[Résolu] Problème activation LiveUpdate ou infection ?

Falkra · le 1 août 2009

L'antivirus peut mettre le bazar dans combofix, donc il est archi préférable de le désactiver. Le laisser, c'est en mode "au pire".

@ toute.

sharleen* · le 1 août 2009

Voici, j'espère que c'est ok..

(J'ai téléchargé, fait le glisser/déposer, ComboFix a démarré l'analyse puis il y a eu redémarrage de Windows, puis le rapport.)

ComboFix 09-07-31.04 - YORK 01/08/2009 16:56.5.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.634 [GMT 2:00]

Running from: c:\documents and settings\YORK\Bureau\ComboFix.exe

Command switches used :: c:\documents and settings\YORK\Bureau\CFscript.txt

AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: CA Personal Firewall 9.1.0.26 *disabled* {14CB4B80-8E52-45EA-905E-67C1267B4160}

FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\system32\UmxWnp.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\UmxWnp.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_KMXAGENT

-------\Legacy_KMXCF

-------\Legacy_KMXCFG

-------\Legacy_KMXFILE

-------\Legacy_KMXFW

-------\Legacy_KMXSBX

-------\Legacy_KMXSTART

-------\Legacy_UMXAGENT

-------\Legacy_UMXCFG

-------\Legacy_UMXPOL

-------\Service_KmxAgent

-------\Service_KmxCF

-------\Service_KmxCfg

-------\Service_KmxFile

-------\Service_KmxFw

-------\Service_KmxSbx

-------\Service_KmxStart

-------\Service_UmxAgent

-------\Service_UmxCfg

-------\Service_UmxPol

((((((((((((((((((((((((( Files Created from 2009-07-01 to 2009-08-01 )))))))))))))))))))))))))))))))

.

2009-07-30 12:25 . 2009-07-30 15:06 -------- d-----w- c:\program files\trend micro

2009-07-30 12:25 . 2009-07-30 15:06 -------- d-----w- C:\rsit

2009-07-24 15:02 . 2009-07-25 20:20 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-07-24 15:02 . 2005-08-25 17:18 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL

2009-07-21 17:27 . 2009-07-21 17:27 -------- d-----w- c:\documents and settings\YORK\Application Data\Malwarebytes

2009-07-21 17:26 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-21 17:26 . 2009-07-21 17:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-07-21 17:26 . 2009-07-21 17:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-21 17:26 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-08 16:06 . 2009-07-08 16:06 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla

2009-07-08 12:15 . 2009-07-08 12:43 -------- d-----w- c:\documents and settings\All Users\Application Data\CA

2009-07-08 12:15 . 2009-07-16 12:32 -------- d-----w- c:\program files\CA

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-01 14:50 . 2005-08-30 08:27 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k7

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k6

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k5

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k4

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k3

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k2

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k1

2009-07-31 20:43 . 2009-07-08 12:45 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k0

2009-07-23 14:43 . 2009-05-05 16:54 -------- d-----w- c:\program files\Lavasoft

2009-07-21 17:54 . 2005-08-30 08:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2009-06-29 15:57 . 2005-08-29 09:38 827392 ----a-w- c:\windows\system32\wininet.dll

2009-06-29 15:57 . 2009-05-31 12:44 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-06-29 15:57 . 2005-08-29 09:37 17408 ----a-w- c:\windows\system32\corpol.dll

2009-06-19 12:17 . 2009-06-19 12:17 -------- d-----w- c:\documents and settings\YORK\Application Data\Thunderbird

2009-06-16 14:40 . 2005-08-29 09:37 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:40 . 2005-08-29 09:37 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-03 19:10 . 2005-08-29 09:37 1297408 ----a-w- c:\windows\system32\quartz.dll

2009-05-07 15:33 . 2005-08-29 09:37 348672 ----a-w- c:\windows\system32\localspl.dll

2007-02-10 15:14 . 2007-02-10 15:14 278528 ----a-w- c:\program files\Fichiers communs\FDEUnInstaller.exe

2009-07-07 02:13 . 2008-08-31 12:14 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

2009-03-31 20:47 . 2008-05-16 12:29 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

"ccleaner"="c:\documents and settings\YORK\Mes documents\Logiciels\CCleaner\CCleaner.exe" [2009-06-25 1578736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-06-10 185896]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-27 7118848]

"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2008-10-17 51048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Enryko.lnk - c:\program files\Enryko\Enryko.exe [2006-10-19 274432]

Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2005-05-31 20:46 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]

2005-08-22 09:52 49152 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Fichiers communs\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\AOL 9.0a\\waol.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\1171206881\\ee\\aolsoftware.exe"=

"c:\\Program Files\\AOL 9.0 VR\\waol.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\System Information\\sinf.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\AOL 9.0b\\waol.exe"=

"c:\\Program Files\\AOL 9.0c\\waol.exe"=

R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [27/12/2004 23:31 16384]

R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [30/08/2005 09:02 6144]

R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.SYS [30/08/2005 09:04 5888]

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Fichiers communs\Symantec Shared\CCSVCHST.EXE [25/01/2008 19:47 149352]

R2 Tmesrv;Tmesrv3;c:\program files\Toshiba\TME3\TMESRV31.EXE [30/08/2005 09:04 118784]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [26/02/2009 19:09 101936]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [30/08/2005 10:35 35968]

R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [30/08/2005 09:09 444032]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [12/01/2008 20:32 23888]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

.

Contents of the 'Scheduled Tasks' folder

2009-07-29 c:\windows\Tasks\Norton Internet Security - Effectuer une analyse complète du système - YORK.job

- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]

2006-10-19 c:\windows\Tasks\Rappel d'enregistrement 1.job

- c:\windows\system32\OOBE\oobebaln.exe [2005-08-29 02:34]

2006-10-19 c:\windows\Tasks\Rappel d'enregistrement 2.job

- c:\windows\system32\OOBE\oobebaln.exe [2005-08-29 02:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://news.google.fr/

mStart Page = hxxp://news.google.fr

IE: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html

FF - ProfilePath - c:\documents and settings\YORK\Application Data\Mozilla\Firefox\Profiles\tydb6b57.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - http:/news.google.com

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava11.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava12.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava13.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava14.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava32.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJPI150_03.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPOJI610.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-01 17:01

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1048)

c:\program files\Softex\OmniPass\opxpgina.dll

c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'explorer.exe'(1784)

c:\windows\system32\eappprxy.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\program files\Toshiba\ConfigFree\CFSvcs.exe

c:\program files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Intel\Wireless\Bin\OProtSvc.exe

c:\program files\Toshiba\TOSHIBA RAID\Service\krdevctl.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

c:\windows\system32\ThpSrv.exe

c:\windows\system32\wdfmgr.exe

c:\windows\wanmpsvc.exe

c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

c:\windows\system32\wscntfy.exe

c:\program files\Toshiba\TME3\TMEEJME.exe

.

**************************************************************************

.

Completion time: 2009-08-01 17:03 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-01 15:03

ComboFix2.txt 2009-08-01 13:51

ComboFix3.txt 2009-08-01 12:41

ComboFix4.txt 2009-08-01 11:07

ComboFix5.txt 2009-08-01 14:56

Pre-Run: 82 259 984 384 octets libres

Post-Run: 82 158 485 504 octets libres

203 --- E O F --- 2009-07-29 12:43

Falkra · le 1 août 2009

Le script a fonctionné. On ne touche plus à combofix pour le moment (on le retirera après, il y a une façon de faire spéciale).

Poste un nouveau rapport Rsit stp (il ne'en fera qu'un : normal).

Et voici un deuxième scan (indolore).

Télécharge et installe regscanner.
Lance-le depuis le raccourci du menu démarrer ou du bureau.
Ca ouvre une fenêtre "Registry scan options".
Dans "Find string" entre "14CB4B80-8E52-45EA-905E-67C1267B4160" sans les guillemets.
En bas à droite dans "Scan the following base keys" sélectionne-les toutes, tout doit être grisé.
Clique sur ok.
Ca cherche.
Une fois la recherche finie, fais CTRL+A pour tout sélectionner, puis CTRL+S pour sauvegarder.
Sauvegarde un fichier texte sur ton bureau, avec le nom de ton choix.
Poste le contenu de ce fichier texte dans ta prochaine réponse stp.

sharleen* · le 1 août 2009

Rapport RSit :

Logfile of random's system information tool 1.06 (written by random/random)

Run by YORK at 2009-08-01 17:46:17

Microsoft Windows XP Professionnel Service Pack 3

System drive C: has 78 GB (82%) free of 95 GB

Total RAM: 1023 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:46:24, on 01/08/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe

C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\krdevctl.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ThpSrv.exe

C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Enryko\Enryko.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\YORK\Bureau\RSIT.exe

C:\Program Files\trend micro\YORK.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll

O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ccleaner] "C:\Documents and Settings\YORK\Mes documents\Logiciels\CCleaner\CCleaner.exe" /AUTO

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Enryko.lnk = C:\Program Files\Enryko\Enryko.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe

O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--

End of file - 8515 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Norton Internet Security - Effectuer une analyse complète du système - YORK.job

C:\WINDOWS\tasks\Rappel d'enregistrement 1.job

C:\WINDOWS\tasks\Rappel d'enregistrement 2.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]

DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2005-05-31 118844]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll [2009-03-31 357744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]

Symantec Intrusion Prevention - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll [2008-05-16 116088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]

AOL Toolbar Launcher - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll [2007-02-09 970752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll [2007-02-09 970752]

{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Show Norton Toolbar - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll [2009-03-31 357744]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2007-06-10 185896]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-07-27 7118848]

"ccApp"=C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe [2008-10-17 51048]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]

"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

"ccleaner"=C:\Documents and Settings\YORK\Mes documents\Logiciels\CCleaner\CCleaner.exe [2009-06-25 1578736]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

Enryko.lnk - C:\Program Files\Enryko\Enryko.exe

Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless]

C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [2005-05-31 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]

C:\Program Files\Softex\OmniPass\opxpgina.dll [2005-08-22 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265088]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoDriveAutoRun"=67108863

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=

"NoDriveAutoRun"=

"NoDriveTypeAutoRun"=

"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe"="C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe:*:Enabled:Sentinel Protection Server"

"C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"

"C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL"

"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"

"C:\Program Files\AOL 9.0a\waol.exe"="C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL"

"C:\Program Files\Fichiers communs\AOL\1171206881\ee\aolsoftware.exe"="C:\Program Files\Fichiers communs\AOL\1171206881\ee\aolsoftware.exe:*:Enabled:AOL Shared Components"

"C:\Program Files\AOL 9.0 VR\waol.exe"="C:\Program Files\AOL 9.0 VR\waol.exe:*:Enabled:AOL"

"C:\Program Files\Fichiers communs\AOL\TopSpeed\3.0\aoltpsd3.exe"="C:\Program Files\Fichiers communs\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed"

"C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe"="C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"

"C:\Program Files\Fichiers communs\AOL\System Information\sinf.exe"="C:\Program Files\Fichiers communs\AOL\System Information\sinf.exe:*:Enabled:AOL System Information"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\Program Files\AOL 9.0b\waol.exe"="C:\Program Files\AOL 9.0b\waol.exe:*:Enabled:AOL"

"C:\Program Files\AOL 9.0c\waol.exe"="C:\Program Files\AOL 9.0c\waol.exe:*:Enabled:AOL"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]