Page PUB

vOICI LE RAPPORT OBTENU/
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:16:37, on 04/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\documents and settings\berlandis\local settings\application data\rnrnrny.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Outlook Express\msimn.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [rnrnrny] "c:\documents and settings\berlandis\local settings\application data\rnrnrny.exe" rnrnrny
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Film Up] C:\DOCUME~1\LAURA\APPLIC~1\PLANBI~1\SOFTWINBUILD.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (User 'LAURA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/43.10/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://turquoise37.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://express.foto.com/ImageUploader5.cab
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1230838878778&h=9d7f19b45b3ed7e9fb33cfcd8bb6a34f/&filename=jinstall-6u11-windows-i586-jc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFUploader/SpeedUploader.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

Merci pour vos conseils, mais n'étant pas à l'aise avec vos conseils, donc vos infos, n'y-a-t-il pas une manière plus accessible pour supprimer ces virus? Annick

Voici le rapport que je viens d'avoir. Que fais-je ensuite??Merci beaucoup pour votre aide.

voici le rapport bloc note que je Search Navipromo version 3.7.1 commencé le 07/01/2009 à 16:32:14,71

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 02.01.2009 à 19h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
USER : berlandis ( Not Administrator ! )
BOOT : Normal boot




A:\ (USB)
C:\ (Local Disk) - NTFS - Total:71 Go (Free:27 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:465 Go (Free:440 Go)


Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\berlandis\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\LAURA\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\berlandis\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\LAURA\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\berlandis\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\LAURA\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\berlandis\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\LAURA\locals~1\applic~1" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"rnrnrny"="\"c:\\documents and settings\\berlandis\\local settings\\application data\\rnrnrny.exe\" rnrnrny"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

dbxjnoc.dat trouvé !
dbxjnoc_nav.dat trouvé !
dbxjnoc_navps.dat trouvé !
grjbepukzc.dat trouvé !
grjbepukzc_nav.dat trouvé !
grjbepukzc_navps.dat trouvé !
hhwborod.dat trouvé !
hhwborod_nav.dat trouvé !
hhwborod_navps.dat trouvé !
kphfbiero.dat trouvé !
kphfbiero_nav.dat trouvé !
kphfbiero_navps.dat trouvé !
nsauzllv.dat trouvé !
nsauzllv_nav.dat trouvé !
nsauzllv_navps.dat trouvé !
tzodws.dat trouvé !
tzodws_nav.dat trouvé !
tzodws_navps.dat trouvé !
yohwqkaho_navfx.dat trouvé !
zscvvy.dat trouvé !
zscvvy_nav.dat trouvé !
zscvvy_navps.dat trouvé !

* Dans "C:\Documents and Settings\berlandis\locals~1\applic~1" :

rnrnrny.exe trouvé !
rnrnrny.dat trouvé !
rnrnrny_nav.dat trouvé !
rnrnrny_navps.dat trouvé !

* Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\LAURA\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 07/01/2009 à 16:47:03,32 ***
viens d'avoir. Qu'est-ce que je fais ensuite?

bonsoir, c'est encore moi, suite à votre conseil, comment faire pour: " Déconnecte toi du net et désactive ton antivirus et antispyware résident pour que Navilog1 puisse s'exécuter normalement"???Merci ANNICK

désolée mais comment désactive-ton??

ok c'est + clair.Merci je vais essayé tt ça, car très pénible d'être envahie par ces pages de pub sauvages. Merci encore pour votre patience , car mes questions sont certainement très surprenates pour vs, et vs devez bcp rire de nos incompétences.Grosse bise virtuelle.

vOICI LE DERNIER RAPPORT. Je vous dirai + tard si ce traitement fut opérationnel. En tous cas MERCI pour votre aide.Bises virtuelle.
lean Navipromo version 3.7.1 commencé le 07/01/2009 à 19:37:35,70

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 02.01.2009 à 19h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
USER : berlandis ( Not Administrator ! )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 090106-1] 4.8.1296 (Not Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:71 Go (Free:27 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:465 Go (Free:440 Go)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\berlandis\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

* Suppression dans "C:\DOCUME~1\LAURA\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\berlandis\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\LAURA\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\berlandis\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\LAURA\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\berlandis\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\LAURA\menudm~1\progra~1" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\berlandis\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


dbxjnoc.dat trouvé !
Copie dbxjnoc.dat réalisée avec succès !
dbxjnoc.dat supprimé !

dbxjnoc_nav.dat trouvé !
Copie dbxjnoc_nav.dat réalisée avec succès !
dbxjnoc_nav.dat supprimé !

dbxjnoc_navps.dat trouvé !
Copie dbxjnoc_navps.dat réalisée avec succès !
dbxjnoc_navps.dat supprimé !

grjbepukzc.dat trouvé !
Copie grjbepukzc.dat réalisée avec succès !
grjbepukzc.dat supprimé !

grjbepukzc_nav.dat trouvé !
Copie grjbepukzc_nav.dat réalisée avec succès !
grjbepukzc_nav.dat supprimé !

grjbepukzc_navps.dat trouvé !
Copie grjbepukzc_navps.dat réalisée avec succès !
grjbepukzc_navps.dat supprimé !

hhwborod.dat trouvé !
Copie hhwborod.dat réalisée avec succès !
hhwborod.dat supprimé !

hhwborod_nav.dat trouvé !
Copie hhwborod_nav.dat réalisée avec succès !
hhwborod_nav.dat supprimé !

hhwborod_navps.dat trouvé !
Copie hhwborod_navps.dat réalisée avec succès !
hhwborod_navps.dat supprimé !

kphfbiero.dat trouvé !
Copie kphfbiero.dat réalisée avec succès !
kphfbiero.dat supprimé !

kphfbiero_nav.dat trouvé !
Copie kphfbiero_nav.dat réalisée avec succès !
kphfbiero_nav.dat supprimé !

kphfbiero_navps.dat trouvé !
Copie kphfbiero_navps.dat réalisée avec succès !
kphfbiero_navps.dat supprimé !

nsauzllv.dat trouvé !
Copie nsauzllv.dat réalisée avec succès !
nsauzllv.dat supprimé !

nsauzllv_nav.dat trouvé !
Copie nsauzllv_nav.dat réalisée avec succès !
nsauzllv_nav.dat supprimé !

nsauzllv_navps.dat trouvé !
Copie nsauzllv_navps.dat réalisée avec succès !
nsauzllv_navps.dat supprimé !

C:\WINDOWS\prefetch\rnrnrny*.pf trouvé !
Copie C:\WINDOWS\prefetch\rnrnrny*.pf réalisée avec succès !
C:\WINDOWS\prefetch\rnrnrny*.pf supprimé !

tzodws.dat trouvé !
Copie tzodws.dat réalisée avec succès !
tzodws.dat supprimé !

tzodws_nav.dat trouvé !
Copie tzodws_nav.dat réalisée avec succès !
tzodws_nav.dat supprimé !

tzodws_navps.dat trouvé !
Copie tzodws_navps.dat réalisée avec succès !
tzodws_navps.dat supprimé !

yohwqkaho_navfx.dat trouvé !
Copie yohwqkaho_navfx.dat réalisée avec succès !
yohwqkaho_navfx.dat supprimé !

zscvvy.dat trouvé !
Copie zscvvy.dat réalisée avec succès !
zscvvy.dat supprimé !

zscvvy_nav.dat trouvé !
Copie zscvvy_nav.dat réalisée avec succès !
zscvvy_nav.dat supprimé !

zscvvy_navps.dat trouvé !
Copie zscvvy_navps.dat réalisée avec succès !
zscvvy_navps.dat supprimé !


* Dans "C:\Documents and Settings\berlandis\locals~1\applic~1" *


rnrnrny.exe trouvé !
Copie rnrnrny.exe réalisée avec succès !
rnrnrny.exe supprimé !

rnrnrny.dat trouvé !
Copie rnrnrny.dat réalisée avec succès !
rnrnrny.dat supprimé !

rnrnrny_nav.dat trouvé !
Copie rnrnrny_nav.dat réalisée avec succès !
rnrnrny_nav.dat supprimé !

rnrnrny_navps.dat trouvé !
Copie rnrnrny_navps.dat réalisée avec succès !
rnrnrny_navps.dat supprimé !


* Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *



* Dans "C:\DOCUME~1\LAURA\locals~1\applic~1" *



*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 07/01/2009 à 19:41:28,59 ***

je fais comment pour envoyer rapport à hijackthis ? enfin sur quelle touche car c'est écrit en anglais§

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:14:10, on 07/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Film Up] C:\DOCUME~1\LAURA\APPLIC~1\PLANBI~1\SOFTWINBUILD.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-501\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Invité')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/43.10/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://turquoise37.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://express.foto.com/ImageUploader5.cab
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1230838878778&h=9d7f19b45b3ed7e9fb33cfcd8bb6a34f/&filename=jinstall-6u11-windows-i586-jc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFUploader/SpeedUploader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
USER : berlandis ( Not Administrator ! )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 090107-0] 4.8.1296 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:71 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:465 Go (Free:440 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 07/01/2009|21:24 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskTBar
C:\Program Files\AskTBar\bar
C:\Program Files\AskTBar\PopSwatr
C:\Program Files\AskTBar\SrchAstt
C:\Program Files\AskTBar\bar\1.bin
C:\Program Files\AskTBar\bar\Cache
C:\Program Files\AskTBar\bar\History
C:\Program Files\AskTBar\bar\Settings
C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
C:\Program Files\AskTBar\bar\Cache\000C8E5B.bin
C:\Program Files\AskTBar\bar\Cache\000C9139.bin
C:\Program Files\AskTBar\bar\Cache\000CA2AE.bin
C:\Program Files\AskTBar\bar\Cache\000CB461.bin
C:\Program Files\AskTBar\bar\Cache\000CB7BC.bin
C:\Program Files\AskTBar\bar\Cache\000CB9FE.bin
C:\Program Files\AskTBar\bar\Cache\01123E4C
C:\Program Files\AskTBar\bar\Cache\files.ini
C:\Program Files\AskTBar\bar\History\search2
C:\Program Files\AskTBar\bar\Settings\prevcfg2.htm
C:\Program Files\AskTBar\PopSwatr\History
C:\Program Files\AskTBar\PopSwatr\History\allowed
C:\Program Files\AskTBar\PopSwatr\History\notallow
C:\Program Files\AskTBar\SrchAstt\1.bin
C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
C:\DOCUME~1\LAURA\APPLIC~1\Dealio
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\resFF
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\temp
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\alerts.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\alerts_over.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\chevron-small.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\DealioSearch.html
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\deal_report.jpg
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\err_toolbar.html
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\global_scripts.js
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\highlight-bg.png
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\logo.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\logo_over.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\man_toolbar.css
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\man_toolbar.html
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\man_toolbar.js
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\scripts.js
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\scroller.js
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\search-chevron.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\separator.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\settings.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\settings_over.gif
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\res\yahoo-search.png
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\resFF\deal_report.jpg
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\resFF\ebay_login.jpg
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\index.76.35
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\index.3.67.22
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.109.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.178.66
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.198.56
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.245.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.247.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.279.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.283.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.284.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.289.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.290.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.297.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.315.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.319.49
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.335.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.337.44
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.340.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.360.53
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.386.59
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.388.59
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.391.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.398.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.399.60
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.403.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.404.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.405.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.406.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.407.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.408.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.409.61
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.412.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.413.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.414.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.415.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.416.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.417.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.418.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.419.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.420.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.421.62
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.424.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.427.63
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.432.65
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.49.67
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.51.46
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.52.57
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.53.51
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.54.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.57.43
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\rulesFF\rules.3.58.47
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\temp\dealio-14006.log
C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127\temp\dod_cache.xml
C:\Program Files\Dealio
C:\Program Files\Dealio\kb127
C:\Program Files\Need2Find
C:\Program Files\Need2Find\bar
C:\Program Files\Need2Find\bar\1.bin
C:\Program Files\Need2Find\bar\Cache
C:\Program Files\Need2Find\bar\History
C:\Program Files\Need2Find\bar\Settings
C:\Program Files\Need2Find\bar\1.bin\N2FFXTBR.JAR
C:\Program Files\Need2Find\bar\1.bin\N2NTSTBR.JAR
C:\Program Files\Need2Find\bar\1.bin\PARTNER.DAT
C:\Program Files\Need2Find\bar\Cache\01C26351
C:\Program Files\Need2Find\bar\Cache\files.ini
C:\Program Files\Need2Find\bar\History\search
C:\Program Files\Need2Find\bar\Settings\prevcfg.htm
C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126\res
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126\temp
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126\temp\ws-14002.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126\temp\ws-14003.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126\temp\ws-14004.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126\temp\ws-14005.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127\temp\ws-14248.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127\temp\ws-14249.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127\temp\ws-14250.log
C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127\temp\ws-14251.log
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127\temp\ws-14248.log
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127\temp\ws-14249.log
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127\temp\ws-14250.log
C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127\temp\ws-14251.log
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\Fonts\acrsec.fon
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon

-----------\\ Extensions

(berlandis) - {5bf73a30-8317-404b-bb12-bb1d7aacb90d} => fr-FR
(berlandis) - {5bf73a30-8317-404b-bb12-bb1d7aacb90d} => frenchlocale
(berlandis) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(LAURA) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(LAURA) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
"Start Page"="https://www.google.com/?gws_rd=ssl"
"Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 07/01/2009|21:27 - Option : [1]

-----------\\ Fin du rapport a 21:27:54,10

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
USER : berlandis ( Not Administrator ! )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 090107-0] 4.8.1296 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:71 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:465 Go (Free:440 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 07/01/2009|21:36 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskTBar\bar
Supprime! - C:\Program Files\AskTBar\PopSwatr
Supprime! - C:\Program Files\AskTBar\SrchAstt
Supprime! - C:\DOCUME~1\LAURA\APPLIC~1\Dealio\kb127
Supprime! - C:\Program Files\Dealio\kb127
Supprime! - C:\Program Files\Need2Find\bar
Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
Supprime! - C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb126
Supprime! - C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings\kb127
Supprime! - C:\DOCUME~1\LAURA\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\WINDOWS\smdat32m.sys
Supprime! - C:\WINDOWS\Fonts\acrsec.fon
Supprime! - C:\WINDOWS\Fonts\acrsecB.fon
Supprime! - C:\WINDOWS\Fonts\acrsecI.fon
Supprime! - C:\Program Files\AskTBar
Supprime! - C:\DOCUME~1\LAURA\APPLIC~1\Dealio
Supprime! - C:\Program Files\Dealio
Supprime! - C:\Program Files\Need2Find
Supprime! - C:\DOCUME~1\BERLAN~1\APPLIC~1\Search Settings
Supprime! - C:\DOCUME~1\LAURA\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(berlandis) - {5bf73a30-8317-404b-bb12-bb1d7aacb90d} => fr-FR
(berlandis) - {5bf73a30-8317-404b-bb12-bb1d7aacb90d} => frenchlocale
(berlandis) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(LAURA) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(LAURA) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
"Start Page"="https://www.google.com/?gws_rd=ssl"
"Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 07/01/2009|21:27 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 07/01/2009|21:41 - Option : [2]

-----------\\ Fin du rapport a 21:41:07,57

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:56:57, on 07/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Film Up] C:\DOCUME~1\LAURA\APPLIC~1\PLANBI~1\SOFTWINBUILD.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-501\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Invité')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/43.10/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://turquoise37.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://express.foto.com/ImageUploader5.cab
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1230838878778&h=9d7f19b45b3ed7e9fb33cfcd8bb6a34f/&filename=jinstall-6u11-windows-i586-jc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFUploader/SpeedUploader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

------- Logfile of AD-Remover 1.0.8.6 by C_XX | ONLY XP/VISTA -------

# START at: 22:12:37 | Mer 07/01/2009 | Microsoft® Windows XP™ SP3 (v5.1.2600)
# BOOT MODE: Normal
# OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
# PC: D8HM0L1J | USER: berlandis ( Current user is an administrator)
# DRIVE(S):
- C:\ (File System: NTFS)
- E:\ (File System: NTFS)
# Internet Explorer v7.0.5730.11

# RUNNING PROCESSES: 47

+-----------------------| Boonty/Boonty Games Elements found :

.
.

+-----------------------| Eorezo Elements found :

.
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\EoRezo
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\EoRezo
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Program Files\EoRezo
C:\Program Files\EoRezo\EoAdv
C:\Program Files\EoRezo\EoAdv\eoAdv.url
C:\Program Files\EoRezo\EoAdv\EoRezoBho.old
C:\Documents and Settings\berlandis\Application Data\EoRezo
C:\Documents and Settings\berlandis\Application Data\EoRezo\cmhost.cyp
C:\Documents and Settings\berlandis\Application Data\EoRezo\ConfMedia.cyp
C:\Documents and Settings\berlandis\Application Data\EoRezo\db
C:\Documents and Settings\berlandis\Application Data\EoRezo\eoDesktop
C:\Documents and Settings\berlandis\Application Data\EoRezo\host.cyp
C:\Documents and Settings\berlandis\Application Data\EoRezo\user.cyp
C:\Documents and Settings\berlandis\Application Data\EoRezo\db\cat.cyp
C:\Documents and Settings\berlandis\Application Data\EoRezo\eoDesktop\config.xml
C:\Documents and Settings\berlandis\Application Data\EoRezo\eoDesktop\eoDesktop.html
C:\Documents and Settings\berlandis\Application Data\EoRezo\eoDesktop\userConfig.xml

+-----------------------| Everest Poker Elements found :

.
.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

.
HKCU\Software\FunWebProducts
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca}
.

+-----------------------| It's TV Elements found :

HKCU\SOFTWARE\ItsLabel
.
C:\Documents and Settings\berlandis\Application Data\ItsLabel
C:\Documents and Settings\berlandis\Application Data\ItsLabel\ItsTV
C:\Documents and Settings\berlandis\Application Data\ItsLabel\ItsTV\itsTV.xml

+-----------------------| Sweetim Elements found :

.
HKCU\SOFTWARE\SWEETIE
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
HKLM\SOFTWARE\Macrogaming
HKLM\~\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\~\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\Program Files\Macrogaming
C:\Program Files\Macrogaming\SweetIM
C:\Program Files\Macrogaming\SweetIM\conf
C:\Program Files\Macrogaming\SweetIM\data
C:\Program Files\Macrogaming\SweetIM\conf\users
C:\Program Files\Macrogaming\SweetIM\conf\users\lol_3818@hotmail.fr
C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\turquoise37@hotmail.fr
C:\Program Files\Macrogaming\SweetIM\conf\users\lol_3818@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lol_3818@hotmail.fr\lastuse_SpecialFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lol_3818@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\turquoise37@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\turquoise37@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\data\contentdb
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010859.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020158.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\01050001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\01050002.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat

+-----------------------| ADDED SCAN :


+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

..\r43dkw3q.default\prefs.js :

~~~~ Mozilla FireFox version [Unable to get version] ~~~~

* Browser Search Default Engine: "Yahoo"
* Browser Search Selected Engine: "Yahoo"
* Browser Search Default Url: "https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl"
* Browser Startup HomePage: "http://eo.st"

.
FOUND -user_pref("browser.startup.homepage", "http://eo.st");

+---------------------------------------------------------------------------+


+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://google.com/

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://www.msn.com/

+---------------------------------------------------------------------------+

[~5035 bytes] - "C:\AD-report-Scan-07.01.2009.log"

# END at: 22:13:24 | 07/01/2009 - Time elapsed: 46.8 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 95 lines ]
+---------------------------------------------------------------------------+

hello, qd je coche les cases indiquées, 2,4,5,6 puis S, il ne se passe rien!!

Bonsoir cher V-X, depuis hier je m'applique à suivre ts les protocoles que vous m'adressez. Vous continuez à m'en conseiller d'autres...Y-en-at-il encore bcp?? Quels seront les sites que j'ai enregistrés pour stopper l'infection que je dois continuer à garder ou virer?MERCI

Temps écoulé: 2 hour(s), 42 minute(s), 23 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\WinPCDoctor (Rogue.WinPCDoctor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\WinAnonymous (Rogue.WinAnonymous) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explsbsm.exelper Objects (Trojan.Zlob) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\WINDOWS\system32\215651 (Trojan.BHO) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:45:25, on 09/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Film Up] C:\DOCUME~1\LAURA\APPLIC~1\PLANBI~1\SOFTWINBUILD.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-1008\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray (User 'LAURA')
O4 - HKUS\S-1-5-21-1374290520-151700281-2192659466-501\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Invité')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/43.10/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://turquoise37.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://express.foto.com/ImageUploader5.cab
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1230838878778&h=9d7f19b45b3ed7e9fb33cfcd8bb6a34f/&filename=jinstall-6u11-windows-i586-jc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFUploader/SpeedUploader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

bonjour, je ne comprends pas rien ne se passe avec cette manip. AD-REMOVER. Et je ne trouve rien d'enregistrer ds le disqueC....A+. ENORME MERCI pour votre aide.

info.txt logfile of random's system information tool 1.05 2009-01-10 16:13:42

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->Dummy
-->MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5AAFE9B0-B60B-4B12-B22D-6B15507502E5}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{61FB6DAF-197D-4404-A58D-B75268F35D01}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{61FB6DAF-197D-4404-A58D-B75268F35D01}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88E5FCB8-5F25-11D5-B16F-0800460222F0}\setup.exe" -l0x40c UNINSTALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C679B41F-EE6E-4727-B131-47101785420A}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D76298C2-E532-4A11-BCFF-76F3F19DA84D}\setup.exe" UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 4.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 4.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 4.0\NT\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Product/Adobe Studio Update 10/2001-->"C:\Program Files\InstallShield Installation Information\{73006B34-9743-4A39-AC37-38EDFCEB6DCE}\setup.exe"
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
Ad-remover-->C:\Program Files\Ad-remover\Uninstal.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ArcSoft Camera Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AD708DF0-9F04-4CB3-821A-85804A833B4D}\setup.exe" -l0x40c -uninst
Ask Toolbar-->rundll32 C:\PROGRA~1\AskTBar\bar\1.bin\AskTBar.dll,O
Assistant de configuration Tiscali-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BE7C4D88-0B31-4668-B533-15BDAC5EAA0F}\setup.exe" -l040c -ct35x
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
CANON iMAGE GATEWAY Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{5B03B93F-1B32-4509-9CA6-4BB33E9987EF}
Canon MP Drivers 7.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D335AC77-6F59-46D6-9082-F74A9F7E0FC3}\Setup.exe" -l0x40c -Uninstall
Canon ScanGear Starter-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}\setup.exe" -l0x40c anything
Canon Utilities PhotoStitch 3.1-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}
Canon ZoomBrowser EX (F)-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Creative MuVo N200 Media Explorer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C679B41F-EE6E-4727-B131-47101785420A}\setup.exe" -l0x40c /remove
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Free Easy Burner V 3.8-->"C:\Program Files\Free Easy Burner\unins000.exe"
getPlus(R)_dll-->rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSd.INF, DefaultUninstall
HardwareDetection-->"C:\Program Files\HardwareDetection\Uninstall.exe" "C:\Program Files\HardwareDetection\install.log" -u
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
IGN Rando-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll<UNINSTALL_CMD>
IGN Rando-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll<UNINSTALL_CMD>
Intel(R) Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
Intel(R) PROSet for Wired Connections-->MsiExec.exe /I{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}
iTunes-->MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java 2 Runtime Environment, SE v1.4.2_03-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 CD-ROM 2-->MsiExec.exe /I{0004040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office 2000 Professional-->MsiExec.exe /I{0001040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office 2000 Small Business-->MsiExec.exe /I{0003040C-78E1-11D2-B60F-006097C998E7}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Works 7.0-->MsiExec.exe /I{64D114CE-4234-45C2-B60A-2B07D5A48F72}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
MSN Pictures Displayer 4.6-->"C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe" /U
MSXML 4.0 SP2 (KB925672)-->MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MuVo Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5AAFE9B0-B60B-4B12-B22D-6B15507502E5}\setup.exe" -l0x40c /remove
Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E916E61F-DE9D-4EAF-91E1-CEB50016326A}
Navilog1 3.7.1-->"C:\Program Files\Navilog1\unins000.exe"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OmniPage SE-->MsiExec.exe /I{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
PSPad editor-->"C:\Program Files\PSPad editor\Uninst\unins000.exe"
QuickTime-->MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
Registry Mechanic 8.0-->"C:\Program Files\Registry Mechanic\unins000.exe" /Log
SA31xx Device Manager & Media Converter-->C:\Program Files\InstallShield Installation Information\{E572B060-C98B-4984-A48E-E4FA56265903}\setup.exe -runfromtemp -l0x040c -removeonly
Search Settings 1.2-->MsiExec.exe /X{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Shareaza version 2.2.5.0-->"C:\Program Files\Shareaza\Uninstall\unins000.exe"
Sonic MyDVD-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
SonicStage 3.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A0EB195B-5876-48E6-879D-33D4B2102610}\setup.exe" -l0x40c UNINSTALL -removeonly
SpamExtract-->C:\Program Files\SpamExtract\Uninstall.exe
Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Tiscali ADSL - Installation principale-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CE5D7CE8-27E7-4452-AF33-F38F074BBD08}\setup.exe" -l0x40c -eth -pri
Tiscali Internet-->MsiExec.exe /I{58B2B6D3-E5FF-4D16-87AC-52CC5717C7C6}
VideoLAN VLC media player 0.8.6a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
ViewSonic Monitor Drivers-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B4FEA924-630D-11D4-B78E-005004566E4D}\Setup.exe" -l0x9
VSO Image Resizer 1.0.11-->"C:\Program Files\VSO\Image Resizer\unins000.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Mail-->MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Hosts File======

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

======Security center information======

AV: avast! antivirus 4.8.1296 [VPS 090109-0]

System event log

Computer Name: D8HM0L1J
Event Code: 7036
Message: Le service ASKService est entré dans l'état : arrêté.

Record Number: 9600
Source Name: Service Control Manager
Time Written: 20081226134359.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 7036
Message: Le service Service Messenger Sharing Folders USN Journal Reader est entré dans l'état : en cours d'exécution.

Record Number: 9599
Source Name: Service Control Manager
Time Written: 20081226133720.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service Messenger Sharing Folders USN Journal Reader.

Record Number: 9598
Source Name: Service Control Manager
Time Written: 20081226133720.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: D8HM0L1J
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 9597
Source Name: Service Control Manager
Time Written: 20081226133421.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 9596
Source Name: Service Control Manager
Time Written: 20081226133421.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

Application event log

Computer Name: D8HM0L1J
Event Code: 301
Message: msnmsgr (1328) \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\fsr04598.log.

Record Number: 23076
Source Name: ESENT
Time Written: 20081219080012.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 301
Message: msnmsgr (1328) \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\fsr04597.log.

Record Number: 23075
Source Name: ESENT
Time Written: 20081219080012.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 301
Message: msnmsgr (1328) \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\fsr04596.log.

Record Number: 23074
Source Name: ESENT
Time Written: 20081219080012.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 301
Message: msnmsgr (1328) \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\fsr04595.log.

Record Number: 23073
Source Name: ESENT
Time Written: 20081219080011.000000+000
Event Type: Informations
User:

Computer Name: D8HM0L1J
Event Code: 301
Message: msnmsgr (1328) \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\berlandis\Local Settings\Application Data\Microsoft\Messenger\turquoise37@hotmail.fr\SharingMetadata\Working\database_D4C8_1099_C810_7C44\fsr04594.log.

Record Number: 23072
Source Name: ESENT
Time Written: 20081219080011.000000+000
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\FICHIE~1\SONICS~1\;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

-----------------EOF-----------------



"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98fbf3d9-0cf8-11dc-a204-0030da4942de}]
shell\Auto\command - tel.xls.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe


======List of files/folders created in the last 1 months======

2009-01-10 16:13:23 ----DC---- C:\rsit
2009-01-08 19:20:15 ----D---- C:\Documents and Settings\berlandis\Application Data\Malwarebytes
2009-01-08 19:20:02 ----DC---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-01-08 19:20:02 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-07 22:11:38 ----D---- C:\Program Files\Ad-remover
2009-01-07 21:24:52 ----AC---- C:\TB.txt
2009-01-07 21:24:03 ----DC---- C:\ToolBar SD
2009-01-07 19:37:35 ----AC---- C:\cleannavi.txt
2009-01-07 17:15:53 ----A---- C:\WINDOWS\system32\aswBoot.exe
2009-01-07 16:32:14 ----AC---- C:\fixnavi.txt
2009-01-07 16:26:46 ----D---- C:\Program Files\Navilog1
2009-01-03 15:53:42 ----D---- C:\Documents and Settings\berlandis\Application Data\Inkscape
2009-01-03 15:36:43 ----D---- C:\Program Files\Inkscape
2008-12-28 17:16:05 ----DC---- C:\HP
2008-12-28 17:15:44 ----DC---- C:\temp
2008-12-25 21:31:55 ----DC---- C:\Downloads
2008-12-25 20:44:24 ----DC---- C:\Documents and Settings\All Users\Application Data\Azureus
2008-12-25 20:44:04 ----D---- C:\Documents and Settings\berlandis\Application Data\Azureus
2008-12-25 20:43:04 ----D---- C:\Program Files\Vuze
2008-12-24 10:48:45 ----A---- C:\WINDOWS\system32\javaws.exe
2008-12-24 10:48:45 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-12-24 10:48:44 ----A---- C:\WINDOWS\system32\javaw.exe
2008-12-24 10:48:44 ----A---- C:\WINDOWS\system32\java.exe
2008-12-12 22:38:13 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-12 22:35:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-12 22:35:47 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-12 22:35:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

======List of files/folders modified in the last 1 months======

2009-01-10 16:13:04 ----D---- C:\WINDOWS\Prefetch
2009-01-10 16:07:41 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-01-10 16:07:31 ----AD---- C:\WINDOWS
2009-01-10 16:05:11 ----D---- C:\WINDOWS\Temp
2009-01-10 08:12:34 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-01-09 19:57:57 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-09 07:50:22 ----D---- C:\WINDOWS\system32\drivers
2009-01-09 07:48:03 ----AD---- C:\WINDOWS\system32
2009-01-08 19:20:02 ----AD---- C:\Program Files
2009-01-08 18:19:15 ----SHD---- C:\WINDOWS\Installer
2009-01-08 18:19:15 ----DC---- C:\Config.Msi
2009-01-07 21:37:55 ----RSD---- C:\WINDOWS\Fonts
2009-01-07 17:13:34 ----D---- C:\WINDOWS\system32\CatRoot2
2009-01-06 19:38:11 ----SD---- C:\Documents and Settings\berlandis\Application Data\Microsoft
2009-01-06 19:38:11 ----D---- C:\Program Files\Fichiers communs
2009-01-06 19:38:05 ----D---- C:\Program Files\Lavasoft
2009-01-04 21:08:38 ----D---- C:\Program Files\eMule
2009-01-03 19:48:35 ----D---- C:\Program Files\Google
2009-01-03 19:48:31 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-01-03 17:08:32 ----D---- C:\WINDOWS\Help
2009-01-03 15:55:45 ----D---- C:\Documents and Settings\berlandis\Application Data\gtk-2.0
2009-01-02 17:23:53 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-01-02 11:59:15 ----D---- C:\i386
2009-01-02 11:50:18 ----HD---- C:\WINDOWS\inf
2009-01-02 11:48:39 ----D---- C:\WINDOWS\system32\IOSUBSYS
2009-01-02 10:01:55 ----D---- C:\WINDOWS\system32\Macromed
2008-12-30 09:20:28 ----D---- C:\Program Files\Power IE
2008-12-28 17:59:26 ----A---- C:\WINDOWS\win.ini
2008-12-28 17:37:23 ----D---- C:\Program Files\Yahoo!
2008-12-28 17:17:40 ----RSHD---- C:\WINDOWS\system32\dllcache
2008-12-28 17:17:26 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-12-27 09:45:16 ----D---- C:\WINDOWS\system
2008-12-27 09:45:16 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2008-12-27 09:44:33 ----D---- C:\Program Files\Java
2008-12-24 14:41:20 ----D---- C:\Documents and Settings\berlandis\Application Data\Canon
2008-12-21 10:46:30 ----D---- C:\Program Files\Circle Developement
2008-12-21 09:41:06 ----D---- C:\Documents and Settings\All Users\Application Data\each new axis love
2008-12-18 22:04:13 ----D---- C:\WINDOWS\ie7updates
2008-12-18 22:03:11 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-14 14:35:43 ----D---- C:\Documents and Settings\berlandis\Application Data\Vso
2008-12-14 08:21:26 ----D---- C:\Program Files\DivX
2008-12-13 09:13:26 ----D---- C:\WINDOWS\Debug
2008-12-13 06:37:56 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-12 22:37:57 ----D---- C:\Program Files\Internet Explorer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-11-26 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-11-26 111184]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-11-26 50864]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-11-26 94032]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-11-26 23152]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-01-31 22016]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2005-01-31 211712]
R3 Ps2;PS2; C:\WINDOWS\system32\DRIVERS\PS2.sys [2005-12-12 19072]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-10-29 260096]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 BthEnum;Service d'énumérateur Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Pilote de port Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272768]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 catchme;catchme; \??\C:\DOCUME~1\BERLAN~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\HardwareDetection\driverhardwarev2.sys []
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 QCMerced;Logitech QuickCam Communicate; C:\WINDOWS\system32\DRIVERS\LVCM.sys []
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2008-04-13 12800]
S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtre de bus AGP Intel; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Filtre de bus AGP Compaq; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;Filtre de bus AGP ALI; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;Pilote de filtre du bus AMD AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 sisagp;Filtre de bus AGP SIS; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;Filtre de bus AGP VIA; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-11-26 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-11-26 155160]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-24 152984]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-03-12 517768]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-11-26 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-11-26 352920]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-15 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 iPod Service;Service de l'iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-02-19 504104]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2003-12-17 143360]
S3 SSScsiSV;SonicStage SCSI Service; C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe [2005-01-24 69632]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]

-----------------EOF-----------------

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\TB.txt: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\berlandis\Bureau\HijackThis.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\berlandis\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\WINDOWS\msnfix.txt: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !