ComboFix 08-07-22.3 - SYSTEM 2008-07-23 13:04:59.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1033.18.1607 [GMT 2:00]
Running from: C:\Windows\system32\config\systemprofile\Desktop\KillBaggle.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA


((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.

2008-07-23 12:12 . 2008-07-23 12:12 <REP> d-------- C:\Muestras
2008-07-19 13:08 . 2008-06-26 02:33 11,722,752 --a------ C:\Windows\System32\NlsLexicons0001.dll
2008-07-13 15:35 . 2006-11-06 18:04 28,672 --a------ C:\Windows\System32\drivers\wceusbsh.sys
2008-07-11 23:24 . 2007-10-10 19:38 90,112 --a------ C:\Windows\RSetupCE.exe
2008-07-11 23:23 . 2008-07-11 23:23 <REP> d-------- C:\Program Files\Resco
2008-07-11 21:10 . 2008-07-11 21:10 <REP> d-------- C:\Program Files\Microsoft ActiveSync

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-14 10:09 --------- d-----w C:\Program Files\Java
2008-07-10 08:07 174 --sha-w C:\Program Files\desktop.ini
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-01-08 19:36 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-01-08 19:36 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-01-08 19:36 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-03-17 08:04 696320]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34 125440]
"updateMgr"="D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-14 17:02 815104]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"Acrobat Assistant 7.0"="D:\Programmes\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-04-27 11:25 257088]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-18 23:02 185896]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-12 22:10 4186112 C:\Windows\RtHDVCpl.exe]

C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Lancement rapide d'Adobe Acrobat.lnk - C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2007-04-17 20:40:47 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4285057348-1256085205-3988045248-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{76BAE9D1-5E0C-4A03-B74C-BABAE0763751}"= TCP:6004|D:\Programmes\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{79478C73-64BE-44BF-B9F0-C9BDC34E3627}D:\\programmes\\emule0.47c\\emule.exe"= UDP:D:\programmes\emule0.47c\emule.exe:eMule
"UDP Query User{82A7CBA6-DDFE-4053-83A4-533F7165E4F7}D:\\programmes\\emule0.47c\\emule.exe"= TCP:D:\programmes\emule0.47c\emule.exe:eMule
"{9FE87751-B5A6-45EB-8AF7-6B275F838731}"= UDP:5721:LocalSubnet:LocalSubnet|IF={A8E3B9DB-D24C-45A0-902C-0A5CE9E1DD80}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
"{19918D1F-BB61-4CC9-899F-17883A5B1220}"= UDP:1034:LocalSubnet:LocalSubnet|IF={A8E3B9DB-D24C-45A0-902C-0A5CE9E1DD80}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
"{3FD4CAD7-9744-4AB7-943E-C36B26F0980D}"= UDP:5678:LocalSubnet:LocalSubnet|IF={A8E3B9DB-D24C-45A0-902C-0A5CE9E1DD80}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
"{B2676C1C-71B4-4CFE-B4C2-AB82790E4D27}"= UDP:999:LocalSubnet:LocalSubnet|IF={A8E3B9DB-D24C-45A0-902C-0A5CE9E1DD80}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
"{17EC45C6-98B9-4DF3-9AAA-968683287A82}"= UDP:26675:LocalSubnet:LocalSubnet|IF={A8E3B9DB-D24C-45A0-902C-0A5CE9E1DD80}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
"{6E4389A6-445E-4769-89D5-C03E94CF245B}"= UDP:990:LocalSubnet:LocalSubnet|IF={A8E3B9DB-D24C-45A0-902C-0A5CE9E1DD80}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001
"{7012C123-BBDE-4A75-B494-8FCB26B7266D}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E131E049-F931-4200-8D94-FD8A3AAC06AC}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{E9FB0321-90D3-4E8C-BD59-4EC78838292D}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{050F181F-F65C-4817-BDBD-091D702D9FB6}D:\\programmes\\emule\\emule.exe"= UDP:D:\programmes\emule\emule.exe:eMule
"UDP Query User{6BC16202-2566-4F9F-915B-2378D70162B4}D:\\programmes\\emule\\emule.exe"= TCP:D:\programmes\emule\emule.exe:eMule
"TCP Query User{D682E965-8C88-4D0B-8565-1C4718509CB4}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{3E7C932B-101C-4953-86FE-FCCE4B693FB5}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{BD406452-9CC2-4A58-B9F6-1F3A7131BF5B}D:\\programmes\\emule\\emule.exe"= UDP:D:\programmes\emule\emule.exe:eMule
"UDP Query User{CCD2AE32-5EA5-4EDD-BBEC-86107F12CB09}D:\\programmes\\emule\\emule.exe"= TCP:D:\programmes\emule\emule.exe:eMule
"TCP Query User{3269BE57-7B85-4FFE-B74C-831FADD059A6}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{E3DC2316-CA7D-49AF-8405-C592A096B142}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{CC3BD6FB-7629-4851-B819-9F5F5633B882}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{9D9412E8-BCB1-4118-99F1-8F5034346C5A}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"{056511BC-CBA5-4354-8A56-19FDCD9D05B3}"= UDP:5721:LocalSubnet:LocalSubnet|IF={2F0E44F0-B52A-48BE-A2A8-F1AE071CFB1D}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
"{D4BF64F2-5E02-42B3-94EB-766C2788A47D}"= UDP:1034:LocalSubnet:LocalSubnet|IF={2F0E44F0-B52A-48BE-A2A8-F1AE071CFB1D}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
"{94FE5436-EC7D-4C9F-BABC-A969A68E2C81}"= UDP:5678:LocalSubnet:LocalSubnet|IF={2F0E44F0-B52A-48BE-A2A8-F1AE071CFB1D}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
"{A008316C-CCFD-4570-B2B1-24E45676BB56}"= UDP:999:LocalSubnet:LocalSubnet|IF={2F0E44F0-B52A-48BE-A2A8-F1AE071CFB1D}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
"{FBE18620-7B8B-403A-A27B-8E1CB72B77D8}"= UDP:26675:LocalSubnet:LocalSubnet|IF={2F0E44F0-B52A-48BE-A2A8-F1AE071CFB1D}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
"{475DF5A7-5A40-49C1-BDE1-E904ABFD5DE1}"= UDP:990:LocalSubnet:LocalSubnet|IF={2F0E44F0-B52A-48BE-A2A8-F1AE071CFB1D}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001
"{A825314E-83CF-4EF7-9460-CAB0B7D7E5B4}"= UDP:5721:LocalSubnet:LocalSubnet|IF={42C3DA1F-C7C5-425B-ABAC-3D5E006E3132}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
"{3C5D1A4C-0B34-4B5B-A985-CB721202F592}"= UDP:1034:LocalSubnet:LocalSubnet|IF={42C3DA1F-C7C5-425B-ABAC-3D5E006E3132}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
"{3C6F0390-4271-459E-87DF-C409FAB84C61}"= UDP:5678:LocalSubnet:LocalSubnet|IF={42C3DA1F-C7C5-425B-ABAC-3D5E006E3132}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
"{41DC65CC-119C-4948-A4F8-6B5E48F98D2D}"= UDP:999:LocalSubnet:LocalSubnet|IF={42C3DA1F-C7C5-425B-ABAC-3D5E006E3132}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
"{AB8A8CA9-247A-4CB7-811E-AD086229855B}"= UDP:26675:LocalSubnet:LocalSubnet|IF={42C3DA1F-C7C5-425B-ABAC-3D5E006E3132}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
"{48A56DB5-23B2-4F83-90F7-2B190B44E4BD}"= UDP:990:LocalSubnet:LocalSubnet|IF={42C3DA1F-C7C5-425B-ABAC-3D5E006E3132}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\Windows\System32\StkCSrv.exe [2006-12-11 00:31]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-04-12 22:15]
R3 AVer3xEn;AVerMedia SAA713x BDA Encoder Service;C:\Windows\system32\DRIVERS\AVer3xEn.sys [2006-11-14 10:24]
R3 ITECIR;ITE CIR Driver;C:\Windows\system32\DRIVERS\ITECIR.sys [2004-04-13 10:39]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\Windows\system32\Drivers\StkCMini.sys [2007-01-19 23:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
O8 -: Convertir en Adobe PDF - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir en un fichier PDF existant - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir la cible du lien en Adobe PDF - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir la cible du lien en un fichier PDF existant - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir la sélection en Adobe PDF - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convertir la sélection en un fichier PDF existant - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convertir les liens sélectionnés en fichier Adobe PDF - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Convertir les liens sélectionnés en un fichier PDF existant - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: E&xporter vers Microsoft Excel - D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{4455EAA5-816F-4B70-AD36-B311F0F8C00A}: NameServer = 192.168.2.1


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-23 13:09:40
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ATK Hotkey\HControl.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\conime.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Windows\ehome\ehrecvr.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\WMIADAP.exe
C:\Windows\System32\dllhost.exe
D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcrobatInfo.exe
.
**************************************************************************
.
Completion time: 2008-07-23 13:13:58 - machine was rebooted [Lio]
ComboFix-quarantined-files.txt 2008-07-23 11:13:51
ComboFix2.txt 2008-07-23 10:29:13

Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 854,740,992 octets libres

163 --- E O F --- 2008-07-20 10:20:08

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48, on 2008-07-23
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\WindowsMobile\wmdc.exe
D:\Programmes\Adobe\Acrobat 7.0\Distillr\acrotray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmes\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Programmes\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [updateMgr] "D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O8 - Extra context menu item: Convertir en Adobe PDF - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://D:\Programmes\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{4455EAA5-816F-4B70-AD36-B311F0F8C00A}: NameServer = 192.168.2.1
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 7543 bytes