mohasidy
2008-02-09 09:34:44 UTC
ComboFix 08-02.05.3 - TIERNO 2008-02-09 15:30:50.1 - NTFSx86
Endroit: C:\Documents and Settings\TIERNO\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
[i] ADS - system32: deleted 756312 bytes in 2 streams. [/i]
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\TIERNO\Application Data\inst.exe
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\ScreenSaver\Images\003910C7.urr
C:\Program Files\FunWebProducts\ScreenSaver\Images\003E942F.urr
C:\Program Files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp
C:\Program Files\FunWebProducts\ScreenSaver\Images\wrkparam.lst
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\internet explorer\msimg32.dll
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Cache\003897A1
C:\Program Files\MyWebSearch\bar\Cache\0038C2C6
C:\Program Files\MyWebSearch\bar\Cache\0038D212.bin
C:\Program Files\MyWebSearch\bar\Cache\0038E294.bin
C:\Program Files\MyWebSearch\bar\Cache\0038EF73.bin
C:\Program Files\MyWebSearch\bar\Cache\00391782.bin
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\482FF6A171.dll
C:\WINDOWS\system32\f3PSSavr.scr
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\kavo0.dll
C:\WINDOWS\system32\kavo1.dll
C:\Program Files\MyWebSearch
----- BITS: Possible sites infect‚s -----
hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-09 to 2008-02-09 ))))))))))))))))))))))))))))))))))))
.
2008-02-08 22:12 . 2008-02-08 22:12
2008-02-08 20:59 . 2008-02-08 21:19
2008-02-08 10:47 . 2008-02-08 10:47 268 --ah----- C:\sqmdata05.sqm
2008-02-08 10:47 . 2008-02-08 10:47 244 --ah----- C:\sqmnoopt05.sqm
2008-02-07 23:20 . 2008-02-07 23:20 268 --ah----- C:\sqmdata04.sqm
2008-02-07 23:20 . 2008-02-07 23:20 244 --ah----- C:\sqmnoopt04.sqm
2008-02-07 21:36 . 2004-08-04 04:54 466,944 --a--c--- C:\WINDOWS\system32\dllcache\smtpsvc.dll
2008-02-07 21:35 . 2002-09-07 00:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-02-07 21:34 . 2002-09-07 00:00 1,158,818 --a--c--- C:\WINDOWS\system32\dllcache\korwbrkr.lex
2008-02-07 21:33 . 2002-09-07 00:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-02-07 21:32 . 2002-09-07 00:00 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-02-07 21:31 . 2004-08-04 04:54 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-02-07 21:30 . 2004-08-04 04:54 290,816 --a--c--- C:\WINDOWS\system32\dllcache\adsiis51.dll
2008-02-07 21:30 . 2004-08-04 04:40 281,600 --a--c--- C:\WINDOWS\system32\dllcache\certwiz.ocx
2008-02-07 21:30 . 2003-03-24 15:52 188,480 --a--c--- C:\WINDOWS\system32\dllcache\cfgwiz.exe
2008-02-07 21:30 . 2002-09-07 00:00 96,768 --a--c--- C:\WINDOWS\system32\dllcache\certmap.ocx
2008-02-07 21:30 . 2004-08-04 04:43 77,824 --a--c--- C:\WINDOWS\system32\dllcache\cnfgprts.ocx
2008-02-07 21:30 . 2004-08-04 04:54 47,104 --a--c--- C:\WINDOWS\system32\dllcache\coadmin.dll
2008-02-07 21:30 . 2004-08-04 04:54 43,520 --a--c--- C:\WINDOWS\system32\dllcache\admwprox.dll
2008-02-07 21:30 . 2003-03-24 15:52 20,540 --a--c--- C:\WINDOWS\system32\dllcache\author.dll
2008-02-07 21:30 . 2003-03-24 15:52 20,540 --a--c--- C:\WINDOWS\system32\dllcache\admin.dll
2008-02-07 21:30 . 2003-03-24 15:52 16,439 --a--c--- C:\WINDOWS\system32\dllcache\author.exe
2008-02-07 21:30 . 2003-03-24 15:52 16,439 --a--c--- C:\WINDOWS\system32\dllcache\admin.exe
2008-02-07 21:27 . 2008-02-07 21:27 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-02-07 21:27 . 2008-02-07 21:27 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-02-07 21:27 . 2008-02-07 21:27 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-02-07 21:27 . 2008-02-07 21:27 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-02-07 21:27 . 2008-02-07 21:27 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-02-07 21:27 . 2008-02-07 21:27 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-02-07 21:26 . 2002-09-07 00:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2008-02-07 21:19 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-02-07 20:44 . 2008-02-07 20:44 268 --ah----- C:\sqmdata03.sqm
2008-02-07 20:44 . 2008-02-07 20:44 244 --ah----- C:\sqmnoopt03.sqm
2008-02-07 14:58 . 2008-02-07 14:58 268 --ah----- C:\sqmdata02.sqm
2008-02-07 14:58 . 2008-02-07 14:58 244 --ah----- C:\sqmnoopt02.sqm
2008-02-06 13:53 . 2003-01-01 00:18
2008-02-06 12:23 . 2008-02-08 19:47
2008-02-06 12:12 . 2008-02-07 22:08
2008-02-05 09:45 . 2003-01-01 01:26 13,030 --a------ C:\PDOXUSRS.NET
2008-02-05 09:43 . 2008-02-05 09:49
2008-02-05 09:43 . 2008-02-05 09:43
2008-02-05 09:43 . 2008-02-05 09:43
2008-02-05 09:43 . 1996-07-18 13:06 297,472 --a------ C:\WINDOWS\uninst.exe
2008-02-05 09:43 . 2000-09-18 05:43 274,432 --a------ C:\WINDOWS\system32\KCGMemo.ocx
2008-02-05 09:43 . 2000-09-13 03:31 270,336 --a------ C:\WINDOWS\system32\KCGLable.ocx
2008-02-05 09:43 . 2000-09-10 05:05 270,336 --a------ C:\WINDOWS\system32\KCGEdit.ocx
2008-02-05 09:43 . 2000-09-09 04:24 270,336 --a------ C:\WINDOWS\system32\Aengine.ocx
2008-02-05 09:43 . 1996-06-28 09:50 83,684 --a------ C:\WINDOWS\system32\SIMPO.TTF
2008-02-05 09:43 . 2000-07-24 02:31 3,072 --a------ C:\WINDOWS\system32\data.set
2008-02-05 09:43 . 1996-06-28 09:50 556 --a------ C:\WINDOWS\system32\KBDA1.KBD
2008-02-05 09:43 . 2000-01-30 16:57 120 --a------ C:\WINDOWS\system32\data.lig
2008-02-05 09:19 . 2008-02-05 09:19
2008-02-04 22:00 . 2008-02-03 17:15 113,487 -r-hs---- C:\q83iwmgf.bat
2008-02-04 21:43 . 2008-02-04 22:44 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-02-04 21:37 . 2008-02-04 21:38
2008-02-04 19:00 . 2008-02-04 19:00
2008-02-04 18:47 . 2008-02-04 18:47
2008-02-04 18:47 . 2008-02-04 21:31
2008-02-03 18:58 . 2008-02-03 18:57 11,599 --a------ C:\Documents and Settings\TIERNO\Application Data\Pamela_Crash_47A60EE7.zip
2008-02-02 23:56 . 2008-02-02 23:58 8 --a------ C:\WINDOWS\system32\wtl.dat
2008-02-02 23:54 . 1998-04-30 14:56 129,024 --a------ C:\WINDOWS\UNWISE.EXE
2008-02-02 23:50 . 2008-02-08 19:45
2008-02-02 23:50 . 2008-02-02 23:50
2008-02-02 22:27 . 2008-02-02 22:27
2008-02-02 21:22 . 2008-02-04 10:41
2008-02-01 20:04 . 2008-02-01 20:04 33,280 --a------ C:\WINDOWS\system32\HUFFYUV.DLL
2008-02-01 19:46 . 2008-02-01 19:46
2008-02-01 15:11 . 2008-02-01 15:10 18,604 --a------ C:\Documents and Settings\TIERNO\Application Data\Pamela_Crash_47A33691.zip
2008-02-01 15:06 . 2008-02-01 15:06
2008-02-01 14:42 . 2008-02-01 14:42
2008-02-01 00:11 . 2008-02-03 00:04
2008-01-31 23:31 . 2007-01-30 05:03 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-01-31 23:31 . 2007-01-30 04:56 352,401 --a------ C:\WINDOWS\system32\divxmedia.ax
2008-01-31 23:16 . 2008-01-31 23:16 8 --a------ C:\Documents and Settings\TIERNO\Application Data\usb.dat.bin
2008-01-31 21:00 . 2004-08-04 05:43 1,086,058 -ra------ C:\WINDOWS\SET43.tmp
2008-01-31 21:00 . 2004-08-04 05:52 1,014,836 -ra------ C:\WINDOWS\SET40.tmp
2008-01-31 21:00 . 2004-08-04 05:45 14,043 -ra------ C:\WINDOWS\SET4F.tmp
2008-01-31 20:59 . 2008-02-07 20:17 460,117 --a------ C:\WINDOWS\setupapi.old
2008-01-28 22:16 . 2008-01-28 22:16
2008-01-27 21:59 . 2008-02-08 23:38
2008-01-27 21:24 . 2008-01-27 21:47
2008-01-27 10:09 . 2008-02-09 15:27 466 -r-hs---- C:\autorun.inf
2008-01-26 22:13 . 2008-01-26 22:13
2008-01-26 21:51 . 2008-01-26 21:51 22 --a------ C:\WINDOWS\system32\mcstate.bin
2008-01-26 21:41 . 2008-01-26 23:09 94,208 --a------ C:\WINDOWS\system32\drivers\ezplay.sys
2008-01-26 21:41 . 2008-01-28 11:31 94,208 --a------ C:\Documents and Settings\TIERNO\Application Data\ezplay.sys
2008-01-26 21:40 . 2008-01-28 11:32
2008-01-26 21:40 . 2008-01-26 23:08 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-01-26 21:40 . 2008-01-28 11:31 47,360 --a------ C:\Documents and Settings\TIERNO\Application Data\pcouffin.sys
2008-01-24 21:50 . 2004-08-04 05:43 1,086,058 -ra------ C:\WINDOWS\SET41.tmp
2008-01-24 21:50 . 2004-08-04 05:52 1,014,836 -ra------ C:\WINDOWS\SET3E.tmp
2008-01-24 21:50 . 2004-08-04 05:45 14,043 -ra------ C:\WINDOWS\SET4D.tmp
2008-01-23 20:53 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-01-21 22:25 . 2008-01-23 21:34
2008-01-19 08:04 . 2008-01-27 17:31 861 --a------ C:\WINDOWS\syspropr.INI
2008-01-19 07:33 . 2008-01-19 13:40
2008-01-19 07:33 . 2008-02-09 15:22
2008-01-19 07:33 . 2008-01-19 07:33 479,298 --a------ C:\WINDOWS\system32\wbocx.ocx
2008-01-19 07:33 . 2008-01-19 07:33 172,032 --a------ C:\WINDOWS\system32\AniGIF.ocx
2008-01-19 07:33 . 2008-01-19 07:33 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-06 12:03 --------- d-----w C:\Program Files\Google
2008-02-05 10:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-05 09:31 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\DMCache
2008-02-05 09:31 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-02-02 23:30 --------- d-----w C:\Program Files\AutoCAD 2007
2008-02-02 22:43 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-02-02 22:43 --------- d-----w C:\Program Files\AnswerWorks 4.0
2008-02-02 14:57 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-02-02 14:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-01-31 23:31 --------- d-----w C:\Program Files\Codec
2008-01-16 20:27 --------- d-----w C:\Program Files\Internet Download Manager
2008-01-16 17:04 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\IDM
2008-01-15 09:54 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-01-15 05:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-01-12 18:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-01-11 12:06 --------- d-----w C:\Program Files\AviSynth 2.5
2008-01-07 21:50 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\Publish Providers
2008-01-07 21:50 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\NetMedia Providers
2008-01-07 21:49 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\Sonic Foundry
2008-01-07 18:41 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\MGS
2008-01-07 13:22 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\Nokia
2008-01-06 22:07 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\DMCache
2008-01-06 17:34 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
2008-01-05 23:42 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\PC Suite
2008-01-05 23:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-01-05 23:36 --------- d-----w C:\Program Files\DIFX
2008-01-05 23:25 --------- d-----w C:\Program Files\Java
2008-01-03 20:50 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-01-03 18:30 --------- d-----w C:\Program Files\Norton AntiVirus
2008-01-03 17:49 --------- d-----w C:\Program Files\Symantec
2008-01-03 17:47 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-01-03 17:47 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-01-03 17:47 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-01-02 19:05 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-01 23:16 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-01-01 22:54 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\Graphisoft
2008-01-01 22:06 --------- d-----w C:\Program Files\Apple Software Update
2008-01-01 17:03 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2008-01-01 16:59 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-01-01 10:39 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\Cabos
2008-01-01 09:20 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2007-12-30 23:46 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\Ahead
2007-12-30 23:31 --------- d-----w C:\Program Files\Total Video Converter
2007-12-30 23:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Autodesk
2007-12-30 21:55 --------- d-----w C:\Program Files\Intel
2007-12-30 21:36 --------- d-----w C:\Program Files\Wistron
2007-12-30 21:04 --------- d-----w C:\Program Files\ATI Technologies
2007-12-30 21:03 --------- d-----w C:\Program Files\Launch Manager
2007-12-30 21:02 --------- d-----w C:\Program Files\ltmoh
2007-12-30 19:00 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\ReGet Software
2007-12-30 16:55 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2007-12-30 13:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\GRETECH
2007-12-30 13:32 --------- d-----w C:\Documents and Settings\TIERNO\Application Data\GRETECH
2007-12-29 12:13 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-12-26 12:27 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\muvee Technologies
2007-12-22 21:48 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-22 20:19 --------- d-----w C:\Program Files\SereneScreen
2007-12-22 18:49 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\IDM
2007-12-22 16:04 --------- d-----w C:\Program Files\Logitech
2007-12-22 16:04 --------- d-----w C:\Program Files\Fichiers communs\FotoWire
2007-12-22 16:04 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\FotoWire
2007-12-22 15:26 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-19 12:51 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\U3
2007-12-19 11:30 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2007-12-18 20:08 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\Ahead
2007-12-18 19:27 --------- d-----w C:\Program Files\Nero
2007-12-18 19:27 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-12-18 18:55 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\GRETECH
2007-12-18 18:54 --------- d-----w C:\Program Files\GRETECH
2007-12-18 15:31 --------- d-----w C:\Program Files\Windows Live
2007-12-18 14:48 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-18 13:12 --------- d-----w C:\Program Files\Gateway
2007-12-18 11:42 --------- d-----w C:\Program Files\SuperCopier2
2007-12-18 10:21 --------- d-----w C:\Documents and Settings\COULIBALY\Application Data\Autodesk
2007-12-18 10:08 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-12-18 10:08 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-12-18 09:39 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-18 09:25 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-18 09:22 --------- d-----w C:\Program Files\Services en ligne
2007-12-18 09:21 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-05-15 14:19 7,101,440 ----a-w C:\Program Files\PocketDivXEncoder_0.3.60.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-01-31 19:28 116088 --a------ C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:54 15360]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-13 23:37 1057280]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:07 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-19 13:33 171448]
"L08FXLRD_11900451"="C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 22:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 14:53 88363 C:\WINDOWS\AGRSMMSG.exe]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-04-28 21:08 184320]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2003-05-12 14:28 32768]
"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2003-09-24 13:53 40960]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480]
"LMgrPanelICON"="C:\Program Files\Launch Manager\PanelICON.exe" [2003-09-24 16:37 36864]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2003-09-12 15:24 65536]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-25 15:30 335872]
"AVManager"="C:\Program Files\Wistron\AVManager\AVManager.exe" [2003-09-24 16:49 77824]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-08-24 21:07 51048]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 20:53 714608]
"System12"="C:\WINDOWS\system32\ne0kS.exe" [2007-07-07 10:07 418318]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 21:34 57344 C:\WINDOWS\SOUNDMAN.EXE]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:54 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" [2007-08-24 21:07]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2007-08-09 16:27]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-01-12 18:32]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2007-08-09 16:27]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11b98640-d0c1-11dc-a80b-00e0b87077f8}]
\Shell\AutoRun\command - E:\q83iwmgf.bat
\Shell\explore\Command - E:\q83iwmgf.bat
\Shell\open\Command - E:\q83iwmgf.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43f14a00-d346-11dc-a81c-00e0b87077f8}]
\Shell\AutoRun\command - E:\q83iwmgf.bat
\Shell\explore\Command - E:\q83iwmgf.bat
\Shell\open\Command - E:\q83iwmgf.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{931452e3-b7d8-11dc-a760-00e0b87077f8}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a703f021-bddf-11dc-a796-00e0b87077f8}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4f39600-d0a7-11dc-a80a-00e0b87077f8}]
\Shell\AutoRun\command - E:\q83iwmgf.bat
\Shell\explore\Command - E:\q83iwmgf.bat
\Shell\open\Command - E:\q83iwmgf.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4a67740-bd1f-11dc-a78e-00e0b87077f8}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4be62c0-c9af-11dc-a7dd-00e0b87077f8}]
\Shell\AutoRun\command - E:\8e9gmih.bat
\Shell\explore\Command - E:\8e9gmih.bat
\Shell\open\Command - E:\8e9gmih.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa3eca90-cb35-11dc-a7ea-00e0b87077f8}]
\Shell\AutoRun\command - E:\um.cmd
\Shell\explore\Command - E:\um.cmd
\Shell\open\Command - E:\um.cmd
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-08 20:55:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-04 20:07:20 C:\WINDOWS\Tasks\Norton AntiVirus - Effectuer une analyse complète du système - TIERNO.job"