Avast apl win 3 non valide

Question

Bonjour,
j'ai lu sur plusieurs forums les causes de ce problème, c'est en voulant ouvrir un crack que celui ci est apparu.
Je me permet de vous envoyer mon raport Findykill que je vien de creer de suite.

Merci de me repondre afin d'erradiquer ce problème qui est tres genent.
(PC qui rame, impossible d'utiliserr avast et d'autres programmes...)
je vous remerci d'avance pour votre super boulo.
Cordialement boulito

----------------- FindyKill V4.711 ------------------

* User : Boulitoplay - BOULITO
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 05/01/09 par Chiquitine29
* Recherche effectuée à 21:12:02 le 06/01/2009
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

Found ! [06/01/2009 20:20] - C:\InfoSat.txt

»»»» Presence des fichiers dans C:\WINDOWS

»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\100375.EXE-1CCFAEAD.pf
Found ! - C:\WINDOWS\prefetch\129656.EXE-089FF499.pf
Found ! - C:\WINDOWS\prefetch\327743125.EXE-3B087373.pf
Found ! - C:\WINDOWS\prefetch\327796953.EXE-200D49EA.pf
Found ! - C:\WINDOWS\prefetch\356968.EXE-0AFFEEF8.pf
Found ! - C:\WINDOWS\prefetch\399781.EXE-2A49FD89.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-22B33FC6.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-0EF461CE.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-0C2E7796.pf
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-398876F9.pf
Found ! - C:\WINDOWS\Prefetch\KEY_GENERATOR.EXE-133CF9E5.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [06/01/2009 20:04] - C:\WINDOWS\system32\mdelk.exe
Found ! [06/01/2009 20:04] - C:\WINDOWS\system32\wintems.exe

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

Found ! [18/10/2008 15:18] - "C:\WINDOWS\system32\drivers\downld"

»»»» Presence des fichiers dans C:\Documents and Settings\Boulitoplay\Application Data

Found ! [06/01/2009 20:06] - "C:\Documents and Settings\Boulitoplay\Application Data\m\flec006.exe"
Found ! [06/01/2009 20:15] - "C:\Documents and Settings\Boulitoplay\Application Data\m\shared"
Found ! [06/01/2009 20:19] - "C:\Documents and Settings\Boulitoplay\Application Data\m"
Found ! [06/01/2009 20:01] - "C:\Documents and Settings\Boulitoplay\Application Data\drivers"
Found ! [06/01/2009 21:03] - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\srosa.sys"
Found ! [06/01/2009 21:03] - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\srosa2.sys"
Found ! [09/08/2006 08:04] - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\winupgro.exe"
Found ! [06/01/2009 20:15] - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\downld"

»»»» Presence des fichiers dans C:\DOCUME~1\BOULIT~1\LOCALS~1\Temp

»»»» Presence des fichiers dans C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5

Found ! [06/01/2009 20:03] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\2C8R8SHG\mxd[1].jpg
Found ! [06/01/2009 20:01] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\8DA157R8\b64_3[1].jpg
Found ! [06/01/2009 20:14] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\9C37YGBM\b64_5[1].jpg
Found ! [06/01/2009 20:04] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\K802S3CG\b64_3[1].jpg
Found ! [06/01/2009 20:02] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\NTEH5N1T\b64[1].jpg
Found ! [06/01/2009 20:15] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\NTEH5N1T\b64_2[1].jpg
Found ! [06/01/2009 20:13] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\NTEH5N1T\servernames[1].htm
Found ! [06/01/2009 20:06] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\YBS3API3\b64[1].jpg
Found ! [06/01/2009 20:05] - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\YBS3API3\b64_1[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
Sensiva="C:\Program Files\Sensiva, Inc\Symbol Commander Pro\Sensiva.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz=nwiz.exe /install
NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
snpstd=C:\WINDOWS\vsnpstd.exe
\\ORDIBAS\EPSON Stylus CX6600 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P36 "\\ORDIBAS\EPSON Stylus CX6600 Series" /O6 "USB001" /M "Stylus CX6600"
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

[HKEY_CURRENT_USER\software\local appwizard-generated applications\key_generator]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\Sensiva]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\serial]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------

Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\Local AppWizard-Generated Applications\key_generator
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\Local AppWizard-Generated Applications\serial
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_generator
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\serial
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR

/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

/!\ Mode sans echec non fonctionnel !!

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Lecteur fixe

E: - Lecteur amovible

H: - Lecteur fixe

I: - Lecteur fixe

+- presence des fichiers :

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------

Configuration: Windows XP
Internet Explorer 7.0

jlpjlp · Answer

slt
vire tes cracks

puis

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 2 (Suppression)

/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage effectué"

/!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal !

-------> ensuite post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides

________________________

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau
sous le nom de antibagle. Fais le avant que le fichier ne soit enregistré sur le bureau]

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

________________________________

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

Utilisateur anonyme · Answer

Salut ,

jutes pour suivre merci

boulito · Answer

Merci pour votre rapidite!
Voici le rapport findykill que je vien de faire avec l'optino N°deux.



Je vous envoi dans quelques minutes les deux autres raports.
Cordialement, Boulito.



----------------- FindyKill V4.711 ------------------

* User : Boulitoplay - BOULITO
* executed from : C:\Program Files\FindyKill
* Update on 05/01/09 par Chiquitine29
* Start at 21:50:39 the 06/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\alg.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
Deleted ! - C:\InfoSat.txt  
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
Deleted ! - C:\WINDOWS\prefetch\100375.EXE-1CCFAEAD.pf 
Deleted ! - C:\WINDOWS\prefetch\129656.EXE-089FF499.pf 
Deleted ! - C:\WINDOWS\prefetch\327743125.EXE-3B087373.pf 
Deleted ! - C:\WINDOWS\prefetch\327796953.EXE-200D49EA.pf 
Deleted ! - C:\WINDOWS\prefetch\356968.EXE-0AFFEEF8.pf 
Deleted ! - C:\WINDOWS\prefetch\399781.EXE-2A49FD89.pf 
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-22B33FC6.pf 
Deleted ! - C:\WINDOWS\prefetch\KEY_GENERATOR.EXE-133CF9E5.pf 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-0EF461CE.pf 
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf 
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-0C2E7796.pf 
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-398876F9.pf 
 
»»»» Supression files in C:\WINDOWS\system32 
 
Deleted ! - C:\WINDOWS\system32\mdelk.exe  
Deleted ! - C:\WINDOWS\system32\wintems.exe  
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
Deleted ! - "C:\WINDOWS\system32\drivers\downld"  
 
»»»» Supression files in C:\Documents and Settings\Boulitoplay\Application Data 
 
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\m\flec006.exe"  
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\1-ACT Hard Disk Monitor 2006 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\3D Shape Shifter Screensaver 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Abo Sabreen Messenger 2.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\ACCESS Dictionary French English 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Acronis Power Utilities 2005.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Animated Indian Corn Cursor.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Ardoise 1.13.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Ascendant NFM 1.50.07.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\ASnumber 1.0-Beta-9.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Atomic Windows Messenger Password Recovery 1.10.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Audio Arpeggiator 1.20.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Audio DVD Creator 1.9.1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\avast!.Professional.Edition.4.7.817.PL.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\AVG Free Edition 8.0 Build 176a1400.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Bakefile 0.2.3.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\BBC Headline News 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\BySoft Network Monitor 1.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Cabbage Soup Diet 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Cards Plus 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Champions League BetWidget 1.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Classic Delay 1.03.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Classic Memory 1.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Claves.Para.Panda.2007.By.Xio.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Copy Link Text 1.3.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Cortona ScreenSaver 2.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\CVS filter 1.56.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\DailyPim 4.06.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Describer 5.4.3.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\DrillBoard 1.0.0.9.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\DriverMagic 1.1.4.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\e-find-in-files-addon 1.08.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Easy Morph 1.61.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Excel Remove (Break) File Links In Multiple Files Software 7.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Excel Save Each Row or Column As Text File Software 7.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\EyeSoft 2.2.8.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Fancy Goldfish 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\FastWebSlideShow 2.03.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Fat Tail Option Calculator 1.0.0.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\FathMail 4.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\FIBS Firebird-Interbase Backup Scheduler 2.0.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Flying Logic Student 1.0.4.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Ford Mustang Screensaver 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Game Speed Adjuster 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\GenVCProjectCleaner 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Glassy Run 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Host File Manager 2.0.0.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\HTML Book Maker 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\iAdmin Mobile 3.6.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\IBPTime 1.50.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\iimmgg.com Tools 1.0.6.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Imagen 3.0.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\IpUpload 1.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Iris 4.00.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Join MPG Moviez 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\jTokeniser 2.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\KGB'secrets (AMUCE) 1.5.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Kill Win 2.1.9.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\KingConvert For HTC Advantage x7510 4.0.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Koch Alarm Timer 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Letter Chase Speed Reader 1.3.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\liveDJpro Crimson Edition 1.4.595.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\LOCKDOWN 1.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\LordsPrayer 1.0.0.27.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\MagicDisc 2.5.71.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\MConvert 7.4.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Microsoft Forefront Client Security Evaluation Edition.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Moderal Jukebox 1.02.1103.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\MSD Collections Multiuser 2.20.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Netsky.C Remover 3.5.1.11.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\NetStatus 2.3.1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Newline Remover 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\NOD32.2.70.26.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Norton_utilities_2006_www.programasfull.com.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\NumLock 1.01.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Official Signs 4 Icon Collection 1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Opell Video to Apple TV Converter 2.1.15.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Orbit Xplorer 2.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Outpost Firewall Free v1.0.1817.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Parabuild 3.1.11.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Password Reminder 1.5.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Peak Explorer 2.11.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Perfect Macro Recorder 1.50.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Photozig Albums 1.0 build 293.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Planet Quest 4.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\PopUp Burner 1.00.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Portable Driver Magician Lite 3.45.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Portable Flicka 2.0.0.5.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\PowerTCP Emulation Tool 1.8.4.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\PresentaVid 1.4.0.2470.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Professor Teaches Office Super Set 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Protect Files Pro 3.7 Build 3.7.1.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\pSX Emulator 1.11.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\QFM Player 3.0.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\RegexBuilder 1.3.0.38852.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\ReHash 0.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Rosary 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\RosterEdge 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\RSS Popper 0.36b.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Run Service ActiveX 2.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Scanlines Effect 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Search and Replace 5.5.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Shape Name Utility 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\SimpleNotes 0.4.7.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\SMR Codec 4.1.00.3920.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Spongy 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Spytech SpyLock 4.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Statusdate 1.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\StayInformed 1.3.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Tigers Screensaver.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Time Adjuster 3.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\TSIG Key Generator 1.00.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\TypingQueen 6.2.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Underwater Screensaver 3.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\UNIT CONVERSION 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Vertabase Timer 1.5.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\VocabGuru 2006 3.0.46 Build 46.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Voiced Keyboard 3.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\W32.Korgo Removal Tool 1.0.5.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\WAP Uploader 1.00.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Web Gallery Wizard Pro 1.5.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Win-ProLi 1.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\WinACCESS 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\WinAgents MIB Browser 1.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\Windows Live Messenger Khalid Edition 2008 5.5 Build 1000.10.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\WireFusion 3D 2.0.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\XanTorrent 0.1.zip 
Deleted ! - C:\Documents and Settings\Boulitoplay\Application Data\m\shared\[SafeApps]McAfee.VirusScan.Professional.2007.10.0.27.zip 
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\m\shared"  
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\m"  
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\srosa.sys"  
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\srosa2.sys"  
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\winupgro.exe"  
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\drivers\downld"  
Deleted ! - "C:\Documents and Settings\Boulitoplay\Application Data\drivers"  
 
»»»» Supression files in C:\DOCUME~1\BOULIT~1\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\2C8R8SHG\mxd[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\8DA157R8\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\9C37YGBM\b64_5[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\K802S3CG\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\NTEH5N1T\b64[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\NTEH5N1T\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\NTEH5N1T\servernames[1].htm    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\YBS3API3\b64[1].jpg    
Deleted ! - C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\YBS3API3\b64_1[1].jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_CURRENT_USER\Software\FirtR   
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdelk.exe   
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintems.exe   
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flec006.exe   
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hldrrr.exe   
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winfilse.exe   
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupgro.exe   
Deleted ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\Local AppWizard-Generated Applications\key_generator   
Deleted ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\Local AppWizard-Generated Applications\serial   
Deleted ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\FFC   
Deleted ! - HKEY_USERS\S-1-5-21-1708537768-1993962763-725345543-1004\Software\MuleAppData   
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

Ndisuio - Type of startup  = 3 
 
EapHost - Type of startup  = 2 
 
Ip6Fw - Type of startup  = 2 
 
SharedAccess - Type of startup  = 2 
 
wuauserv - Type of startup  = 2 
 
wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

E: - Lecteur amovible

H: - Lecteur fixe

I: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Other Infections ] ----------------  
 
 
Références de comparaison Bagle MD5 :

113ac36b77630a2f67dd6cb7844406a4  C:\WINDOWS\system32\mdelk.exe 
113ac36b77630a2f67dd6cb7844406a4  C:\WINDOWS\system32\wintems.exe 
d532a42b8f3f3787529bfe86d6cf5f02  C:\Documents and Settings\Boulitoplay\Application Data\drivers\winupgro.exe 

Suspect ! - d532a42b8f3f3787529bfe86d6cf5f02  C:\Program Files\Sensiva, Inc\Symbol Commander Pro\Sensiva.exe  
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\Boulitoplay\Recent\! Microsoft Office 2007 Crack-Serial-Keygen.lnk
C:\Documents and Settings\Boulitoplay\Recent\Crack.lnk
 
 
---------------- ! End of report ! ------------------

boulito · Answer

Voici le rapport combofix (sachez que je n'ai toujours pas pu ouvrir avast car le problème perciste)
Windows m'informe que ej cour un risque car aucun antivirus n'est actif mais je ne peut toujours pas ouvrir et utiliser avast...

ComboFix 09-01-05.05 - Boulitoplay 2009-01-06 22:01:55.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1535.1167 [GMT 1:00]
Lancé depuis: c:\documents and settings\Boulitoplay\Bureau\antibagle.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Sensiva, Inc\Symbol Commander Pro\Sensiva.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-06 au 2009-01-06 ))))))))))))))))))))))))))))))))))))
.

2009-01-06 21:11 . 2009-01-06 21:53 <REP> d-------- c:\program files\FindyKill
2009-01-06 20:27 . 2009-01-06 20:30 <REP> d-------- C:\toto
2009-01-06 19:56 . 2009-01-06 19:57 <REP> d-------- c:\documents and settings\Boulitoplay\Application Data\CopyTrans
2009-01-05 15:09 . 2009-01-05 15:11 180,811,040 --a------ C:\France 3 national - Strip-tease - 23-08-2008 22h55 1h05m.ts
2009-01-05 15:02 . 2009-01-05 15:02 <REP> d-------- c:\program files\FileZilla FTP Client
2009-01-05 15:02 . 2009-01-05 15:39 <REP> d-------- c:\documents and settings\Boulitoplay\Application Data\FileZilla
2009-01-02 17:51 . 2009-01-02 17:51 <REP> d-------- c:\documents and settings\Boulitoplay\Application Data\CopyTransPhoto
2009-01-02 17:51 . 2009-01-02 17:51 <REP> d-------- c:\documents and settings\Boulitoplay\Application Data\CopyTransManager
2009-01-02 17:49 . 2009-01-02 17:49 <REP> d-------- c:\program files\WindSolutions
2009-01-02 17:49 . 2009-01-02 17:49 <REP> d-------- c:\documents and settings\Boulitoplay\Application Data\CopyTransControlCenter
2009-01-02 17:49 . 2009-01-02 17:49 <REP> d-------- c:\documents and settings\All Users\Application Data\CopyTransControlCenter
2008-12-28 01:41 . 2008-12-28 01:41 <REP> d-------- c:\program files\RealVNC
2008-12-26 18:06 . 2001-08-17 21:56 7,552 --a------ c:\windows\system32\drivers\SONYPVU1.SYS
2008-12-26 18:06 . 2001-08-17 21:56 7,552 --a--c--- c:\windows\system32\dllcache\sonypvu1.sys
2008-12-24 02:35 . 2008-12-24 02:45 <REP> d-------- c:\documents and settings\Boulitoplay\Application Data\Apple Computer
2008-12-24 02:34 . 2008-12-24 02:34 <REP> d-------- c:\program files\iTunes
2008-12-24 02:34 . 2008-12-24 02:34 <REP> d-------- c:\program files\iPod
2008-12-24 02:34 . 2008-12-24 02:34 <REP> d-------- c:\program files\Bonjour
2008-12-24 02:34 . 2008-12-24 02:34 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-24 02:34 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-24 02:34 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-24 02:33 . 2008-12-24 02:34 <REP> d-------- c:\program files\QuickTime
2008-12-24 02:33 . 2008-12-24 02:33 <REP> d-------- c:\program files\Apple Software Update
2008-12-24 02:33 . 2008-12-24 02:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-24 02:05 . 2008-12-24 02:34 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-24 02:05 . 2008-12-24 02:05 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-12-24 02:05 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-24 01:25 . 2008-04-14 04:33 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-24 01:25 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-12-10 11:50 . 2008-12-10 11:51 1,393 --a------ c:\windows\imsins.BAK

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 10:52 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-24 22:14 --------- d-----w c:\program files\VDOWNLOADER
2008-11-19 02:02 --------- d-----w c:\program files\HyCam2
2008-11-17 16:48 --------- d-----w c:\documents and settings\Boulitoplay\Application Data\SecondLife
2008-11-14 13:22 182,384 ----a-w c:\windows\system32\PnkBstrB.exe
2008-11-14 13:22 137,272 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-13 06:53 --------- d-----w c:\program files\Lx_cats
2008-11-12 21:44 --------- d-----w c:\documents and settings\Boulitoplay\Application Data\Lexmark Productivity Studio
2008-10-30 21:30 72,192 ----a-w c:\windows\system32\tasklist.exe
2008-10-25 01:05 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:18 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sensiva"="c:\program files\Sensiva" [X]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-01-06 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"snpstd"="c:\windows\vsnpstd.exe" [2005-10-11 339968]
"\\ORDIBAS\EPSON Stylus CX6600 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE" [2004-03-01 98304]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Rappels du Calendrier Microsoft Works.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Rappels du Calendrier Microsoft Works.lnk
backup=c:\windows\pss\Rappels du Calendrier Microsoft Works.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Boulitoplay^Menu Démarrer^Programmes^Démarrage^Enregistrement de FIFA 09.lnk]
path=c:\documents and settings\Boulitoplay\Menu Démarrer\Programmes\Démarrage\Enregistrement de FIFA 09.lnk
backup=c:\windows\pss\Enregistrement de FIFA 09.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 01:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-08-08 13:11 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2007-04-16 14:28 577536 c:\windows\soundman.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"i:\\Téléchargement\\eMule\\emule.exe"=
"i:\\Téléchargement\\BitComet\\BitComet.exe"=
"i:\\jeux\\Wolfenstein - Enemy Territory\\ET.exe"=
"i:\\jeux\\Wolfenstein - Enemy Territory\\ETDED.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"i:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Program Files\\GameSpy\\Comrade\\Comrade.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"i:\\jeux\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"37028:TCP"= 37028:TCP:Emule TCP
"37038:UDP"= 37038:UDP:Emule udp
"1234:TCP"= 1234:TCP:bitco tcp
"1234:UDP"= 1234:UDP:bitco udp
"8080:TCP"= 8080:TCP:vla
"5900:TCP"= 5900:TCP:vnc
"5900:UDP"= 5900:UDP:vnc

R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2008-10-27 33792]
R4 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
S1 aswSP;avast! Self Protection; [x]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-07-25 191656]
S3 XPADFL02;XPAD Filter Service 02;c:\windows\system32\drivers\xPADFL02.sys [2008-10-27 27904]
S4 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - EAPHOST
*NewlyCreated* - IP6FW

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adb87b1e-75ca-11dd-a727-0014854d180b}]
\Shell\AutoRun\command - jfvkcsy.bat
\Shell\explore\Command - jfvkcsy.bat
\Shell\open\Command - jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8158f90-ac00-11dd-a74f-0014854d180b}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e
\Shell\Open\command - Boot.exe e
.
Contenu du dossier 'Tâches planifiées'

2009-01-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-sglfb.sys
SafeBoot-tga.sys
SafeBoot-wd.sys
SafeBoot-sacsvr

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - i:\téléchargement\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - i:\téléchargement\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - i:\téléchargement\BitComet\BitComet.exe/AddAllLink.htm

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_5.cab
c:\windows\Downloaded Program Files\hardwaredetection.inf

c:\windows\Downloaded Program Files\GoPetsWeb.ocx - O16 -: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8}
hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
c:\windows\Downloaded Program Files\GoPetsWeb.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 22:02:45
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-01-06 22:04:01
ComboFix-quarantined-files.txt 2009-01-06 21:03:28

Avant-CF: 8 313 257 984 octets libres
Après-CF: 8,467,730,432 octets libres

185 --- E O F --- 2008-12-17 19:11:48

Je vous envoi de suite le dernier raport "rsit".

Cordialement, Boulito.

boulito · Answer

Voici dans un premier temps le fichier "info" et ensuite le "log"



info.txt logfile of random's system information tool 1.05 2009-01-06 22:09:45

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AMD Processor Driver-->C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x040c -removeonly
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
BitComet 1.04-->I:\Téléchargement\BitComet\uninst.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Ciel Business Plan-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4A31ABB-229F-4922-8499-4731B0A0A2AD}\Install.exe" 
CopyTrans Suite (remove only)-->"C:\Program Files\WindSolutions\CopyTrans Suite\uninstall.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"I:\Téléchargement\eMule\Uninstall.exe"
Eurobarre-->"C:\WINDOWS\Eurobarre\uninstall.exe" "/U:C:\Program Files\Eurobarre\Uninstall\uninstall.xml"
EVEREST Ultimate Edition v4.50-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
FIFA 09-->MsiExec.exe /X{2315B23D-3E21-4920-837D-AE6460934ECB}
FileZilla Client 3.1.6-->C:\Program Files\FileZilla FTP Client\uninstall.exe
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
Frets On Fire-->"C:\Program Files\Frets on Fire\Uninstall.exe"
GameSpy Comrade-->MsiExec.exe /X{7C2E4E9B-0B88-48B6-B7B0-E3F3DF0A239D}
Haali Media Splitter-->"C:\Program Files\Haali\MatroskaSplitter\uninstall.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HyperCam 2-->"C:\Program Files\HyCam2\UnHyCam2.exe"
IKEA Home Planner-->MsiExec.exe /I{A987FEC8-5616-49BD-BCA6-ACFFFE7403FE}
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
K-Lite Codec Pack 4.1.4 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lanceur du programme d'installation de Microsoft Works 2000 -->C:\Program Files\Microsoft Works Suite 2000\Setup\Launcher.exe D:\
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LibUSB-Win32-0.1.10.1-->"C:\Program Files\LibUSB-Win32-0.1.10.1\unins000.exe"
Ma-Config.com-->MsiExec.exe /X{CFF24C43-9C46-4044-9C54-A4D98A3A25FB}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Picture It! 2000-->MsiExec.exe /I{E78FC917-C21B-11D2-99FE-00105A98B681}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works 2000-->MsiExec.exe /I{A3088CD2-612B-11D3-AF43-00C04F443448}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero 6 Ultra Edition-->C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL
NVIDIA Drivers-->C:\WINDOWS\system32
vudisp.exe UninstallGUI
Odebit Multimédia V3.2-->"C:\Program Files\Odebit Multimédia\V3.2\unins000.exe"
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Photorécit 3 pour Windows-->MsiExec.exe /I{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}
PLAYSTATION(R)Network Downloader-->MsiExec.exe /X{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}
Pro Evolution Soccer 2009-->MsiExec.exe /X{A8DB611A-D80E-450D-85F6-3ACDD164BE31}
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
Real Alternative 1.51 Lite-->"C:\Program Files\Real Alternative\unins000.exe"
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c  -removeonly
Ripp-It Codec Pack v 4.2.6-->C:\Program Files\Ripp-It Codec Pack\uninst.exe
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
SAMSUNG Mobile USB Modem ^^-->C:\WINDOWS\system32\Samsung_USB_Drivers\4\SSVDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x40c  -removeonly
SecondLife (remove only)-->"I:\jeux\SecondLife\uninst.exe" /P="SecondLife"
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
SixaxisDriver 0.91-->"C:\Program Files\SixaxisDriver\unins000.exe"
SopCast 3.0.3-->C:\Program Files\SopCast\uninst.exe
Symbol Commander Pro-->C:\WINDOWS\svap_unst.exe
TVAnts 1.0-->C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb958619)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {79B301C1-DBC0-467C-AFDA-2A6CDAFA4302}
USB PC Camera (SN9C101)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57383270-6F61-4DC8-A9B8-C1745FC29F38}\Setup.exe" -l0x9 
VDownloader  0.75-->"C:\Program Files\VDOWNLOADER\unins000.exe"
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VNC Free Edition 4.1.3-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
WinAVI Video Converter 8.0-->"C:\Program Files\WinAVI Video Converter\unins000.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: avast! antivirus 4.8.1296 [VPS 090106-0] (disabled)

System event log

Computer Name: BOULITO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 6452
Source Name: Service Control Manager
Time Written: 20081113144052.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: BOULITO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service aswRdr.

Record Number: 6451
Source Name: Service Control Manager
Time Written: 20081113144052.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: BOULITO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

Record Number: 6450
Source Name: Service Control Manager
Time Written: 20081113144052.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: BOULITO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Gestionnaire de connexions d'accès distant.

Record Number: 6449
Source Name: Service Control Manager
Time Written: 20081113144051.000000+060
Event Type: Informations
User: BOULITO\Boulitoplay

Computer Name: BOULITO
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

Record Number: 6448
Source Name: Service Control Manager
Time Written: 20081113144051.000000+060
Event Type: Informations
User: 

Application event log

Computer Name: BOULITO
Event Code: 701
Message: msnmsgr (3520) La défragmentation en ligne a terminé un passage complet dans la base de données '\.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db'.

Record Number: 2214
Source Name: ESENT
Time Written: 20081111010022.000000+060
Event Type: Informations
User: 

Computer Name: BOULITO
Event Code: 700
Message: msnmsgr (3520) La défragmentation en ligne commence un passage complet dans la base de données '\.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db'.

Record Number: 2213
Source Name: ESENT
Time Written: 20081111010022.000000+060
Event Type: Informations
User: 

Computer Name: BOULITO
Event Code: 701
Message: msnmsgr (3520) La défragmentation en ligne a terminé un passage complet dans la base de données '\.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db'.

Record Number: 2212
Source Name: ESENT
Time Written: 20081111000022.000000+060
Event Type: Informations
User: 

Computer Name: BOULITO
Event Code: 700
Message: msnmsgr (3520) La défragmentation en ligne commence un passage complet dans la base de données '\.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db'.

Record Number: 2211
Source Name: ESENT
Time Written: 20081111000022.000000+060
Event Type: Informations
User: 

Computer Name: BOULITO
Event Code: 102
Message: msnmsgr (3520) \.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db: Le moteur de base de données a démarré une nouvelle instance (0).

Record Number: 2210
Source Name: ESENT
Time Written: 20081110210442.000000+060
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2c02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------










Voici le second raport "log"






Logfile of random's system information tool 1.05 (written by random/random)
Run by Boulitoplay at 2009-01-06 22:09:44
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (40%) free of 20 GB
Total RAM: 1535 MB (75% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS	asks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - I:\Téléchargement\BitComet	ools\BitCometBHO_1.2.8.7.dll [2008-08-11 656696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-01-06 81000]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]
"snpstd"=C:\WINDOWS\vsnpstd.exe [2005-10-11 339968]
"\ORDIBAS\EPSON Stylus CX6600 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE [2004-03-01 98304]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Sensiva"=C:\Program Files\Sensiva []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Rappels du Calendrier Microsoft Works.lnk]
C:\PROGRA~1\FICHIE~1\MICROS~1\WORKSS~1\wkcalrem.exe [1999-08-05 53317]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Boulitoplay^Menu Démarrer^Programmes^Démarrage^Enregistrement de FIFA 09.lnk]
I:\PROGRA~1\EASPOR~1\FIFA09~1\Support\EAREGI~1.EXE /remind /language=FR /PRID=ODS:15373.110.Base Product /WHPR=FIFA 09 /PRNM=Electronic Arts Product []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\NBF]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
bf.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\ProtectedStorage]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\vds]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"I:\Téléchargement\eMule\emule.exe"="I:\Téléchargement\eMule\emule.exe:*:Enabled:eMule"
"I:\Téléchargement\BitComet\BitComet.exe"="I:\Téléchargement\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"I:\jeux\Wolfenstein - Enemy Territory\ET.exe"="I:\jeux\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET"
"I:\jeux\Wolfenstein - Enemy Territory\ETDED.exe"="I:\jeux\Wolfenstein - Enemy Territory\ETDED.exe:*:Enabled:ETDED"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE"="C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE:*:Enabled:SAgent4"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"I:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe"="I:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"C:\Program Files\GameSpy\Comrade\Comrade.exe"="C:\Program Files\GameSpy\Comrade\Comrade.exe:*:Enabled:Comrade"
"C:\Program Files\TVAnts\Tvants.exe"="C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts"
"I:\jeux\SecondLife\SLVoice.exe"="I:\jeux\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Lexmark 2500 Series\app4r.exe"="C:\Program Files\Lexmark 2500 Series\App4R.exe:*:Enabled:Printing Application"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adb87b1e-75ca-11dd-a727-0014854d180b}]
shell\AutoRun\command - jfvkcsy.bat
shell\explore\command - jfvkcsy.bat
shell\open\command - jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8158f90-ac00-11dd-a74f-0014854d180b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e
shell\Open\command - Boot.exe e


======List of files/folders created in the last 1 months======

2009-01-06 22:09:44 ----D---- C:sit
2009-01-06 22:09:44 ----D---- C:\Program Files	rend micro
2009-01-06 22:04:04 ----D---- C:\WINDOWS	emp
2009-01-06 22:04:02 ----A---- C:\ComboFix.txt
2009-01-06 22:01:18 ----A---- C:\WINDOWS\zip.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\VFIND.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\SWSC.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\SWREG.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\sed.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\NIRCMD.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\grep.exe
2009-01-06 22:01:18 ----A---- C:\WINDOWS\fdsv.exe
2009-01-06 22:01:16 ----D---- C:\antibagle
2009-01-06 21:11:48 ----D---- C:\Program Files\FindyKill
2009-01-06 20:30:12 ----D---- C:\WINDOWS\ERDNT
2009-01-06 20:27:57 ----D---- C:	oto
2009-01-06 20:27:26 ----D---- C:\Qoobox
2009-01-06 19:56:41 ----D---- C:\Documents and Settings\Boulitoplay\Application Data\CopyTrans
2009-01-05 15:02:34 ----D---- C:\Documents and Settings\Boulitoplay\Application Data\FileZilla
2009-01-05 15:02:26 ----D---- C:\Program Files\FileZilla FTP Client
2009-01-02 17:51:30 ----D---- C:\Documents and Settings\Boulitoplay\Application Data\CopyTransPhoto
2009-01-02 17:51:13 ----D---- C:\Documents and Settings\Boulitoplay\Application Data\CopyTransManager
2009-01-02 17:49:10 ----D---- C:\Program Files\WindSolutions
2009-01-02 17:49:07 ----D---- C:\Documents and Settings\Boulitoplay\Application Data\CopyTransControlCenter
2009-01-02 17:49:07 ----D---- C:\Documents and Settings\All Users\Application Data\CopyTransControlCenter
2008-12-28 01:41:22 ----D---- C:\Program Files\RealVNC
2008-12-24 02:35:05 ----D---- C:\Documents and Settings\Boulitoplay\Application Data\Apple Computer
2008-12-24 02:34:59 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2008-12-24 02:34:40 ----D---- C:\Program Files\iPod
2008-12-24 02:34:37 ----D---- C:\Program Files\iTunes
2008-12-24 02:34:37 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-24 02:34:24 ----D---- C:\Program Files\Bonjour
2008-12-24 02:33:54 ----D---- C:\Program Files\QuickTime
2008-12-24 02:33:51 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-12-24 02:33:40 ----D---- C:\Program Files\Apple Software Update
2008-12-24 02:05:34 ----D---- C:\Program Files\Fichiers communs\Apple
2008-12-24 02:05:34 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2008-12-24 02:05:31 ----SHD---- C:\Config.Msi
2008-12-24 01:25:13 ----A---- C:\WINDOWS\system32\ptpusb.dll
2008-12-24 01:25:12 ----A---- C:\WINDOWS\system32\ptpusd.dll
2008-12-10 11:51:47 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-10 11:51:01 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-10 11:50:33 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-10 11:50:29 ----A---- C:\WINDOWS\imsins.BAK
2008-12-10 11:50:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

======List of files/folders modified in the last 1 months======

2009-01-06 22:09:44 ----RD---- C:\Program Files
2009-01-06 22:04:04 ----D---- C:\WINDOWS\system32
2009-01-06 22:04:04 ----D---- C:\WINDOWS\Prefetch
2009-01-06 22:04:04 ----D---- C:\WINDOWS
2009-01-06 22:02:46 ----A---- C:\WINDOWS\system.ini
2009-01-06 22:02:21 ----HD---- C:\WINDOWS\system32\drivers
2009-01-06 22:02:20 ----D---- C:\WINDOWS\AppPatch
2009-01-06 22:02:20 ----D---- C:\Program Files\Fichiers communs
2009-01-06 22:01:32 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-01-06 21:52:56 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-01-06 20:10:36 ----D---- C:\WINDOWS\system32\CatRoot2
2009-01-06 19:17:49 ----A---- C:\WINDOWS\NeroDigital.ini
2009-01-02 17:46:39 ----SHD---- C:\WINDOWS\Installer
2009-01-02 17:46:39 ----D---- C:\WINDOWS\WinSxS
2009-01-02 12:37:09 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-12-26 18:06:36 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-12-26 18:06:29 ----HD---- C:\WINDOWS\inf
2008-12-26 02:50:37 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-12-24 14:22:14 ----SD---- C:\Documents and Settings\Boulitoplay\Application Data\Microsoft
2008-12-24 02:34:59 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-12-24 02:33:43 ----SD---- C:\WINDOWS\Tasks
2008-12-24 02:07:07 ----D---- C:\WINDOWS\Minidump
2008-12-22 17:35:14 ----A---- C:\WINDOWS\avisplitter.ini
2008-12-21 01:24:10 ----D---- C:\Downloads
2008-12-17 20:11:30 ----D---- C:\WINDOWS\ie7updates
2008-12-17 20:11:19 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-17 20:03:09 ----D---- C:\WINDOWS\system32\config
2008-12-17 20:02:57 ----D---- C:\WINDOWS\system32\wbem
2008-12-17 20:02:57 ----D---- C:\WINDOWS\Registration
2008-12-17 20:02:29 ----D---- C:\WINDOWS\system32\Restore
2008-12-13 07:37:56 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-12 12:54:59 ----D---- C:\WINDOWS\Debug
2008-12-10 11:52:25 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-12-10 11:51:39 ----D---- C:\Program Files\Internet Explorer
2008-12-10 00:24:37 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2008-08-29 5632]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-08-06 4122112]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1; C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 33792]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-04-24 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS
v4_mini.sys [2006-10-22 3994624]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2003-04-24 5888]
R3 snpstd;USB PC Camera (SN9C101); C:\WINDOWS\System32\DRIVERS\snpstd.sys [2005-11-18 390656]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43520]
S1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys []
S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys []
S3 afx2dk5e;afx2dk5e; C:\WINDOWS\system32\drivers\afx2dk5e.sys []
S3 AR5211;SMCWPCIT-G 108 Mbps Wireless PCI Adapter Service; C:\WINDOWS\System32\DRIVERS\ar5211.sys [2005-12-21 470048]
S3 catchme;catchme; \??\C:\antibagle\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-11-07 32000]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 XPADFL02;XPAD Filter Service 02; C:\WINDOWS\system32\DRIVERS\xpadfl02.sys [2006-12-24 27904]
S4 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys []
S4 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys []
S4 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys []
S4 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1; C:\WINDOWS\system32\libusbd-nt.exe [2005-03-09 18944]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32
vsvc32.exe [2006-10-22 159810]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-08-29 66872]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 191656]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-01-06 18752]
S4 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-01-06 155160]
S4 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-01-06 254040]
S4 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-01-06 352920]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------








Voila j'ai fait tout ce que vous m'avez demande.
uoi de neuf docteur?   :S

jlpjlp · Answer

slt chiquitine29!


boulito c'est toi qui a mis ce logiciel:

Sensiva ???


________________

vire ces cracks:
C:\Documents and Settings\Boulitoplay\Recent\! Microsoft Office 2007 Crack-Serial-Keygen.lnk
C:\Documents and Settings\Boulitoplay\Recent\Crack.lnk 

________________

Telecharge UsbFix sur ton bureau 
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l installation avec les parametres par default 

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir 

--> Double clic sur le raccourci UsbFix sur ton bureau 

--> Le pc va redémarer 

-->Apres redémarrage post le rapport UsbFix.txt 

Note : le rapport UsbFix.txt est sauvegardé a la racine du disque 
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides 


____________________


vire avast comme ceci
https://www.avast.com/fr-fr/uninstall-utility

puis mets antivir qui est meilleur et colle un rapport avec
https://www.malekal.com/avira-free-security-antivirus-gratuit/

boulito · Answer

Oui c'est moi qui ai instale ce logiciel, c'est un logiciel de reconnaissance des mouvements de la sourie, super pratique.
Je ne trouve pas le dossier "recent" dans c:/Documents and Settings\Boulitoplay


Merci de m'aider ...
J'envoi sous peu le raport et instale antivir apres avoir suprime avast

boulito · Answer

Voici le raport usbfix, je vous averti une fois avast dsinstal et antivir instal.
Merci, cordialement, boulito.

boulito · Answer

Oups j'ai oubli le raport, je suis desole.

-------------- UsbFix V2.413.9 ---------------

* User : Boulitoplay - BOULITO
* Outils mis a jours le 05/01/2009 par Chiquitine29 et Chimay8
* Recherche effectuée à 22:41:48 le 06/01/2009
* Windows Xp - Internet Explorer 7.0.5730.13

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

E: - Lecteur amovible

H: - Lecteur fixe

I: - Lecteur fixe

--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe

+- Listing des fichiers présents :

[29/08/2008 01:00][--a------] C:\AUTOEXEC.BAT
[06/01/2009 22:04][--a------] C:\ComboFix.txt
[06/01/2009 22:04][--a------] C:\UsbFix.txt
[29/08/2008 01:00][--a------] C:\CONFIG.SYS
[29/08/2008 01:00][--a------] C:\IO.SYS
[29/08/2008 01:00][--a------] C:\MSDOS.SYS
[29/08/2008 01:00][--a------] C:\pagefile.sys

--------------- [ Lecteur E ] ----------------

E: - Lecteur amovible

+- Listing des fichiers présents :

[06/01/2009 22:38][--a------] E:\UsbFix.exe
[06/01/2009 22:09][--a------] E:\info.txt
[06/01/2009 22:09][--a------] E:\log.txt

--------------- [ Lecteur H ] ----------------

H: - Lecteur fixe

+- Listing des fichiers présents :

[29/08/2008 03:19][--ahs----] H:\desktop.ini

--------------- [ Lecteur I ] ----------------

I: - Lecteur fixe

+- Listing des fichiers présents :

[29/08/2008 02:03][-rahs----] I:\NTDETECT.COM
[29/08/2008 02:51][-rahs----] I:\boot.ini

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
Sensiva="C:\Program Files\Sensiva, Inc\Symbol Commander Pro\Sensiva.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz=nwiz.exe /install
NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
snpstd=C:\WINDOWS\vsnpstd.exe
\\ORDIBAS\EPSON Stylus CX6600 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P36 "\\ORDIBAS\EPSON Stylus CX6600 Series" /O6 "USB001" /M "Stylus CX6600"
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{adb87b1e-75ca-11dd-a727-0014854d180b}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{adb87b1e-75ca-11dd-a727-0014854d180b}\Shell\explore\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{adb87b1e-75ca-11dd-a727-0014854d180b}\Shell\open\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8158f90-ac00-11dd-a74f-0014854d180b}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8158f90-ac00-11dd-a74f-0014854d180b}\Shell\open\Command

--------------- [ Nettoyage des disques ] ----------------

Supprimé ! - [12/11/2008 17:10][--ahs----] H:\THUMBS.DB

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[29/08/2008 01:00][--a------] C:\AUTOEXEC.BAT
[06/01/2009 22:38][--a------] E:\UsbFix.exe
[29/08/2008 03:19][--ahs----] H:\desktop.ini
[29/08/2008 02:03][-rahs----] I:\NTDETECT.COM
[29/08/2008 02:51][-rahs----] I:\boot.ini

--------------- [ Vaccination ] ----------------

C:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
E:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
H:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
I:\autorun.inf -> Dossier autorun.inf crée par UsbFix !

--------------- ! Fin du rapport ! ----------------

boulito · Answer

Je n'ai plus rien a faire? tout est regle ou pas encore? :s

jlpjlp · Answer

vire avast comme ceci
https://www.avast.com/fr-fr/uninstall-utility

puis mets antivir qui est meilleur et colle un rapport avec
https://www.malekal.com/avira-free-security-antivirus-gratuit/

boulito · Answer

Voila c'est fait j'ai viré avast et instalé antivir.
Pour l'instant tout est nikel, mon pc ne rame plus... merci beaucoup pour votre aide!!!
Passez une bonne journée!
Cordialement, Boulito.

jlpjlp · Answer

colle nous un rapport avec antivir

puis


Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

boulito · Answer

bonjour et désolé pour avoir été aussi long a répondre, voici les raports de antivir et RSI.

Passez une bonne soirée, boulito.

Avira AntiVir Personal
Date de création du fichier de rapport : mercredi 7 janvier 2009 22:20

La recherche porte sur 1153470 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme : Windows XP
Version de Windows :(Service Pack 3) [5.1.2600]
Mode Boot : Démarré normalement
Identifiant : SYSTEM
Nom de l'ordinateur :BOULITO

Informations de version :
BUILD.DAT : 8.2.0.52 16931 Bytes 02/12/2008 14:55:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00
AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16
LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 24/12/2008 22:02:39
ANTIVIR2.VDF : 7.1.1.60 318976 Bytes 02/01/2009 22:02:41
ANTIVIR3.VDF : 7.1.1.74 158208 Bytes 06/01/2009 22:02:43
Version du moteur: 8.2.0.45
AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/2008 10:05:56
AESCRIPT.DLL : 8.1.1.19 336252 Bytes 06/01/2009 22:02:56
AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 15:06:41
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 09:41:39
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 06/01/2009 22:02:54
AEHEUR.DLL : 8.1.0.75 1524087 Bytes 06/01/2009 22:02:53
AEHELP.DLL : 8.1.2.0 119159 Bytes 06/01/2009 22:02:48
AEGEN.DLL : 8.1.1.8 323956 Bytes 06/01/2009 22:02:47
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.5.2 172405 Bytes 06/01/2009 22:02:45
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16
RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Contrôle intégral du système
Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, H:, I:,
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: arrêt
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen

Début de la recherche : mercredi 7 janvier 2009 22:20

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'iexplore.exe' - '1' module(s) sont contrôlés
Processus de recherche 'usnsvc.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msnmsgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'iPodService.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Sensiva.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'iTunesHelper.exe' - '1' module(s) sont contrôlés
Processus de recherche 'E_FATI9EE.EXE' - '1' module(s) sont contrôlés
Processus de recherche 'vsnpstd.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'PnkBstrA.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nvsvc32.exe' - '1' module(s) sont contrôlés
Processus de recherche 'libusbd-nt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mDNSResponder.exe' - '1' module(s) sont contrôlés
Processus de recherche 'AppleMobileDeviceService.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'35' processus ont été contrôlés avec '35' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD1
[INFO] Aucun virus trouvé !
[AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD2
[INFO] Aucun virus trouvé !
[AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD3
[INFO] Aucun virus trouvé !
[AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD4
[INFO] Aucun virus trouvé !
[AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'H:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'I:\'
[INFO] Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '49' fichiers).

La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\' <Windows>
C:\pagefile.sys
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\WINDOWS\system32\drivers\sptd.sys
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
Recherche débutant dans 'H:\' <DD1>
Recherche débutant dans 'I:\' <DD2>

Fin de la recherche : jeudi 8 janvier 2009 00:35
Temps nécessaire: 2:14:17 Heure(s)

La recherche a été effectuée intégralement

6179 Les répertoires ont été contrôlés
253211 Des fichiers ont été contrôlés
0 Des virus ou programmes indésirables ont été trouvés
0 Des fichiers ont été classés comme suspects
0 Des fichiers ont été supprimés
0 Des virus ou programmes indésirables ont été réparés
0 Les fichiers ont été déplacés dans la quarantaine
0 Les fichiers ont été renommés
2 Impossible de contrôler des fichiers
253209 Fichiers non infectés
3692 Les archives ont été contrôlées
6 Avertissements
0 Consignes

Voici le raport de rsi :

info.txt logfile of random's system information tool 1.05 2009-01-08 01:19:21

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AMD Processor Driver-->C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x040c -removeonly
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
BitComet 1.04-->I:\Téléchargement\BitComet\uninst.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Ciel Business Plan-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4A31ABB-229F-4922-8499-4731B0A0A2AD}\Install.exe"
CopyTrans Suite (remove only)-->"C:\Program Files\WindSolutions\CopyTrans Suite\uninstall.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"I:\Téléchargement\eMule\Uninstall.exe"
Eurobarre-->"C:\WINDOWS\Eurobarre\uninstall.exe" "/U:C:\Program Files\Eurobarre\Uninstall\uninstall.xml"
EVEREST Ultimate Edition v4.50-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
FIFA 09-->MsiExec.exe /X{2315B23D-3E21-4920-837D-AE6460934ECB}
FileZilla Client 3.1.6-->C:\Program Files\FileZilla FTP Client\uninstall.exe
Frets On Fire-->"C:\Program Files\Frets on Fire\Uninstall.exe"
GameSpy Comrade-->MsiExec.exe /X{7C2E4E9B-0B88-48B6-B7B0-E3F3DF0A239D}
Haali Media Splitter-->"C:\Program Files\Haali\MatroskaSplitter\uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HyperCam 2-->"C:\Program Files\HyCam2\UnHyCam2.exe"
IKEA Home Planner-->MsiExec.exe /I{A987FEC8-5616-49BD-BCA6-ACFFFE7403FE}
ImTOO iPod Computer Transfer-->C:\Program Files\ImTOO\iPod Computer Transfer\Uninstall.exe
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
K-Lite Codec Pack 4.1.4 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lanceur du programme d'installation de Microsoft Works 2000 -->C:\Program Files\Microsoft Works Suite 2000\Setup\Launcher.exe D:\
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LibUSB-Win32-0.1.10.1-->"C:\Program Files\LibUSB-Win32-0.1.10.1\unins000.exe"
Ma-Config.com-->MsiExec.exe /X{CFF24C43-9C46-4044-9C54-A4D98A3A25FB}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Picture It! 2000-->MsiExec.exe /I{E78FC917-C21B-11D2-99FE-00105A98B681}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works 2000-->MsiExec.exe /I{A3088CD2-612B-11D3-AF43-00C04F443448}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero 6 Ultra Edition-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Odebit Multimédia V3.2-->"C:\Program Files\Odebit Multimédia\V3.2\unins000.exe"
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Photorécit 3 pour Windows-->MsiExec.exe /I{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}
PLAYSTATION(R)Network Downloader-->MsiExec.exe /X{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}
Pro Evolution Soccer 2009-->MsiExec.exe /X{A8DB611A-D80E-450D-85F6-3ACDD164BE31}
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
Real Alternative 1.51 Lite-->"C:\Program Files\Real Alternative\unins000.exe"
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c -removeonly
Ripp-It Codec Pack v 4.2.6-->C:\Program Files\Ripp-It Codec Pack\uninst.exe
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
SAMSUNG Mobile USB Modem ^^-->C:\WINDOWS\system32\Samsung_USB_Drivers\4\SSVDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x40c -removeonly
SecondLife (remove only)-->"I:\jeux\SecondLife\uninst.exe" /P="SecondLife"
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
SixaxisDriver 0.91-->"C:\Program Files\SixaxisDriver\unins000.exe"
SopCast 3.0.3-->C:\Program Files\SopCast\uninst.exe
Symbol Commander Pro-->C:\WINDOWS\svap_unst.exe
TVAnts 1.0-->C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb958619)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {79B301C1-DBC0-467C-AFDA-2A6CDAFA4302}
USB PC Camera (SN9C101)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57383270-6F61-4DC8-A9B8-C1745FC29F38}\Setup.exe" -l0x9
VDownloader 0.75-->"C:\Program Files\VDOWNLOADER\unins000.exe"
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WinAVI Video Converter 8.0-->"C:\Program Files\WinAVI Video Converter\unins000.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: Avira AntiVir PersonalEdition Classic

System event log

Computer Name: BOULITO
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 6600
Source Name: Service Control Manager
Time Written: 20081117135109.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: BOULITO
Event Code: 7036
Message: Le service Services Terminal Server est entré dans l'état : en cours d'exécution.

Record Number: 6599
Source Name: Service Control Manager
Time Written: 20081117135109.000000+060
Event Type: Informations
User:

Computer Name: BOULITO
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 6598
Source Name: EventLog
Time Written: 20081117135048.000000+060
Event Type: Informations
User:

Computer Name: BOULITO
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 6597
Source Name: EventLog
Time Written: 20081117135048.000000+060
Event Type: Informations
User:

Computer Name: BOULITO
Event Code: 6006
Message: Le service d'Enregistrement d'événement a été arrêté.

Record Number: 6596
Source Name: EventLog
Time Written: 20081117044108.000000+060
Event Type: Informations
User:

Application event log

Computer Name: BOULITO
Event Code: 11707
Message: Product: MSXML 4.0 SP2 (KB954430) -- Installation completed successfully.

Record Number: 2252
Source Name: MsiInstaller
Time Written: 20081112100627.000000+060
Event Type: Informations
User: BOULITO\Boulitoplay

Computer Name: BOULITO
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 2251
Source Name: SecurityCenter
Time Written: 20081112095759.000000+060
Event Type: Informations
User:

Computer Name: BOULITO
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 2250
Source Name: SecurityCenter
Time Written: 20081112095447.000000+060
Event Type: Informations
User:

Computer Name: BOULITO
Event Code: 701
Message: msnmsgr (3520) La défragmentation en ligne a terminé un passage complet dans la base de données '\\.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db'.

Record Number: 2249
Source Name: ESENT
Time Written: 20081112030022.000000+060
Event Type: Informations
User:

Computer Name: BOULITO
Event Code: 700
Message: msnmsgr (3520) La défragmentation en ligne commence un passage complet dans la base de données '\\.\C:\Documents and Settings\Boulitoplay\Local Settings\Application Data\Microsoft\Messenger\jf_du_62@hotmail.com\SharingMetadata\Working\database_D61C_3D16_1C3C_F2DB\dfsr.db'.

Record Number: 2248
Source Name: ESENT
Time Written: 20081112030022.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2c02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Logfile of random's system information tool 1.05 (written by random/random)
Run by Boulitoplay at 2009-01-08 01:19:10
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (40%) free of 20 GB
Total RAM: 1535 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:19, on 08/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sensiva, Inc\Symbol Commander Pro\Sensiva.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Boulitoplay\Local Settings\Temporary Internet Files\Content.IE5\OGJQIYWG\RSIT[1].exe
C:\Program Files\trend micro\Boulitoplay.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - I:\Téléchargement\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [\\ORDIBAS\EPSON Stylus CX6600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P36 "\\ORDIBAS\EPSON Stylus CX6600 Series" /O6 "USB001" /M "Stylus CX6600"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sensiva] "C:\Program Files\Sensiva, Inc\Symbol Commander Pro\Sensiva.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://I:\Téléchargement\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://I:\Téléchargement\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://I:\Téléchargement\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://I:\Téléchargement\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553550000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - https://sourceforge.net/p/libusb-win32/wiki/Home/ - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

_________________


Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

_________________

Désactive ta restauration systeme puis redemarre ton ordi puis réactive là comme ceci:
https://www.informatruc.com

_______________
encore des soucis?












pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

ANTIVIR  ou AVG8 ou (AVAST ) 
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/-    si tea timer non active de spybot: 
 WINDOWS    DEFENDER ou  SPYWARE TERMINATOR

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware ont sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus  touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

Avast apl win 3 non valide

15 réponses

Discussions similaires

Newsletters