sde

Le micro va mieux IE raméne plus de pub. [ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ] -->- Recherche: C:\Combofix.txt: trouvé ! C:\Qoobox: trouvé ! C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé ! C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé ! C:\Documents and Settings\Cathy PISANI\Bureau\HijackThis.lnk: trouvé ! C:\Documents and Settings\Cathy PISANI\Mes documents\Install\HJTInstall.exe: trouvé ! C:\Documents and Settings\Cathy PISANI\Recent\HijackThis.lnk: trouvé ! C:\Program Files\Trend Micro\HijackThis: trouvé ! C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé ! C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé ! --------------------------------- -->- Suppression: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé ! C:\Documents and Settings\Cathy PISANI\Bureau\HijackThis.lnk: supprimé ! C:\Documents and Settings\Cathy PISANI\Mes documents\Install\HJTInstall.exe: supprimé ! C:\Documents and Settings\Cathy PISANI\Recent\HijackThis.lnk: supprimé ! C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé ! C:\Combofix.txt: supprimé ! C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé ! C:\Qoobox: supprimé ! C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé ! C:\Program Files\Trend Micro\HijackThis: supprimé !

Voila Avira AntiVir Personal Report file date: 2009-02-09 20:11 Scanning for 1327406 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Save mode Username: Administrateur Computer name: CATHY Version information: BUILD.DAT : 8.2.0.337 16934 Bytes 2008-11-18 13:05:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 2008-11-18 08:21:26 AVSCAN.DLL : 8.1.4.0 40705 Bytes 2008-05-26 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 2008-06-12 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 2008-05-26 07:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 11:30:36 ANTIVIR1.VDF : 7.1.1.113 2817536 Bytes 2009-01-14 18:03:34 ANTIVIR2.VDF : 7.1.1.240 1659904 Bytes 2009-02-07 18:03:48 ANTIVIR3.VDF : 7.1.1.248 54272 Bytes 2009-02-09 18:03:49 Engineversion : 8.2.0.76 AEVDF.DLL : 8.1.1.0 106868 Bytes 2009-02-09 18:04:06 AESCRIPT.DLL : 8.1.1.43 344442 Bytes 2009-02-09 18:04:04 AESCN.DLL : 8.1.1.6 127348 Bytes 2009-02-09 18:04:03 AERDL.DLL : 8.1.1.3 438645 Bytes 2008-11-04 13:58:38 AEPACK.DLL : 8.1.3.8 397684 Bytes 2009-02-09 18:04:02 AEOFFICE.DLL : 8.1.0.33 196987 Bytes 2009-02-09 18:04:00 AEHEUR.DLL : 8.1.0.90 1573237 Bytes 2009-02-09 18:03:59 AEHELP.DLL : 8.1.2.0 119159 Bytes 2009-02-09 18:03:53 AEGEN.DLL : 8.1.1.14 332148 Bytes 2009-02-09 18:03:52 AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-14 10:05:56 AECORE.DLL : 8.1.6.4 176501 Bytes 2009-02-09 18:03:50 AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-14 10:05:56 AVWINLL.DLL : 1.0.0.12 15105 Bytes 2008-07-09 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 2008-05-16 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 2008-07-31 12:02:15 AVREG.DLL : 8.0.0.1 33537 Bytes 2008-05-09 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 2008-06-12 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-22 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 2008-06-12 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 2008-06-12 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 2008-06-27 13:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: repair Secondary action.................: delete Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, E:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: 2009-02-09 20:11 Starting search for hidden objects. The driver could not be initialized. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'AAWTray.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'AAWService.exe' - '1' Module(s) have been scanned Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 16 processes with 16 modules were scanned Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [iNFO] No virus was found! Boot sector 'D:\' [iNFO] No virus was found! Boot sector 'E:\' [iNFO] No virus was found! Starting to scan the registry. The registry was scanned ( '73' files ). Starting the file scan: Begin scan in 'C:\' <BOOT> C:\pagefile.sys [WARNING] The file could not be opened! C:\Qoobox\Quarantine\C\Documents and Settings\Cathy\Local Settings\Application Data\qyoykow.exe.vir [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan [NOTE] A backup was created as '49ff93a7.qua' ( QUARANTINE ) [NOTE] The file was deleted! Begin scan in 'D:\' <BACKUP> D:\Tools\eTrust Antivirus\eTrustAntivirus7.1_90trial_FR_medion.exe [0] Archive type: CAB SFX (self extracting) --> \eTrustAntivirusOEM\Bin\eAV_S.Win\webpkg.exe [1] Archive type: RSRC --> Object [2] Archive type: CAB (Microsoft) --> inoweb.exe [WARNING] No further files can be extracted from this archive. The archive will be closed Begin scan in 'E:\' <RECOVER> End of the scan: 2009-02-09 22:25 Used time: 2:13:48 Hour(s) The scan has been done completely. 16193 Scanning directories 660458 Files were scanned 1 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 1 files were deleted 0 files were repaired 1 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 660456 Files not concerned 11826 Archives were scanned 2 Warnings 1 Notes

ComboFix 09-02-08.02 - Cathy 2009-02-09 18:39:42.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1023.524 [GMT 1:00] Lancé depuis: c:\documents and settings\Cathy\Mes documents\Install\stephane.exe Commutateurs utilisés :: c:\documents and settings\Cathy\Mes documents\Install\CFScript.txt * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Bonjour c:\program files\Bonjour\About Bonjour.rtf c:\program files\Bonjour\mdnsNSP.dll c:\program files\Bonjour\mDNSResponder.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-09 au 2009-02-09 )))))))))))))))))))))))))))))))))))) . 2009-02-09 16:10 . 2005-10-10 04:58 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau 2009-02-09 16:10 . 2005-10-10 04:58 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression 2009-02-09 16:10 . 2005-10-10 05:16 <REP> d---s---- c:\documents and settings\Administrateur\UserData 2009-02-09 16:10 . 2005-10-10 03:02 <REP> d--h----- c:\documents and settings\Administrateur\Modèles 2009-02-09 16:10 . 2005-10-27 11:27 <REP> dr------- c:\documents and settings\Administrateur\Mes documents 2009-02-09 16:10 . 2005-10-10 04:58 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer 2009-02-09 16:10 . 2005-10-27 11:27 <REP> dr------- c:\documents and settings\Administrateur\Favoris 2009-02-09 16:10 . 2009-02-09 16:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau 2009-02-09 16:10 . 2005-10-17 09:09 <REP> d-------- c:\documents and settings\Administrateur\Application Data\You've Got Pictures Screensaver 2009-02-09 16:10 . 2005-10-17 09:37 <REP> d-------- c:\documents and settings\Administrateur\Application Data\CyberLink 2009-02-09 16:10 . 2005-11-14 10:13 <REP> d-------- c:\documents and settings\Administrateur\Application Data\AOL 2009-02-09 16:10 . 2009-02-09 16:10 <REP> d-------- c:\documents and settings\Administrateur 2009-02-09 12:18 . 2009-02-09 12:18 <REP> d-------- c:\program files\Fichiers communs\Control Panels 2009-02-08 18:45 . 2009-02-08 18:46 280 --a------ c:\windows\wininit.ini 2009-02-08 16:18 . 2009-02-08 23:15 <REP> d-------- c:\program files\Spybot - Search & Destroy 2009-02-08 16:18 . 2009-02-08 23:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-02-06 14:20 . 2009-02-06 14:20 <REP> d-------- c:\documents and settings\Cathy\Application Data\Windows Search 2009-02-06 14:20 . 2009-02-06 14:20 <REP> d-------- c:\documents and settings\Cathy\Application Data\McAfee 2009-02-06 12:24 . 2009-02-06 12:24 <REP> d-------- c:\program files\Trend Micro 2009-02-06 00:03 . 2009-02-06 00:03 56 -r-hs---- c:\windows\system32\E7CA37B826.sys 2009-02-05 23:59 . 2009-02-06 00:56 <REP> d-------- c:\program files\bitRipper 2009-02-04 21:41 . 2009-02-04 21:41 <REP> d-------- c:\documents and settings\All Users\Application Data\FLEXnet 2009-02-03 00:20 . 2009-02-03 00:20 <REP> d-------- c:\documents and settings\All Users\Application Data\ALM 2009-02-02 23:21 . 2007-02-20 16:04 2,463,976 --a------ c:\windows\system32\NPSWF32.dll 2009-02-02 23:21 . 2007-02-20 16:04 190,696 --a------ c:\windows\system32\NPSWF32_FlashUtil.exe 2009-02-02 22:52 . 2009-02-02 22:52 <REP> d-------- c:\program files\Fichiers communs\Macrovision Shared 2009-02-02 22:41 . 2009-02-02 22:43 <REP> d-------- c:\windows\system32\Adobe 2009-02-02 20:27 . 2009-02-02 20:27 <REP> d-------- C:\LogiShrd 2009-02-02 20:27 . 2009-02-02 20:27 <REP> d-------- c:\documents and settings\Cathy\WINDOWS 2009-02-02 20:02 . 2009-02-02 20:03 <REP> d-------- c:\program files\QuickTime 2009-01-29 23:35 . 2009-02-01 21:54 <REP> d-------- c:\program files\Ontrack 2009-01-29 21:47 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2009-01-29 21:36 . 2009-01-29 21:36 <REP> d-------- c:\windows\system32\XPSViewer 2009-01-29 21:36 . 2009-01-29 21:36 <REP> d-------- c:\program files\Reference Assemblies 2009-01-29 21:36 . 2009-01-29 21:36 <REP> d-------- c:\program files\MSBuild 2009-01-29 21:35 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-01-29 21:35 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-01-29 21:35 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-01-29 21:35 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-01-29 21:35 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-01-29 21:35 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-01-29 21:35 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-01-28 21:50 . 2009-02-01 23:50 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-01-25 23:49 . 2009-01-25 23:48 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-01-25 23:46 . 2009-01-25 23:46 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-01-25 23:45 . 2009-01-25 23:45 <REP> d-------- c:\program files\Lavasoft 2009-01-25 19:08 . 2009-01-25 19:08 <REP> d-------- c:\program files\Windows Defender 2009-01-25 18:47 . 2009-02-06 14:40 <REP> d-------- c:\program files\Yahoo! 2009-01-25 18:47 . 2009-01-25 18:47 <REP> d-------- c:\program files\CCleaner 2009-01-25 18:47 . 2009-01-25 18:47 <REP> d-------- c:\documents and settings\Cathy\Application Data\Yahoo! 2009-01-10 22:51 . 2009-01-10 22:51 <REP> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-09 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-02-09 09:27 --------- d-----w c:\program files\Fichiers communs\Adobe 2009-02-02 19:17 --------- d-----w c:\program files\Java 2009-02-01 20:57 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-01 20:16 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2009-01-25 22:25 --------- d-----w c:\program files\Google 2009-01-21 17:04 0 ----a-w c:\windows\system32\drivers\lvuvc.hs 2009-01-21 17:04 0 ----a-w c:\windows\system32\drivers\logiflt.iad 2009-01-10 21:53 --------- d-----w c:\program files\HP 2009-01-08 18:26 --------- d-----w c:\program files\Fichiers communs\Logitech 2008-12-18 17:23 --------- d-----w c:\documents and settings\NetworkService\Application Data\SACore 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2005-11-13 01:50 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2005-10-17 09:00 8 --sh--r c:\windows\system32\F6D6A6A063.sys . ((((((((((((((((((((((((((((( SnapShot@2009-02-09_16.58.17,98 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-09 15:48:58 20,128 ----a-w c:\windows\system32\MGHwTemp.sys + 2009-02-09 17:43:10 20,128 ----a-w c:\windows\system32\MGHwTemp.sys + 2009-02-09 17:42:15 16,384 ----atw c:\windows\temp\Perflib_Perfdata_21c.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KTPWare"="c:\program files\Elantech\ktp3.exe" [2004-11-17 258048] "MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2005-10-13 178688] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368] "RemoteControl"="c:\program files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-08-17 127118] "mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2004-08-29 53248] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-10-17 180269] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-01 509784] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600] "BOOT"="c:\program files\ISSENDIS\ISSENDIS WebUpdate v6\issendiswebupdatev6.exe" [2002-08-16 476160] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992] "Adobe_ID0EYTHM"="c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160] "SoundMan"="SOUNDMAN.EXE" [2005-09-22 c:\windows\soundman.exe] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-07 c:\windows\AGRSMMSG.exe] "nwiz"="nwiz.exe" [2005-05-25 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-12 113664] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-10-04 67128] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Home Cinema\\PowerCinema\\PowerCinema.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "587:TCP"= 587:TCP:Messagerie Orange "3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server "3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server "50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server "50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-25 64160] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-12 98304] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] R3 Ktp3;Elantech TouchPad(KTP3);c:\windows\system32\drivers\Ktp3.sys [2005-10-10 24704] R3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [2005-10-17 20128] S3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [2005-10-11 799744] S3 CBEN5;Pilote de la famille de carte CardBus Ethernet 10/100 Xircom;c:\windows\system32\drivers\cben5.sys [2005-10-10 46108] S3 phaudlwr;Philips Audio Filter;c:\windows\system32\drivers\phaudlwr.sys [2008-10-10 88704] S3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [2008-10-10 486912] S3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [2008-10-10 7680] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbea412a-ef91-11dd-be4b-0013d3af5a53}] \Shell\AutoRun\command - H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9c0ae9d-edae-11db-bc1d-0013d3af5a53}] \Shell\AutoRun\command - G:\LaunchU3.exe . Contenu du dossier 'Tâches planifiées' 2009-02-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-01 23:49] 2008-10-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-02-09 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.orange.fr/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://fr.search.yahoo.com/search?fr=mcafee&p=%s IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: internet Trusted Zone: mcafee.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-09 18:42:40 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\windows\TEMP\TMP00000036766FB23460D5801F Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "C0403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . ------------------------ Autres processus actifs ------------------------ . c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\searchindexer.exe c:\program files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe c:\progra~1\COMMON~1\X10\Common\X10nets.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wbem\wmiapsrv.exe c:\program files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Heure de fin: 2009-02-09 18:51:30 - La machine a redémarré [Cathy] ComboFix-quarantined-files.txt 2009-02-09 17:51:25 ComboFix2.txt 2009-02-09 17:32:23 ComboFix3.txt 2009-02-09 16:00:16 Avant-CF: 51,944,935,424 octets libres Après-CF: 51,930,345,472 octets libres 257 --- E O F --- 2009-02-05 20:19:16

Voila pour l premire partie. Je fait la suite. Fichier E7CA37B826.sys reçu le 2009.02.09 18:22:10 (CET)Antivirus Version Dernière mise à jour Résultat a-squared 4.0.0.93 2009.02.09 - AhnLab-V3 5.0.0.2 2009.02.09 - AntiVir 7.9.0.76 2009.02.09 - Authentium 5.1.0.4 2009.02.08 - Avast 4.8.1335.0 2009.02.09 - AVG 8.0.0.229 2009.02.09 - BitDefender 7.2 2009.02.09 - CAT-QuickHeal 10.00 2009.02.09 - ClamAV 0.94.1 2009.02.09 - Comodo 972 2009.02.09 - DrWeb 4.44.0.09170 2009.02.09 - eSafe 7.0.17.0 2009.02.09 - eTrust-Vet 31.6.6346 2009.02.07 - F-Prot 4.4.4.56 2009.02.08 - F-Secure 8.0.14470.0 2009.02.09 - Fortinet 3.117.0.0 2009.02.09 - GData 19 2009.02.09 - Ikarus T3.1.1.45.0 2009.02.09 - K7AntiVirus 7.10.624 2009.02.09 - Kaspersky 7.0.0.125 2009.02.09 - McAfee 5520 2009.02.08 - McAfee+Artemis 5520 2009.02.08 - Microsoft 1.4306 2009.02.09 - NOD32 3839 2009.02.09 - Norman 6.00.02 2009.02.09 - nProtect 2009.1.8.0 2009.02.09 - Panda 9.5.1.2 2009.02.09 - PCTools 4.4.2.0 2009.02.09 - Rising 21.15.50.00 2009.02.07 - SecureWeb-Gateway 6.7.6 2009.02.09 - Sophos 4.38.0 2009.02.09 - Sunbelt 3.2.1847.2 2009.02.07 - Symantec 10 2009.02.09 - TheHacker 6.3.1.5.250 2009.02.09 - TrendMicro 8.700.0.1004 2009.02.09 - VBA32 3.12.8.12 2009.02.08 - ViRobot 2009.2.9.1596 2009.02.09 - VirusBuster 4.5.11.0 2009.02.09 - Information additionnelle File size: 56 bytes MD5...: 2775849139f83e620d072d4566653be5 SHA1..: 395ed5563c9dea9ec38e45cc736a251584780b3f SHA256: f4c0c8b28e33c008a37206dae487d5ce42d0aea7e8806fee79b572995cc6411b SHA512: 1c81e82cfdea37af3634c4631d4ebfc5494d3c4ca292b2ede41f5e79bcc09000<BR>49a88a1dcc340d743f4a25c74a98e859968ce753b28b1b249aa359e0861a02c5<BR> ssdeep: 3:/lGPi89uDxb:eMDd<BR> PEiD..: - TrID..: File type identification<BR>MS Flight Simulator Aircraft Performance Info (100.0%) PEInfo: -

Voila j'ai fait le résulktat ci dessous. ComboFix 09-02-08.02 - Administrateur 2009-02-09 16:38:27.1 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1023.775 [GMT 1:00] LancÚ depuis: c:\documents and settings\Cathy\Mes documents\Install\stephane.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* AVERTISSEMENT - LA CONSOLE DE R+CUP+RATION N'EST PAS INSTALL+E SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Cathy\Local Settings\Application Data\eckooky.dat c:\documents and settings\Cathy\Local Settings\Application Data\eckooky_nav.dat c:\documents and settings\Cathy\Local Settings\Application Data\eckooky_navps.dat c:\documents and settings\Cathy\Local Settings\Application Data\qyoykow.dat c:\documents and settings\Cathy\Local Settings\Application Data\qyoykow.exe c:\documents and settings\Cathy\Local Settings\Application Data\qyoykow_nav.dat c:\documents and settings\Cathy\Local Settings\Application Data\qyoykow_navps.dat c:\windows\pack.epk c:\windows\system32\_004326_.tmp.dll c:\windows\system32\_004327_.tmp.dll c:\windows\system32\_004328_.tmp.dll c:\windows\system32\_004329_.tmp.dll c:\windows\system32\_004336_.tmp.dll c:\windows\system32\_004337_.tmp.dll c:\windows\system32\_004338_.tmp.dll c:\windows\system32\_004339_.tmp.dll c:\windows\system32\_004341_.tmp.dll c:\windows\system32\_004342_.tmp.dll c:\windows\system32\_004345_.tmp.dll c:\windows\system32\_004346_.tmp.dll c:\windows\system32\_004348_.tmp.dll c:\windows\system32\_004349_.tmp.dll c:\windows\system32\_004350_.tmp.dll c:\windows\system32\_004352_.tmp.dll c:\windows\system32\_004355_.tmp.dll c:\windows\system32\_004356_.tmp.dll c:\windows\system32\_004360_.tmp.dll c:\windows\system32\_004361_.tmp.dll c:\windows\system32\_004363_.tmp.dll c:\windows\system32\_004365_.tmp.dll c:\windows\system32\_004366_.tmp.dll c:\windows\system32\_004368_.tmp.dll c:\windows\system32\_004369_.tmp.dll c:\windows\system32\_004370_.tmp.dll c:\windows\system32\_004371_.tmp.dll c:\windows\system32\_004372_.tmp.dll c:\windows\system32\_004375_.tmp.dll c:\windows\system32\_004376_.tmp.dll c:\windows\system32\_004377_.tmp.dll c:\windows\system32\_004378_.tmp.dll c:\windows\system32\_004379_.tmp.dll c:\windows\system32\_004384_.tmp.dll c:\windows\system32\bhtzcqiuwt.dat c:\windows\system32\bhtzcqiuwt_nav.dat c:\windows\system32\bhtzcqiuwt_navps.dat c:\windows\system32\mcrh.tmp c:\windows\Tasks\gmpkzckl.job . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-09 au 2009-02-09 )))))))))))))))))))))))))))))))))))) . 2009-02-09 16:10 . 2005-10-10 04:58 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau 2009-02-09 16:10 . 2005-10-10 04:58 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression 2009-02-09 16:10 . 2005-10-10 05:16 <REP> d---s---- c:\documents and settings\Administrateur\UserData 2009-02-09 16:10 . 2005-10-10 03:02 <REP> d--h----- c:\documents and settings\Administrateur\Modèles 2009-02-09 16:10 . 2005-10-27 11:27 <REP> dr------- c:\documents and settings\Administrateur\Mes documents 2009-02-09 16:10 . 2005-10-10 04:58 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer 2009-02-09 16:10 . 2005-10-27 11:27 <REP> dr------- c:\documents and settings\Administrateur\Favoris 2009-02-09 16:10 . 2009-02-09 16:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau 2009-02-09 16:10 . 2005-10-17 09:09 <REP> d-------- c:\documents and settings\Administrateur\Application Data\You've Got Pictures Screensaver 2009-02-09 16:10 . 2005-10-17 09:37 <REP> d-------- c:\documents and settings\Administrateur\Application Data\CyberLink 2009-02-09 16:10 . 2005-11-14 10:13 <REP> d-------- c:\documents and settings\Administrateur\Application Data\AOL 2009-02-09 16:10 . 2009-02-09 16:10 <REP> d-------- c:\documents and settings\Administrateur 2009-02-09 12:18 . 2009-02-09 12:18 <REP> d-------- c:\program files\Fichiers communs\Control Panels 2009-02-08 18:45 . 2009-02-08 18:46 280 --a------ c:\windows\wininit.ini 2009-02-08 16:18 . 2009-02-08 23:15 <REP> d-------- c:\program files\Spybot - Search & Destroy 2009-02-08 16:18 . 2009-02-08 23:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-02-06 14:20 . 2009-02-06 14:20 <REP> d-------- c:\documents and settings\Cathy\Application Data\Windows Search 2009-02-06 14:20 . 2009-02-06 14:20 <REP> d-------- c:\documents and settings\Cathy\Application Data\McAfee 2009-02-06 12:24 . 2009-02-06 12:24 <REP> d-------- c:\program files\Trend Micro 2009-02-06 00:03 . 2009-02-06 00:03 56 -r-hs---- c:\windows\system32\E7CA37B826.sys 2009-02-05 23:59 . 2009-02-06 00:56 <REP> d-------- c:\program files\bitRipper 2009-02-04 21:41 . 2009-02-04 21:41 <REP> d-------- c:\documents and settings\All Users\Application Data\FLEXnet 2009-02-03 00:20 . 2009-02-03 00:20 <REP> d-------- c:\documents and settings\All Users\Application Data\ALM 2009-02-02 23:21 . 2007-02-20 16:04 2,463,976 --a------ c:\windows\system32\NPSWF32.dll 2009-02-02 23:21 . 2007-02-20 16:04 190,696 --a------ c:\windows\system32\NPSWF32_FlashUtil.exe 2009-02-02 22:52 . 2009-02-02 22:52 <REP> d-------- c:\program files\Fichiers communs\Macrovision Shared 2009-02-02 22:41 . 2009-02-02 22:43 <REP> d-------- c:\windows\system32\Adobe 2009-02-02 20:27 . 2009-02-02 20:27 <REP> d-------- C:\LogiShrd 2009-02-02 20:27 . 2009-02-02 20:27 <REP> d-------- c:\documents and settings\Cathy\WINDOWS 2009-02-02 20:02 . 2009-02-02 20:03 <REP> d-------- c:\program files\QuickTime 2009-01-29 23:35 . 2009-02-01 21:54 <REP> d-------- c:\program files\Ontrack 2009-01-29 21:47 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2009-01-29 21:36 . 2009-01-29 21:36 <REP> d-------- c:\windows\system32\XPSViewer 2009-01-29 21:36 . 2009-01-29 21:36 <REP> d-------- c:\program files\Reference Assemblies 2009-01-29 21:36 . 2009-01-29 21:36 <REP> d-------- c:\program files\MSBuild 2009-01-29 21:35 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-01-29 21:35 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-01-29 21:35 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-01-29 21:35 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-01-29 21:35 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-01-29 21:35 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-01-29 21:35 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-01-28 21:50 . 2009-02-01 23:50 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-01-25 23:49 . 2009-01-25 23:48 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-01-25 23:46 . 2009-01-25 23:46 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-01-25 23:45 . 2009-01-25 23:45 <REP> d-------- c:\program files\Lavasoft 2009-01-25 19:08 . 2009-01-25 19:08 <REP> d-------- c:\program files\Windows Defender 2009-01-25 18:47 . 2009-02-06 14:40 <REP> d-------- c:\program files\Yahoo! 2009-01-25 18:47 . 2009-01-25 18:47 <REP> d-------- c:\program files\CCleaner 2009-01-25 18:47 . 2009-01-25 18:47 <REP> d-------- c:\documents and settings\Cathy\Application Data\Yahoo! 2009-01-10 22:51 . 2009-01-10 22:51 <REP> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-09 09:27 --------- d-----w c:\program files\Fichiers communs\Adobe 2009-02-02 19:17 --------- d-----w c:\program files\Java 2009-02-01 20:57 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-01 20:16 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2009-01-25 22:25 --------- d-----w c:\program files\Google 2009-01-21 17:04 0 ----a-w c:\windows\system32\drivers\lvuvc.hs 2009-01-21 17:04 0 ----a-w c:\windows\system32\drivers\logiflt.iad 2009-01-10 21:53 --------- d-----w c:\program files\HP 2009-01-08 18:26 --------- d-----w c:\program files\Fichiers communs\Logitech 2008-12-18 17:23 --------- d-----w c:\documents and settings\NetworkService\Application Data\SACore 2008-12-18 17:17 --------- d-----w c:\program files\McAfee 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2005-11-13 01:50 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2005-10-17 09:00 8 --sh--r c:\windows\system32\F6D6A6A063.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KTPWare"="c:\program files\Elantech\ktp3.exe" [2004-11-17 258048] "MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2005-10-13 178688] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368] "RemoteControl"="c:\program files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-08-17 127118] "mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2004-08-29 53248] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-10-17 180269] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-01 509784] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600] "BOOT"="c:\program files\ISSENDIS\ISSENDIS WebUpdate v6\issendiswebupdatev6.exe" [2002-08-16 476160] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992] "Adobe_ID0EYTHM"="c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160] "SoundMan"="SOUNDMAN.EXE" [2005-09-22 c:\windows\soundman.exe] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-07 c:\windows\AGRSMMSG.exe] "nwiz"="nwiz.exe" [2005-05-25 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-12 113664] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-10-04 67128] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Home Cinema\\PowerCinema\\PowerCinema.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "587:TCP"= 587:TCP:Messagerie Orange "3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server "3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server "50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server "50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-25 64160] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-12 98304] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-11-19 206096] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] R3 Ktp3;Elantech TouchPad(KTP3);c:\windows\system32\drivers\Ktp3.sys [2005-10-10 24704] R3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [2005-10-17 20128] S3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [2005-10-11 799744] S3 CBEN5;Pilote de la famille de carte CardBus Ethernet 10/100 Xircom;c:\windows\system32\drivers\cben5.sys [2005-10-10 46108] S3 phaudlwr;Philips Audio Filter;c:\windows\system32\drivers\phaudlwr.sys [2008-10-10 88704] S3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [2008-10-10 486912] S3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [2008-10-10 7680] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c3703ee-a75e-11dc-bce2-0013d3af5a53}] \Shell\Auto\command - AdobeR.exe e \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbea412a-ef91-11dd-be4b-0013d3af5a53}] \Shell\AutoRun\command - H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9c0ae9d-edae-11db-bc1d-0013d3af5a53}] \Shell\AutoRun\command - G:\LaunchU3.exe . Contenu du dossier 'Tâches planifiées' 2009-02-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-01 23:49] 2008-10-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-16 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] 2009-01-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] 2009-02-09 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20] . - - - - ORPHELINS SUPPRIMES - - - - MSConfigStartUp-eckooky - c:\documents and settings\cathy\local settings\application data\eckooky.exe MSConfigStartUp-messengerskinner - c:\program files\MessengerSkinner\MessengerSkinner.exe . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.orange.fr/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://fr.search.yahoo.com/search?fr=mcafee&p=%s IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: internet Trusted Zone: mcafee.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-09 16:48:14 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "C0403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . ------------------------ Autres processus actifs ------------------------ . c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\progra~1\FICHIE~1\McAfee\MNA\McNASvc.exe c:\progra~1\FICHIE~1\McAfee\McProxy\McProxy.exe c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe c:\program files\McAfee\MPF\MpfSrv.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\searchindexer.exe c:\progra~1\McAfee.com\Agent\mcagent.exe c:\program files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe c:\progra~1\COMMON~1\X10\Common\X10nets.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wbem\wmiapsrv.exe c:\program files\iPod\bin\iPodService.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\program files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe c:\program files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe . ************************************************************************** . Heure de fin: 2009-02-09 17:00:05 - La machine a redémarré [Cathy] ComboFix-quarantined-files.txt 2009-02-09 15:59:54 Avant-CF: 52 833 521 664 octets libres Après-CF: 51,696,091,136 octets libres 317 --- E O F --- 2009-02-05 20:19:16

Bonjour. Le micro portable de ma copine était devenu une infection, j'ai passé tout les outils que je connais dessus CCLEANER, Adware, spyboot, windows defender, mcafee. Je pense qu'il est propre mais je ne peux toujours pas changer les paramètres dans ms config et impossible de changer les paramètres d'IE sur la partie moteur de recherches. J'ai lancé Hijacthis je ne vois rien qui me choque mais je pense que je suis loin de tous connaître. Ci-joint le résultat de hijackthis. Merci. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:51:36, on 09/02/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Elantech\ktp3.exe C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe C:\Program Files\Home Cinema\PowerCinema\PCMService.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.search.yahoo.com/search?fr=mcafee&p=%s R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp3.exe O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [bOOT] C:\Program Files\ISSENDIS\ISSENDIS WebUpdate v6\issendiswebupdatev6.exe /BOOT O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.mcafee.com O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1128950190762 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O20 - AppInit_DLLs: fzbtpw.dll yeideq.dll eopddx.dll qgkunv.dll smfnwr.dll O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 14844 bytes