wisdstr.exe
    c:\windows\system32\braviax.exe
    c:\documents and settings\All Users\Application Data\xogafyjin.reg
    c:\program files\Fichiers communs\xelogawevu._dl
    c:\program files\Fichiers communs\niruhyfybu.inf
    c:\documents and settings\All Users\Application Data\lujahopys.bin
    c:\program files\Fichiers communs\xidyhi.dl

    Folder::
    c:\program files\PC_Antispyware2010

    ---> Ouvre le Bloc-notes : Démarrer > Tous les programmes > Accessoires > Bloc-notes.

    - Colle (CTRL+V) le texte dans le Bloc-notes.
    - Enregistre ce fichier dans : Bureau
    - Nom du fichier : CFScript
    - Type du fichier : tous les fichiers !!
    - Clique sur Enregistrer.
    - Quitte le Bloc-notes.

    ---> Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :



  • Cela va relancer Combofix : au message qui apparaît, accepte.
  • Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
  • Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher, copie/colle son contenu sur le forum.
  • Si le fichier ne s'ouvre pas, il se trouve ici : C:\ComboFix.txt

    ;) 
    15 Août 2009 17:29:24

    ComboFix 09-08-10.06 - Alex et Marc 2009-08-15 11:13.2.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.510.241 [GMT -4:00]
    Running from: c:\documents and settings\Alex et Marc\Bureau\IDN.exe
    Command switches used :: c:\documents and settings\Alex et Marc\Bureau\CFScript.txt
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    "c:\documents and settings\Alex et Marc\Local Settings\Application Data\fojid.dat"
    "c:\documents and settings\Alex et Marc\Local Settings\Application Data\ogipo.bin"
    "c:\documents and settings\Alex et Marc\Local Settings\Application Data\qonaxuq.dat"
    "c:\documents and settings\All Users\Application Data\agodahywew.exe"
    "c:\documents and settings\All Users\Application Data\amocadod.com"
    "c:\documents and settings\All Users\Application Data\lujahopys.bin"
    "c:\documents and settings\All Users\Application Data\xogafyjin.reg"
    "c:\documents and settings\LocalService\Application Data\cupajici.sys"
    "c:\program files\Fichiers communs\navoty.pif"
    "c:\program files\Fichiers communs\netex.sys"
    "c:\program files\Fichiers communs\niruhyfybu.inf"
    "c:\program files\Fichiers communs\tykor.reg"
    "c:\program files\Fichiers communs\ukuwo.exe"
    "c:\program files\Fichiers communs\xelogawevu._dl"
    "c:\program files\Fichiers communs\xidyhi.dl"
    "c:\windows\bigem.com"
    "c:\windows\bijiqaxed.dll"
    "c:\windows\ejuwon.exe"
    "c:\windows\ekoxiguh.com"
    "c:\windows\gucilocova.bat"
    "c:\windows\gyjifeme.reg"
    "c:\windows\IFinst27.exe"
    "c:\windows\kysoliba.exe"
    "c:\windows\nypemac.bat"
    "c:\windows\system32\braviax.exe"
    "c:\windows\system32\drivers\902fdf0d.sys"
    "c:\windows\system32\etohob.scr"
    "c:\windows\system32\etuhuvari.exe"
    "c:\windows\system32\ewil.scr"
    "c:\windows\system32\hisu.dat"
    "c:\windows\system32\itijud.vbs"
    "c:\windows\system32\minod.dll"
    "c:\windows\system32\omazicih.vbs"
    "c:\windows\system32\pokavyg.com"
    "c:\windows\system32\wisdstr.exe"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Alex et Marc\Local Settings\Application Data\fojid.dat
    c:\documents and settings\Alex et Marc\Local Settings\Application Data\ogipo.bin
    c:\documents and settings\Alex et Marc\Local Settings\Application Data\qonaxuq.dat
    c:\documents and settings\All Users\Application Data\agodahywew.exe
    c:\documents and settings\All Users\Application Data\amocadod.com
    c:\documents and settings\All Users\Application Data\lujahopys.bin
    c:\documents and settings\All Users\Application Data\xogafyjin.reg
    c:\documents and settings\LocalService\Application Data\cupajici.sys
    c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\mypap.scr
    c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\qehani.vbs
    c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\upubuwybaj.bin
    c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\uvehuzyz.dl
    c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
    c:\program files\Fichiers communs\navoty.pif
    c:\program files\Fichiers communs\netex.sys
    c:\program files\Fichiers communs\niruhyfybu.inf
    c:\program files\Fichiers communs\tykor.reg
    c:\program files\Fichiers communs\ukuwo.exe
    c:\program files\Fichiers communs\xelogawevu._dl
    c:\program files\Fichiers communs\xidyhi.dl
    c:\program files\PC_Antispyware2010
    c:\program files\PC_Antispyware2010\AVEngn.dll
    c:\program files\PC_Antispyware2010\data\daily.cvd
    c:\program files\PC_Antispyware2010\htmlayout.dll
    c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
    c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcm80.dll
    c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcp80.dll
    c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcr80.dll
    c:\program files\PC_Antispyware2010\PC_Antispyware2010.cfg
    c:\program files\PC_Antispyware2010\pthreadVC2.dll
    c:\program files\PC_Antispyware2010\Uninstall.exe
    c:\program files\PC_Antispyware2010\wscui.cpl
    c:\windows\bigem.com
    c:\windows\bijiqaxed.dll
    c:\windows\braviax.exe
    c:\windows\cru629.dat
    c:\windows\ejuwon.exe
    c:\windows\ekoxiguh.com
    c:\windows\gucilocova.bat
    c:\windows\gyjifeme.reg
    c:\windows\IFinst27.exe
    c:\windows\kysoliba.exe
    c:\windows\nypemac.bat
    c:\windows\system32\_scui.cpl
    c:\windows\system32\braviax.exe
    c:\windows\system32\cru629.dat
    c:\windows\system32\dllcache\figaro.sys
    c:\windows\system32\drivers\902fdf0d.sys
    c:\windows\system32\etohob.scr
    c:\windows\system32\etuhuvari.exe
    c:\windows\system32\ewil.scr
    c:\windows\system32\hisu.dat
    c:\windows\system32\itijud.vbs
    c:\windows\system32\minod.dll
    c:\windows\system32\omazicih.vbs
    c:\windows\system32\pokavyg.com
    c:\windows\system32\wisdstr.exe

    Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected
    Restored copy from - c:\system volume information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP207\A0113933.sys


    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_902fdf0d


    ((((((((((((((((((((((((( Files Created from 2009-07-15 to 2009-08-15 )))))))))))))))))))))))))))))))
    .

    2009-08-15 04:00 . 2009-08-15 04:00 17013 ----a-w- c:\windows\system32\ylytu.scr
    2009-08-15 04:00 . 2009-08-15 04:00 13248 ----a-w- c:\windows\uzizen.vbs
    2009-08-15 04:00 . 2009-08-15 04:00 12385 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\ujusiwigi.dat
    2009-08-15 04:00 . 2009-08-15 04:00 11043 ----a-w- c:\windows\system32\edyki.pif
    2009-08-15 04:00 . 2009-08-15 04:00 19337 ----a-w- c:\program files\Fichiers communs\anup.sys
    2009-08-15 04:00 . 2009-08-15 04:00 10241 ----a-w- c:\windows\isejono.dll
    2009-08-14 14:53 . 2009-08-14 14:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
    2009-08-14 13:19 . 2009-08-14 13:19 -------- d-----w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\PCHealth
    2009-08-14 07:33 . 2009-08-14 07:33 -------- d-----w- c:\windows\system32\XPSViewer
    2009-08-14 07:32 . 2009-08-14 07:32 -------- d-----w- c:\program files\MSBuild
    2009-08-14 07:31 . 2009-08-14 07:31 -------- d-----w- c:\program files\Reference Assemblies
    2009-08-14 07:29 . 2009-08-14 07:31 -------- d-----w- C:\7a3737d4833bcd543f028a
    2009-08-14 07:29 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-08-14 07:29 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
    2009-08-14 07:29 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-08-14 07:29 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
    2009-08-14 07:29 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-08-14 07:29 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
    2009-08-14 07:29 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-08-13 22:31 . 2009-08-13 22:31 19909 ----a-w- c:\program files\Fichiers communs\mypyzygeko.sys
    2009-08-13 18:33 . 2009-08-13 18:33 -------- d-----w- C:\_OTM
    2009-08-13 16:54 . 2009-08-14 01:42 -------- d-----w- C:\UsbFix
    2009-08-13 16:19 . 2009-08-13 16:37 -------- d-----w- C:\Lop SD
    2009-08-13 15:17 . 2009-08-13 15:17 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Malwarebytes
    2009-08-13 15:17 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-13 15:17 . 2009-08-13 15:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-13 15:17 . 2009-08-13 15:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-13 15:17 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-13 15:01 . 2009-08-14 15:01 -------- d-----w- c:\program files\trend micro
    2009-08-13 15:01 . 2009-08-13 15:02 -------- d-----w- C:\rsit
    2009-08-12 17:21 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
    2009-08-12 16:56 . 2009-08-12 16:56 192203 ----a-w- c:\windows\system32\wisdstr.VIR
    2009-08-12 16:48 . 2009-08-12 16:48 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys
    2009-08-06 17:08 . 2009-08-06 17:08 -------- d-----w- c:\program files\Lame for Audacity
    2009-08-06 16:55 . 2009-08-06 17:08 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Audacity
    2009-08-05 15:46 . 2009-08-05 15:46 152576 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
    2009-07-28 19:19 . 2009-07-28 19:19 -------- d-----w- C:\TERRASSE
    2009-07-28 19:14 . 1998-03-05 15:34 231936 ------w- c:\windows\system32\SNWValid.dll
    2009-07-28 19:13 . 1998-03-05 15:25 1022976 ------w- c:\windows\system32\SierraNW.dll
    2009-07-28 19:13 . 2009-07-28 19:13 -------- d-----w- c:\program files\Sierra On-Line
    2009-07-28 19:13 . 1998-01-23 16:22 304128 ----a-w- c:\windows\IsUninst.exe
    2009-07-28 18:25 . 2009-07-28 18:26 -------- d-----w- c:\program files\Realtime Landscaping Photo 5 Trial
    2009-07-27 17:47 . 2009-07-27 17:47 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\MSNInstaller
    2009-07-27 01:41 . 2009-07-27 01:41 -------- d-----w- c:\documents and settings\Propriétaire
    2009-07-24 16:51 . 2009-07-24 16:51 -------- d-----w- c:\program files\gPotato.eu
    2009-07-24 15:29 . 2009-07-24 15:29 -------- d-----w- c:\program files\BestGameEver
    2009-07-21 18:18 . 2009-07-22 14:28 -------- d-----w- c:\program files\PartyGaming
    2009-07-19 04:16 . 2009-07-21 03:16 -------- d-----w- c:\program files\Risk II
    2009-07-19 04:15 . 2009-07-19 04:15 -------- d-----w- c:\program files\ReflexiveArcade
    2009-07-17 19:03 . 2009-07-17 19:03 58880 ------w- c:\windows\system32\dllcache\atl.dll
    2009-07-16 16:10 . 2009-07-16 16:10 -------- d-----w- c:\windows\MythwarII

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-15 15:26 . 2009-08-15 15:26 192158 ----a-w- c:\windows\system32\wisdstr.exe
    2009-08-15 15:26 . 2009-08-15 15:26 11264 ----a-w- c:\windows\system32\braviax.exe
    2009-08-15 15:26 . 2004-08-05 17:00 29184 ----a-w- c:\windows\system32\drivers\beep.sys
    2009-08-15 04:00 . 2009-08-15 04:00 12944 ----a-w- c:\program files\Fichiers communs\dabityjag.ban
    2009-08-15 04:00 . 2009-08-15 04:00 11567 ----a-w- c:\documents and settings\LocalService\Application Data\lifalahen.bin
    2009-08-15 04:00 . 2009-08-15 04:00 15027 ----a-w- c:\program files\Fichiers communs\ymyjipis.ban
    2009-08-15 03:57 . 2005-05-07 11:51 85396 ----a-w- c:\windows\system32\perfc00C.dat
    2009-08-15 03:57 . 2005-05-07 11:51 511874 ----a-w- c:\windows\system32\perfh00C.dat
    2009-08-15 03:20 . 2009-03-02 17:46 1 ----a-w- c:\documents and settings\Alex et Marc\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2009-08-14 14:59 . 2005-05-07 12:05 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
    2009-08-14 13:15 . 2009-02-17 23:38 46504 ----a-w- c:\documents and settings\Alex et Marc\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-13 22:58 . 2009-02-15 20:20 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\LimeWire
    2009-08-13 15:55 . 2009-02-15 03:46 -------- d-----w- c:\program files\Cheat Engine
    2009-08-13 15:41 . 2004-08-05 17:00 89600 ----a-w- c:\windows\system32\userinit.exe
    2009-08-12 16:48 . 2004-08-05 17:00 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2009-08-10 00:52 . 2009-06-28 15:21 -------- d-----w- c:\program files\Messenger Plus! Live
    2009-08-05 15:47 . 2005-05-07 11:59 -------- d-----w- c:\program files\Java
    2009-08-05 09:00 . 2004-08-05 17:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-08-01 01:53 . 2009-07-16 03:24 -------- d-----w- c:\program files\Gpotato
    2009-07-31 21:53 . 2009-02-11 21:39 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Apple Computer
    2009-07-31 21:53 . 2009-02-11 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2009-07-26 16:46 . 2005-05-07 12:00 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-26 16:46 . 2009-03-28 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\IJJIGame
    2009-07-25 09:23 . 2009-02-15 20:19 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-24 15:09 . 2009-06-09 23:37 -------- d-----w- c:\program files\BitComet
    2009-07-19 04:22 . 2009-02-19 22:52 -------- d-----w- c:\program files\EA Games
    2009-07-17 19:03 . 2004-08-05 17:00 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-17 00:03 . 2009-06-23 16:29 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2009-07-17 00:03 . 2009-06-23 16:29 139152 ----a-w- c:\documents and settings\Alex et Marc\Application Data\PnkBstrK.sys
    2009-07-17 00:03 . 2009-06-23 16:29 139152 ----a-w- c:\documents and settings\Alex et Marc\Application Data\PnkBstrK.sys
    2009-07-17 00:03 . 2009-06-23 16:29 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
    2009-07-17 00:03 . 2009-06-23 16:29 794408 ----a-w- c:\windows\system32\pbsvc.exe
    2009-07-16 03:40 . 2009-07-16 03:40 -------- d-----w- c:\program files\Common Files
    2009-07-15 15:07 . 2009-07-15 15:07 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Desktopicon
    2009-07-15 14:30 . 2009-07-15 14:30 -------- d-----w- c:\program files\Microsoft
    2009-07-15 14:30 . 2009-06-28 13:41 -------- d-----w- c:\program files\Windows Live
    2009-07-15 14:23 . 2009-06-19 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\WindSolutions
    2009-07-14 03:43 . 2004-08-05 17:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-13 17:20 . 2009-07-13 17:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SweetIM
    2009-07-05 14:33 . 2009-06-20 14:07 -------- d-----w- c:\program files\USARadioNow
    2009-07-05 14:33 . 2009-06-20 14:06 -------- d-----w- c:\program files\forumswatcher.com
    2009-07-04 16:22 . 2009-07-04 16:19 -------- d-----w- c:\program files\Audible
    2009-07-03 15:26 . 2009-07-03 15:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Chat Republic Games
    2009-06-29 20:14 . 2009-06-28 17:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
    2009-06-28 13:42 . 2009-06-28 13:41 -------- dcsh--w- c:\program files\Fichiers communs\WindowsLiveInstaller
    2009-06-28 13:41 . 2009-06-28 13:41 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
    2009-06-26 16:50 . 2004-08-05 17:00 670720 ----a-w- c:\windows\system32\wininet.dll
    2009-06-26 16:50 . 2004-08-05 17:00 81920 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-25 20:36 . 2009-07-15 14:14 1291640 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
    2009-06-25 20:36 . 2009-07-15 14:14 729088 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
    2009-06-23 16:29 . 2009-02-28 23:19 -------- d-----w- c:\program files\DirectX
    2009-06-23 16:29 . 2009-06-23 16:29 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
    2009-06-23 02:41 . 2009-06-23 02:41 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\Media Player Classic
    2009-06-23 02:17 . 2009-06-23 02:16 -------- d-----w- c:\program files\iTunes
    2009-06-23 02:17 . 2009-06-23 02:17 -------- d-----w- c:\program files\iPod
    2009-06-23 02:17 . 2009-02-11 21:37 -------- d-----w- c:\program files\Fichiers communs\Apple
    2009-06-23 02:14 . 2009-06-23 02:14 -------- d-----w- c:\program files\QuickTime
    2009-06-23 02:08 . 2009-06-23 02:08 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
    2009-06-20 14:49 . 2009-06-20 14:41 -------- d-----w- c:\program files\Winamp
    2009-06-20 14:09 . 2009-04-30 20:46 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\CopyTrans
    2009-06-20 14:08 . 2009-06-19 21:49 -------- d-----w- c:\documents and settings\Alex et Marc\Application Data\WindSolutions
    2009-06-20 14:06 . 2009-06-20 14:06 -------- d-----w- c:\program files\Conduit
    2009-06-20 14:04 . 2009-04-30 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\CopyTransControlCenter
    2009-06-18 22:02 . 2009-06-18 22:02 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys
    2009-06-18 22:02 . 2009-06-18 22:02 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
    2009-06-16 14:40 . 2004-08-05 17:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:40 . 2004-08-05 17:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-15 10:44 . 2004-08-05 17:00 78848 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:14 . 2004-08-05 17:00 85504 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 13:21 . 2004-08-05 17:00 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:15 . 2004-08-05 17:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-09 23:37 . 2009-06-09 23:37 1048576 ----a-w- c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
    2009-06-06 18:06 . 2009-03-28 01:15 337197168 ----a-w- c:\documents and settings\Alex et Marc\Application Data\ijjigame\U_SFInstaller.exe
    2009-06-05 15:42 . 2009-04-04 21:56 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-06-05 15:42 . 2009-02-11 21:37 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-06-03 19:10 . 2004-08-05 17:00 1297408 ----a-w- c:\windows\system32\quartz.dll
    .

    ------- Sigcheck -------

    [7] 2004-08-05 17:00 25088 D6D65EA32B190401B57EDB6706F29669 c:\windows\$NtServicePackUninstall$\userinit.exe
    [7] 2008-04-14 02:34 26624 E74DDB12188C2FF57A78624DBF7332FC c:\windows\ServicePackFiles\i386\userinit.exe
    [-] 2009-08-13 15:41 89600 C0E8A5778DAC0152B3A02E262715F48A c:\windows\SYSTEM32\userinit.exe


    [-] 2009-08-15 15:26 29184 C4000A48F953D36167A7DF84F98A2634 c:\windows\SYSTEM32\DLLCACHE\beep.sys
    [-] 2009-08-15 15:26 29184 C4000A48F953D36167A7DF84F98A2634 c:\windows\SYSTEM32\DRIVERS\beep.sys

    [7] 2004-08-05 17:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtServicePackUninstall$\ntfs.sys
    [7] 2008-04-13 19:15 574976 78A08DD6A8D65E697C18E1DB01C5CDCA c:\windows\ServicePackFiles\i386\ntfs.sys
    [-] 2009-08-12 16:48 619584 4DFB45D14330ACE7FD32EE8DBCF50C97 c:\windows\SYSTEM32\DLLCACHE\ntfs.sys
    [-] 2009-08-12 16:48 619584 4DFB45D14330ACE7FD32EE8DBCF50C97 c:\windows\SYSTEM32\DRIVERS\ntfs.sys

    c:\windows\system32\appmgmts.dll ... is missing !!
    .
    ((((((((((((((((((((((((((((( SnapShot@2009-08-15_03.53.42 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-08-15 15:23 . 2009-08-15 15:23 16384 c:\windows\temp\Perflib_Perfdata_514.dat
    + 2005-05-07 11:51 . 2009-08-15 03:57 63952 c:\windows\SYSTEM32\PERFC009.DAT
    - 2005-05-07 11:51 . 2009-08-14 16:42 63952 c:\windows\SYSTEM32\PERFC009.DAT
    - 2009-08-15 03:51 . 2009-08-15 03:51 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
    + 2009-08-15 15:21 . 2009-08-15 15:21 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
    + 2009-08-15 15:21 . 2009-08-15 15:21 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
    - 2009-08-15 03:51 . 2009-08-15 03:51 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
    + 2005-05-07 11:51 . 2009-08-15 03:57 407170 c:\windows\SYSTEM32\PERFH009.DAT
    - 2005-05-07 11:51 . 2009-08-14 16:42 407170 c:\windows\SYSTEM32\PERFH009.DAT
    + 2009-08-15 15:21 . 2009-08-15 15:21 184320 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
    - 2009-08-15 03:51 . 2009-08-15 03:51 184320 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
    + 2009-08-15 15:21 . 2009-08-15 15:21 237568 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
    - 2009-08-15 03:51 . 2009-08-15 03:51 237568 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
    - 2009-08-15 03:51 . 2009-08-15 03:51 237568 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
    + 2009-08-15 15:21 . 2009-08-15 15:21 237568 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
    - 2009-08-15 03:51 . 2009-08-15 03:51 4489216 c:\windows\ERDNT\subs\Users\00000005\NTUSER.DAT
    + 2009-08-15 15:21 . 2009-08-15 15:21 4489216 c:\windows\ERDNT\subs\Users\00000005\NTUSER.DAT
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{50d0cd27-d4ef-4a21-917e-a1573771def4}"= "c:\program files\forumswatcher.com\tbfor0.dll" [2009-07-05 2215960]
    "{669163c1-c4b9-46de-ad62-a0271d3a0a75}"= "c:\program files\USARadioNow\tbUSA0.dll" [2009-07-05 2215960]

    [HKEY_CLASSES_ROOT\clsid\{50d0cd27-d4ef-4a21-917e-a1573771def4}]

    [HKEY_CLASSES_ROOT\clsid\{669163c1-c4b9-46de-ad62-a0271d3a0a75}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{50d0cd27-d4ef-4a21-917e-a1573771def4}"= "c:\program files\forumswatcher.com\tbfor0.dll" [2009-07-05 2215960]
    "{669163c1-c4b9-46de-ad62-a0271d3a0a75}"= "c:\program files\USARadioNow\tbUSA0.dll" [2009-07-05 2215960]

    [HKEY_CLASSES_ROOT\clsid\{50d0cd27-d4ef-4a21-917e-a1573771def4}]

    [HKEY_CLASSES_ROOT\clsid\{669163c1-c4b9-46de-ad62-a0271d3a0a75}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{50D0CD27-D4EF-4A21-917E-A1573771DEF4}"= "c:\program files\forumswatcher.com\tbfor0.dll" [2009-07-05 2215960]
    "{669163C1-C4B9-46DE-AD62-A0271D3A0A75}"= "c:\program files\USARadioNow\tbUSA0.dll" [2009-07-05 2215960]

    [HKEY_CLASSES_ROOT\clsid\{50d0cd27-d4ef-4a21-917e-a1573771def4}]

    [HKEY_CLASSES_ROOT\clsid\{669163c1-c4b9-46de-ad62-a0271d3a0a75}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
    "WeatherEye"="c:\météomédia\MétéoÉclair\WeatherEye.exe" [2009-01-16 4519832]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
    "UpdateManager"="c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
    "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
    "lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
    "lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "PC Antispyware 2010"="c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe" [BU]
    "P17Helper"="P17.dll" - c:\windows\SYSTEM32\P17.dll [2004-06-10 60928]
    "braviax"="" [BU]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    "braviax"="" [BU]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Post-it© Software Notes Lite.lnk - c:\program files\3M\PSNLite\PsnLite.exe [2004-10-15 2080768]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "FirewallDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\SYSTEM32\\lxdncoms.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\frun.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdnpswx.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdntime.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdnjswx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
    "c:\\WINDOWS\\SYSTEM32\\java.exe"=
    "c:\\Program Files\\BitComet\\BitComet.exe"=
    "c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxdnwbgw.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=
    "c:\\Program Files\\Lexmark 2600 Series\\Diagnostics\\LXDNdiag.exe"=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "23366:TCP"= 23366:TCP:BitComet 23366 TCP
    "23366:UDP"= 23366:UDP:BitComet 23366 UDP

    R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-15 108289]
    R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]
    R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxdnserv.exe [2009-02-11 98984]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mDefault_Search_URL = hxxp://www.google.com/ie
    mSearch Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.app-zilla.com/search.htm
    mSearchAssistant = hxxp://www.google.com
    IE: Tout télécharger avec BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: Télécharger avec BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: Télécharger toutes les vidéos avec BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
    DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
    FF - ProfilePath - c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
    FF - component: c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
    FF - component: c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
    FF - plugin: c:\documents and settings\Alex et Marc\Application Data\Mozilla\Firefox\Profiles\e8vmint8.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiCHPlugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll

    ---- FIREFOX POLICIES ----

    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-15 11:24
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\docume~1\ALEXET~1\LOCALS~1\Temp\~DF6A3E.tmp 512 bytes
    c:\windows\system32\wisdstr.exe 192158 bytes executable
    c:\windows\system32\braviax.exe 11264 bytes executable

    scan completed successfully
    hidden files: 3

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3300)
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\program files\Audible\Bin\AudibleExt.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Avira\AntiVir Desktop\avguard.exe
    c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\SYSTEM32\CTSVCCDA.EXE
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\SYSTEM32\lxdncoms.exe
    c:\windows\SYSTEM32\rundll32.exe
    c:\program files\Lexmark 2600 Series\lxdnmsdmon.exe
    c:\windows\SYSTEM32\PnkBstrA.exe
    c:\windows\SYSTEM32\MsPMSPSv.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\SYSTEM32\wscntfy.exe
    c:\windows\SYSTEM32\braviax.exe
    .
    **************************************************************************
    .
    Completion time: 2009-08-15 11:28 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-08-15 15:28
    ComboFix2.txt 2009-08-15 03:57

    Pre-Run: 116 294 885 376 octets libres
    Post-Run: 116 258 488 320 octets libres

    449 --- E O F --- 2009-08-14 16:44
    a c 273 8 Sécurité
    15 Août 2009 21:26:37

    Vraiment collante cette infection.

  • Télécharge Dr.Web CureIt! sur ton Bureau.
  • Double-clique sur drweb-cureit.exe et clique sur Commencer le scan.
  • Ce scan rapide permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, clique sur le bouton Oui pour Tout à l'invite.
  • Lorsque le scan rapide est terminé, clique sur Options > Changer la configuration.
  • Choisis l'onglet Scanner, et décoche Analyse heuristique.
  • De retour à la fenêtre principale : choisis Analyse complète.
  • Clique la flèche verte sur la droite et le scan débutera. Une publicité apparaît quelquefois, ferme-la.
  • Clique Oui pour Tout si un fichier est détecté.
  • A la fin du scan, si des infections sont trouvées, clique sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, clique sur Quarantaine.
  • Au menu principal de l'outil, en haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport.
  • Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv.
  • Ferme Dr.Web CureIt!
  • Redémarre ton ordinateur (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.
  • Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.

    NB : Dr.Web en version gratuite est un scanner à la demande et n'entre pas en conflit avec ton antivirus résident. Tu pourras finalement supprimer Dr.Web à la fin des manipulations.
    16 Août 2009 03:10:45

    Quand je lance Dr. Web je clique sur commencer le scan et Dr.Web ouvre et un message s'affiche '' la base viral ou le chemin vers la basse viral est invalide et Dr.Web ferme et l'écran devien bleu et il y a plein de texte a l'écran.
    a c 273 8 Sécurité
    16 Août 2009 03:17:16

    C'est la première fois que je vois ce message.

  • Télécharge le scanner portable AVPTool sur ton Bureau.
  • Lance l'exécutable intitulé setup_7.0xxxxx en double-cliquant dessus.
  • Réponds Oui à la question Do you want to continue installation ?.
  • Clique sur Next pour les deux fenêtres suivantes : AVPTool s'installe sur ton Bureau dans un dossier nommé Kaspersky Lab Tool.
  • L'outil se lance tout seul : coche toutes les cases dans l'onglet Automatic Scan.
  • Clique maintenant sur Scan. Le scan commence, une nouvelle fenêtre s'ouvre indiquant la progression du balayage en pourcentage.
  • A la fin du scan, AVPTool signale les objets infectés par l'intermédiaire d'un pop-up : coche alors Apply to all et clique sur Disinfect ou sur Delete selon ce que propose la fenêtre.
  • Une fois les infections traitées par l'intermédiaire des pop-ups, il se peut que des fichiers malsains n'aient pas été supprimés : ils apparaissent en rouge dans la liste : clique alors sur le bouton Neutralize all de la fenêtre de progression du scan : si un pop-up indique qu'il faut redémarrer, accepte en cliquant sur OK.
  • Rends-toi maintenant dans l'onglet Events de la fenêtre de progression du scan et décoche Show all events.
  • Clique enfin sur Reports puis Save to file et enregistre le rapport sur ton Bureau sous le nom Rapport AVPTool.
  • Ferme les fenêtres d'AVPTool : un message apparaît proposant de désinstaller le logiciel : choisis Yes.
  • Un message d'alerte indique que le PC doit être redémarré pour finir la désinstallation. À la question Would you like to restart now, réponds Oui et laisse ton ordinateur redémarrer en Mode normal.
  • Poste le rapport dans ta prochaine réponse.
    16 Août 2009 03:44:57

    est-ce qu'il serais mieux de formater mon PC ?
    a c 273 8 Sécurité
    16 Août 2009 03:47:51

    Si tu sais comment faire, oui car cette nouvelle infection est vraiment embêtante.
    16 Août 2009 03:49:30

    Oui avec mon PC Dell a l'ouverture je fais Ctrl+F11 et tous ce fais automatiquement.
    a c 273 8 Sécurité
    18 Août 2009 05:45:41

    En fait, il aurait fallu que tu installes la console de récupération comme je te l'avais demandé lors de la procédure de ComboFix. On m'a donné cette "astuce" ce soir pour dégommer cette infection Braviax.

    Tu as formaté, c'est plus propre ;) 

    Comme antivirus gratuit, je te conseille AntiVir.

    Pour supprimer les popups d'AntiVir : Lien

    Un autre logiciel à posséder : Malwarebytes' Anti-Malware (MBAM)
    18 Août 2009 06:10:52

    D'accord Merci beaucoup de ton aide :D 
    a c 273 8 Sécurité
    18 Août 2009 15:08:08

    --> Si tu estimes que ton problème est résolu, ajoute [Résolu] au titre. Pour cela :
  • Clique, dans ton premier message, sur le bouton Editer .
  • Ajoute la mention [Résolu] devant le titre.
  • Clique ensuite sur Valider votre message.


    Sois plus vigilant(e) sur Internet ;) 
    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS