Infection cheval de troie, demande conseils

thibaut -  
Bonjour,
ce matin a 9h40 mon antivirus Norton m'a avertit que j'avais été attaqué par un cheval de troie, il a dit qu'il l'avait bloqué mais on m'a informé que Norton était pas terrible comme anti virus. Je n'ai pas trop envi de planter mon pc donc avant qu'une catastrophe arrive, pouvez vous me conseiller des logiciels ou une démarche a suivre pour virer ce qui m'a investé.
merci beaucoup
Configuration: Windows XP
Internet Explorer 7.0

20 réponses

Résumé de la discussion

Un utilisateur signale une alerte Norton indiquant une possible infection par un cheval de Troie sous Windows XP et cherche des solutions pour nettoyer l'ordinateur. Des recommandations consistent à supprimer des extensions et fichiers suspects, nettoyer les cookies et les entrées de démarrage afin de réduire les composants indésirables et les redirections. D'autres conseils proposent d'utiliser des outils d'analyse comme HijackThis pour évaluer la configuration système et repérer des éléments malveillants, tout en restant conscient que Norton seul peut être insuffisant. D'autres informations soulignent qu'une sécurité efficace passe par une approche en plusieurs étapes, incluant la suppression manuelle d'éléments suspects, un second contrôle des paramètres, puis des sauvegardes avant toute réinstallation.

Bobot (l’IA à votre service)
  1. kevin05 Contributeur sécurité
    Salut,

    - Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

    - Double-clique sur RSIT.exe afin de lancer le programme.

    - Clique sur Continue à l'écran Disclaimer.

    - Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

    - Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

    Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
    0
    1. crossman611
      dsl mais je ne c pas ou se trouvent eorozo? pouvez vous me repondre SVP
      0
  2. crossman611
    bonjour quand j'ai telecharger votre logiciel ca ma ouvert 2 bloc notes ou il y a plein de donner. je sait pas comment faire.
    0
    1. kevin05 Contributeur sécurité
      poste les 2 rapports séparément
      0
      1. crossman611
        Logfile of random's system information tool 1.05 (written by random/random)
        Run by Thibaut at 2009-01-29 13:39:54
        Microsoft Windows XP Professionnel Service Pack 3
        System drive C: has 141 GB (61%) free of 232 GB
        Total RAM: 1022 MB (45% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 13:41:34, on 29/01/2009
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16762)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        c:\Program Files\Norton Internet Security\ISSVC.exe
        c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
        c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\arservice.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\WINDOWS\System32\FTRTSVC.exe
        C:\WINDOWS\runservice.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
        C:\WINDOWS\system32\PnkBstrA.exe
        C:\WINDOWS\system32\PnkBstrB.exe
        C:\WINDOWS\ehome\ehtray.exe
        C:\WINDOWS\ARPWRMSG.EXE
        C:\WINDOWS\system32\svchost.exe
        C:\windows\system\hpsysdrv.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\WINDOWS\ALCXMNTR.EXE
        C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE
        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
        c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        C:\Program Files\Gamevance\gamevance32.exe
        C:\HP\KBD\KBD.EXE
        C:\Program Files\Search Settings\SearchSettings.exe
        C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
        C:\Program Files\Hercules\WiFi Station\WifiStation.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Windows Live\Contacts\wlcomm.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\Thibaut\Local Settings\Temporary Internet Files\Content.IE5\2EJM0FQ1\RSIT[1].exe
        C:\Program Files\Trend Micro\HijackThis\Thibaut.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
        R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
        R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
        R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
        O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
        O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
        O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
        O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
        O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
        O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
        O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"
        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
        O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
        O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
        O4 - HKLM\..\Run: [Gamevance] C:\Program Files\Gamevance\gamevance32.exe
        O4 - HKLM\..\Run: [TXP] c:\program files\topthemesxp\txp.exe
        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
        O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
        O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
        O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [18Wheels_of_Steel.exe] C:\DOWNLO~1\18WHEE~3.EXE /r
        O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
        O4 - Global Startup: WiFi Station.lnk = ?
        O8 - Extra context menu item: &Search - ?p=ZCxdm451YYFR
        O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
        O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Thibaut\Application Data\Dealio\kb126\res\DealioSearch.html
        O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
        O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
        O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O15 - Trusted Zone: *.canalplay.com (HKLM)
        O15 - Trusted Zone: *.canalplusactive.com (HKLM)
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
        O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/insaniquarium/zylomgamesplayer.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxentelechargement.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
        O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/popinsaniquarium/popcaploader_v10.cab
        O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://jeuxentelechargement.orange.fr/online2/insaniquarium/Oberongamesloader.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
        O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
        O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
        O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
        O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        0
        2. crossman611
          info.txt logfile of random's system information tool 1.05 2009-01-29 13:41:42

          ======Uninstall list======

          -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
          -->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
          -->c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
          -->c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
          -->c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
          -->c:\WINDOWS\system32\\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920}
          -->MsiExec.exe /X{7B4AB13C-1A5C-4BC5-ABA6-762F8198444C}
          -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{363435F2-7426-11D8-9966-00A0C9663221}\setup.exe" -l0x40c
          -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{363435F2-7426-11D8-9966-00A0C9663221}\setup.exe" -l0x40c /remove
          -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x40c
          -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC067AB0-2594-4A7E-A1DE-ADEB7D15EB4B}\setup.exe" -l0x40c
          -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC067AB0-2594-4A7E-A1DE-ADEB7D15EB4B}\setup.exe" -l0x40c /remove
          -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
          3D-WinBrick2001-->C:\WINDOWS\s&f_UnIn.exe -uC:\Program Files\3D-WinBrick2001\UnInst.inf
          3GP Converter 2007-->"C:\Program Files\3GP Converter 2007\unins000.exe"
          Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
          Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
          Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
          Adobe Illustrator 10-->"C:\Program Files\InstallShield Installation Information\{412033BC-44CF-48D9-B813-4B835101F4D3}\setup.exe"
          Adobe InDesign 2.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Adobe\InDesign 2.0\Uninst.isu" -c"C:\Program Files\Adobe\InDesign 2.0\Uninst.dll"
          Adobe Reader 7.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A71000000002}
          Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
          Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
          Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
          AquaScreen2 3D Screen Saver-->C:\Documents and Settings\All Users\Application Data\Softdisk LLC\Screen Saver Studio\AquaScreen2 3D\UNINSTAL.EXE
          AquaSea3D Screen Saver-->C:\Documents and Settings\All Users\Application Data\Softdisk LLC\Screen Saver Studio\AquaSea3D\UNINSTAL.EXE
          Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
          ArcSoft Multimedia Email-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD54CF66-090B-43E7-97C1-110EF526474D}\SETUP.EXE" -l0x40c -uninst
          Assistant de connexion Windows Live-->MsiExec.exe /I{D6E592B3-67DA-4BBB-9783-E1838FB253A2}
          ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
          ATI Catalyst Control Center-->MsiExec.exe /I{7B76034B-B3ED-46D5-8C66-DEB102CB830A}
          ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
          AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
          Battlefield 2(TM) Demo-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8BECF123-B0EF-4E51-B7F3-923EFE15CC4A}\setup.exe" -l0x9 -removeonly
          Bluesoleil2.6.0.8 Release 070517-->MsiExec.exe /X{438BB9B4-65FE-4626-91D9-A8F57B18001D}
          CC_ccProxyExt-->MsiExec.exe /I{DA42FDCA-7C5A-43EF-9A05-CCE148ADF919}
          ccCommon-->MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}
          CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
          ccPxyCore-->MsiExec.exe /I{FC08587A-4F01-4188-819F-F55880022917}
          Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
          Connexion Facile à Internet-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1036
          Content Transfer-->MsiExec.exe /X{CFADE4AF-C0CF-4A04-A776-741318F1658F}
          Correctif n° 2 pour Windows XP Édition Media Center 2005-->C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
          Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
          Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
          Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
          Creative WebCam Vista Plus Driver (1.00.05.0906)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script VF0090.uns -unsext NT -plugin V0090Pin.dll -pluginres CtCamPin.crl
          dBpoweramp Music Converter-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
          DiMAGE Viewer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{976EA7B1-7562-483D-88DA-4323D263B7CD}\Setup.exe" -l0x40c anything
          DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
          DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
          DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
          DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
          DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
          EAX Unified-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\EAX Unified\Uninst.isu"
          Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /u
          EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
          EPSON Copy Utility 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x40c -UnInstall
          EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5DA7BC15-18D3-41A0-9F59-838DA3EAEF17}\SETUP.EXE" -l0x40c UNINST
          EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E86BC406-944E-41F6-ADE6-2C136734C96B}\Setup.exe" -l0x40c UNINST
          EPSON Image Clip Palette-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{314F6D08-A8B7-11D8-8446-0050BA1D384D}\Setup.exe" -l0x40c -u
          EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
          EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
          EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
          EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x40c -anything
          ESDX4800_4200 Guide util.-->C:\Program Files\EPSON\TPMANUAL\ESDX4800_4200\USE_G\DOCUNINS.EXE
          Feeding Frenzy 2 Deluxe-->"C:\Program Files\Zylom Games\Feeding Frenzy 2 Deluxe\GameInstaller.exe" --uninstall UnInstall.log
          FMS-->C:\Program Files\FMS\Uninstall.exe
          Free Mp3 Wma Converter V 1.7.2-->"C:\Program Files\Free Audio Pack\unins000.exe"
          FreeRIP v3.09-->"C:\Program Files\FreeRIP3\unins000.exe"
          Gamevance-->C:\Program Files\Gamevance\gvun.exe
          GemMaster Mystic-->"C:\Program Files\GemMasterFrench\uninstallgemmaster.exe"
          High Definition Audio - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
          HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
          Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
          HP Appareils photos Photosmart 5.0-->C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
          HP Deskjet Printer Preload-->MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
          HP DigitalMedia Archive-->MsiExec.exe /I{F80239D8-7811-4D5E-B033-0D0BBFE32920}
          HP Document Viewer 5.3-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
          HP Image Zone 5.3-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
          HP Image Zone for Media Center PC-->c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u
          HP Imaging Device Functions 5.3-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
          HP Photosmart 330,380,420,470,7800,8000,8200 Series-->C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
          HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
          HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
          HP Tunes-->MsiExec.exe /X{D54193B7-D2DF-4977-B546-86CA48DB214E}
          HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
          HPTunesAddIn-->MsiExec.exe /I{69CF01AD-9E35-4BD7-9036-7B8478BEB839}
          ImTOO PSP Video Converter-->C:\Program Files\ImTOO\PSP Video Converter\Uninstall.exe
          Indeo® Software-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ligos\Indeo\Uninst.isu" -c"C:\Program Files\Ligos\Indeo\Indeo System Files\indounin.dll"
          Insaniquarium Deluxe 1.0-->C:\Program Files\PopCap Games\Insaniquarium Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Insaniquarium Deluxe\Install.log"
          Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
          Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0}
          InterVideo WinDVD Player-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
          iTunes-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{523E6F2A-2D59-4D91-90E8-6C49931C9F50}
          IZArc 3.5 beta 3-->"C:\Program Files\IZArc\unins002.exe"
          J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
          Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
          JVTorrent 1.1-->C:\Program Files\JVTorrent\uninst.exe
          L&H TTS3000 Français-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSFRF.inf, Uninstall
          Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
          Livebox-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FC7DDAAE-7F2B-4270-9BFD-5A130B667E9E}\Setup.exe" -l0x40c
          LiveReg (Symantec Corporation)-->C:\Program Files\Fichiers communs\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
          LiveUpdate 3.0 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
          Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
          MainConcept for Software Encoder-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{9950CE72-AE0E-4288-AC34-ACF4691F6FCB}
          Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
          Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
          Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
          Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
          Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
          Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
          Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
          Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
          Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
          Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
          Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
          Microsoft Works-->MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
          MIKSOFT Mobile 3GP converter-->"C:\Program Files\MIKSOFT\Mobile 3GP converter\unins000.exe"
          Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
          Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
          Mise à jour pour Lecteur Windows Media 10 (KB910393)-->"C:\WINDOWS\$NtUninstallKB910393$\spuninst\spuninst.exe"
          Mise à jour pour Lecteur Windows Media 10 (KB913800)-->"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
          Mise à jour pour Lecteur Windows Media 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
          Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
          Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
          Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
          Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
          MotorM4X-->"C:\Program Files\City Interactive\MotorM4X\uninstall.exe"
          Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
          MP3 Player Utilities 4.00-->MsiExec.exe /I{7784A172-61F1-445E-8368-601607E0DD22}
          MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
          MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
          MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
          MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
          MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
          MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
          MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
          muvee autoProducer 4.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2C3D719A-92C7-4323-89CC-C937D0267B84}\setup.exe" -l0x40c
          muvee autoProducer unPlugged 1.1 - HPD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B1931B3A-29E9-4F91-9B61-BE2CF05E84F1}\setup.exe" -l0x40c
          Navilog1 3.5.7-->"C:\Program Files\Navilog1\unins000.exe"
          Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
          netKar PRO 1.0.3-->"c:\nkpro\unins000.exe"
          Nokia Connectivity Cable Driver-->MsiExec.exe /X{4F1DCA42-2030-437C-A94E-736692A499C1}
          Norton AntiSpam-->MsiExec.exe /I{5677563D-0CB1-485f-9E18-C5025306BB3F}
          Norton AntiVirus 2005-->MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
          Norton Internet Security 2005 (Symantec Corporation)-->C:\Program Files\Fichiers communs\Symantec Shared\SymSetup\{A93C9E60-29B6-49da-BA21-F70AC6AADE20}.exe /X
          Norton Internet Security-->MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125}
          Norton Internet Security-->MsiExec.exe /I{449F3A9E-9903-4a0d-A209-08030D45A935}
          Norton Internet Security-->MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
          Norton Internet Security-->MsiExec.exe /I{526AD5DC-CFC4-4f2a-8442-C84CC91D6C7F}
          Norton Internet Security-->MsiExec.exe /I{A93C9E60-29B6-49da-BA21-F70AC6AADE20}
          Norton Internet Security-->MsiExec.exe /I{AADFE0B9-F905-4d5f-A144-0ADB2EFA747B}
          Norton Internet Security-->MsiExec.exe /I{C9D599E1-6B68-4a1f-8A4F-A1DB433DB1BF}
          Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
          Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
          Norton Internet Security-->MsiExec.exe /I{FC2C0536-583C-46c0-844A-62CECAE01F22}
          Norton Security Center-->MsiExec.exe /X{503AA035-41E2-4858-B31F-1E49AC66C309}
          Norton Security Scan-->MsiExec.exe /I{1A8A214F-6BAC-4E01-A27D-25C19A484908}
          Norton WMI Update-->MsiExec.exe /X{E85FA9A1-C241-4698-893B-DD99509B8DB0}
          Norton WMI Update-->MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4}
          OpenAL-->"C:\Program Files\OpenAL\oalinst.exe" /U
          Otto-->"C:\Program Files\FrenchOtto\uninstallotto.exe"
          Outil de connexion Wanadoo-->C:\PROGRA~1\Wanadoo\MessageDesinstallation.exe Wanadoo
          Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
          Package de pilotes Windows - Nokia Modem (03/05/2008 3.7)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_635B28EFCFA9395123BB1C251595CB16129E2560\nokia_bluetooth.inf
          Package de pilotes Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf
          PC Connectivity Solution-->MsiExec.exe /I{AC599724-5755-48C1-ABE7-ABB857652930}
          PC-Doctor 5 for Windows-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{AB61A692-5543-4C48-979B-8CEA1C52FE9C} /l1036
          PIF DESIGNER-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B90450DF-E781-46FD-B1F1-0C86DA40E443}\SETUP.EXE" -l0x40c anything
          Pilote Webcam pour DiMAGE KONICA_MINOLTA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{99E67091-D392-4031-AD2A-E9547F3615F8}\setup.exe" -l0x40c
          ProtectDisc Driver, Version 11-->C:\Program Files\ProtectDisc Driver Installer\uninstall_v11.exe
          PS2-->C:\WINDOWS\system32\ps2.exe uninstall
          PSP Video 9 4.04-->C:\Program Files\Red Kawa\Video Converter App\uninstaller.exe
          Pure DEMO-->C:\Program Files\InstallShield Installation Information\{6A6155A8-9A9C-46FA-9702-CCA5405306F7}\setup.exe -runfromtemp -l0x040c -removeonly
          Python 2.2 pywin32 extensions (build 203)-->"C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
          Python 2.2.3-->C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
          QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
          RACE 07 Demo Dedicated Server-->"C:\Program Files\Steam\steam.exe" steam://uninstall/4270
          RACE 07 Demo-->"C:\Program Files\Steam\steam.exe" steam://uninstall/4260
          SAGEM Wi-Fi 11g USB adapter (Driver)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7421E270-0140-4F62-AE39-ECB9F1C81B35}\setup.exe" -l0x40c
          SAGEM Wi-Fi 11g USB adapter (Tool)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A11CA13A-07D2-40DF-A274-9D516FE06A16}\Setup.exe" -l0x40c
          Sandlot Games Client Services-->"C:\Program Files\Fichiers communs\Sandlot Shared\unins000.exe"
          Search Settings 1.1-->MsiExec.exe /X{32AD1A7A-25F1-44B9-A396-EA8A4A6605B0}
          Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
          Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
          SEGA Rally Revo Demo-->"C:\Program Files\InstallShield Installation Information\{9FE3F0EA-3122-47F9-BA98-3132C12D3D33}\setup.exe" -runfromtemp -l0x040c -removeonly
          SEGA Rally Revo Demo-->MsiExec.exe /I{9FE3F0EA-3122-47F9-BA98-3132C12D3D33}
          Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
          Sonic Encoders-->MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
          Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
          Sonic MyDVD Plus-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
          Sonic RecordNow Audio-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
          Sonic RecordNow Copy-->MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}
          Sonic RecordNow Data-->MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
          Sonic Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
          SPBBC-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
          Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
          Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
          SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
          TmNationsForever-->"C:\Program Files\TmNationsForever\unins000.exe"
          TrackMania Sunrise Extreme Demo 1.5.0-->"C:\Program Files\TrackMania Sunrise Extreme Demo\unins000.exe"
          ubi.com-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AEDDF5A3-29CE-11D5-A8C2-000102246AAE}\Setup.exe" UNINSTALL-L0x9 -uninst
          Ulead Photo Explorer 7.0 SE Platinum-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C6D8763-EEB7-433E-A75E-2AB44892FCA2}\Setup.exe" -l0x40c
          Ulead Photo Express 4.0 My Custom Edition-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{21BCE515-D5A3-11D4-8E33-0010B53EC668}\SETUP.EXE"
          Update for Windows XP (KB953356)-->"C:\WINDOWS\$NtUninstallKB953356$\spuninst\spuninst.exe"
          Utilitaires Sierra-->C:\Program Files\Sierra On-Line\sutil32.exe uninstall
          VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
          VeohTV BETA-->C:\Program Files\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
          Westward-->"C:\Program Files\orange\jeux\Westward\Uninstall.exe" "C:\Program Files\orange\jeux\Westward\install.log"
          WiFi Station-->C:\Program Files\InstallShield Installation Information\{DECE22F4-EEDD-4615-BC56-2F4827FAD64B}\setup.exe -runfromtemp -l0x040c -removeonly
          Windows Desktop Search -->"C:\WINDOWS\$NtUninstallKB911993-V2$\spuninst\spuninst.exe"
          Windows Live Call-->MsiExec.exe /I{01523985-2098-43AF-9C97-12B07BE02A9B}
          Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
          Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
          Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
          Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
          Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
          Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
          Windows XP Media Center Edition 2005 KB925766-->"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
          Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
          Xfire (remove only)-->"C:\Program Files\Xfire\uninst.exe"
          X-Moto-->"C:\Program Files\XMoto\uninstall.exe"
          YouTube Downloader App 1.01-->C:\Program Files\Red Kawa\Downloader App\uninstaller.exe

          ======Security center information======

          AV: Norton Internet Security
          FW: Norton Internet Security

          System event log

          Computer Name: SABINE
          Event Code: 7036
          Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : arrêté.

          Record Number: 102036
          Source Name: Service Control Manager
          Time Written: 20090116220152.000000+060
          Event Type: Informations
          User:

          Computer Name: SABINE
          Event Code: 7036
          Message: Le service LiveUpdate est entré dans l'état : en cours d'exécution.

          Record Number: 102035
          Source Name: Service Control Manager
          Time Written: 20090116220151.000000+060
          Event Type: Informations
          User:

          Computer Name: SABINE
          Event Code: 7035
          Message: Un contrôle Démarrer a correctement été envoyé au service LiveUpdate.

          Record Number: 102034
          Source Name: Service Control Manager
          Time Written: 20090116220151.000000+060
          Event Type: Informations
          User: AUTORITE NT\SYSTEM

          Computer Name: SABINE
          Event Code: 7036
          Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

          Record Number: 102033
          Source Name: Service Control Manager
          Time Written: 20090116220145.000000+060
          Event Type: Informations
          User:

          Computer Name: SABINE
          Event Code: 7035
          Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

          Record Number: 102032
          Source Name: Service Control Manager
          Time Written: 20090116220145.000000+060
          Event Type: Informations
          User: AUTORITE NT\SYSTEM

          Application event log

          Computer Name: SABINE
          Event Code: 1
          Message: L'application a démarré

          Record Number: 18489
          Source Name: ccSetMgr
          Time Written: 20081222093734.000000+060
          Event Type: Informations
          User: AUTORITE NT\SYSTEM

          Computer Name: SABINE
          Event Code: 1
          Message: Application started

          Record Number: 18488
          Source Name: SNDSrvc
          Time Written: 20081222093731.000000+060
          Event Type: Informations
          User: AUTORITE NT\SYSTEM

          Computer Name: SABINE
          Event Code: 0
          Message: Service started

          Record Number: 18487
          Source Name: SPBBCSvc
          Time Written: 20081222093731.000000+060
          Event Type: Informations
          User:

          Computer Name: SABINE
          Event Code: 26
          Message: Application starting

          Record Number: 18486
          Source Name: SNDSrvc
          Time Written: 20081222093728.000000+060
          Event Type: Informations
          User: AUTORITE NT\SYSTEM

          Computer Name: SABINE
          Event Code: 26
          Message:
          Record Number: 18485
          Source Name: ISService
          Time Written: 20081222093727.000000+060
          Event Type: Informations
          User: AUTORITE NT\SYSTEM

          ======Environment variables======

          "ComSpec"=%SystemRoot%\system32\cmd.exe
          "Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Python22;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\QuickTime\QTSystem\
          "windir"=%SystemRoot%
          "FP_NO_HOST_CHECK"=NO
          "OS"=Windows_NT
          "PROCESSOR_ARCHITECTURE"=x86
          "PROCESSOR_LEVEL"=15
          "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
          "PROCESSOR_REVISION"=2f02
          "NUMBER_OF_PROCESSORS"=1
          "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
          "TEMP"=%SystemRoot%\TEMP
          "TMP"=%SystemRoot%\TEMP
          "SonicCentral"=c:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
          "CLASSPATH"=.;C:\Program Files\Java\jre1.5.0\lib\ext\QTJava.zip
          "QTJAVA"=C:\Program Files\Java\jre1.5.0\lib\ext\QTJava.zip

          -----------------EOF-----------------
          0
          1. kevin05 Contributeur sécurité
            élécharge Malwarebytes’ Anti-Malware

            tuto ICI

            NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici

            - Sur la page cliques sur Télécharger Malwarebyte’s Anti-Malware
            - Enregistres le sur le bureau
            - Double cliques sur le fichier téléchargé pour lancer le processus d’installation
            - Lorsqu’il te le sera demandé, met à jour Malwarebytes anti malware
            - Si le pare-feu demande l’autorisation de se connecter pour malwarebytes, acceptes
            - Une fois la mise à jour terminée, ferme Malwarebytes
            - Double-cliques sur l’icône de malwarebytes pour le relancer
            - Dans l’onglet, Recherche, probablement ouvert par défaut,
            - Sélectionne Exécuter un examen rapide
            - Clique sur Rechercher
            - Le scan démarre
            - A la fin de l’analyse, un message s’affiche : L’examen s’est terminé normalement. Cliquez sur ‘Afficher les résultats’ pour afficher tous les objets trouvés.
            - Cliques sur Ok pour poursuivre.
            - Si des malwares ont été détectés, cliques sur Afficher les résultats
            - Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
            - Malwarebytes va ouvrir le bloc-notes et y copier le rapport d’analyse.
            - Rends toi dans l’onglet rapport/log
            - Tu cliques dessus pour l’afficher une fois affiché
            - Tu cliques sur édition en haut du bloc notes, et puis sur sélectionner tout
            - Tu recliques sur édition et puis sur copier et tu reviens sur le forum et dans ta réponse
            - Tu cliques droit dans le cadre de la réponse et coller
            0
            1. crossman611
              il mas mis: certaint de ces element ne peuve pas etre suprimer ils ont ete mis dans suprimer les elements au demarage donc veiller redemare votre ordinateur.
              j'ai redemarer. en maintenat je fais koi?
              0
          2. crossman611
            l'analyse est en train de se faire
            0
            1. kevin05 Contributeur sécurité
              Si tu as redemmarer poste moi le rapport stp
              0
              1. crossman611
                il est où le rapport?
                0
              2. crossman611
                c ca le rapport?

                Malwarebytes' Anti-Malware 1.33
                Version de la base de données: 1704
                Windows 5.1.2600 Service Pack 3

                29/01/2009 14:58:40
                mbam-log-2009-01-29 (14-58-40).txt

                Type de recherche: Examen rapide
                Eléments examinés: 82396
                Temps écoulé: 15 minute(s), 11 second(s)

                Processus mémoire infecté(s): 0
                Module(s) mémoire infecté(s): 0
                Clé(s) du Registre infectée(s): 0
                Valeur(s) du Registre infectée(s): 0
                Elément(s) de données du Registre infecté(s): 0
                Dossier(s) infecté(s): 0
                Fichier(s) infecté(s): 0

                Processus mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Module(s) mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Clé(s) du Registre infectée(s):
                (Aucun élément nuisible détecté)

                Valeur(s) du Registre infectée(s):
                (Aucun élément nuisible détecté)

                Elément(s) de données du Registre infecté(s):
                (Aucun élément nuisible détecté)

                Dossier(s) infecté(s):
                (Aucun élément nuisible détecté)

                Fichier(s) infecté(s):
                (Aucun élément nuisible détecté)
                0
            2. kevin05 Contributeur sécurité
              tu peux le trouver dans l'onglet rapport de malwarebyte's
              0
              1. crossman611
                je vous l'ais envoyer juste avant
                0
                1. kevin05 Contributeur sécurité
                  ? Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

                  ? Lance l'installation du programme en exécutant le fichier téléchargé.

                  ? Double-clique maintenant sur le raccourci de Toolbar-S&D.

                  ? Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

                  ? Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

                  ? Poste le rapport généré. (C:\TB.txt)
                  0
                  1. crossman611
                    -----------\\ ToolBar S&D 1.2.8 XP/Vista

                    Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                    X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3800+ )
                    BIOS : Phoenix - Award BIOS v6.00PG
                    USER : Thibaut ( Administrator )
                    BOOT : Normal boot
                    Antivirus : Norton Internet Security 2005 (Activated)
                    Firewall : Norton Internet Security 2005 (Activated)
                    C:\ (Local Disk) - NTFS - Total:226 Go (Free:137 Go)
                    D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
                    E:\ (CD or DVD)
                    F:\ (USB)
                    G:\ (USB)
                    H:\ (USB)
                    I:\ (USB)

                    "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                    Option : [1] ( 29/01/2009|15:12 )

                    -----------\\ Recherche de Fichiers / Dossiers ...

                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\chevron-small.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\DealioSearch.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\deals-leftcap.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\deal_report.jpg
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\ebay_login.jpg
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\err_mainwindow.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\err_toolbar.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\global_scripts.js
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\headerbgthin.jpg
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\highlight-bg.png
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\logo.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\logo_over.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\man_toolbar.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\man_toolbar.js
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\post-this-deal.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\post-this-deal_over.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\scripts.js
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\scroller.js
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\search-chevron.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\search-chevron_over.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\search_bg_blink.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\separator.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\settings.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\settings_over.gif
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\res\yahoo-search.png
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\index.76.35
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.10.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.109.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.110.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.12.52
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.13.58
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.130.58
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.135.50
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.153.44
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.155.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.156.49
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.16.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.161.52
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.178.66
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.184.55
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.188.52
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.189.45
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.196.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.198.56
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.199.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.200.53
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.201.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.202.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.203.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.205.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.213.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.214.49
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.215.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.216.67
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.217.67
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.218.52
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.219.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.220.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.221.57
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.222.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.223.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.226.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.227.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.228.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.229.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.23.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.239.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.24.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.240.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.241.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.242.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.243.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.244.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.245.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.247.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.248.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.249.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.250.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.251.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.252.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.253.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.254.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.255.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.256.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.257.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.279.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.28.58
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.282.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.283.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.284.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.289.67
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.290.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.291.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.296.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.297.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.304.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.307.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.308.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.31.47
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.310.46
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.311.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.315.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.316.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.317.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.318.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.319.49
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.32.48
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.334.44
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.335.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.336.44
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.337.44
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.338.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.339.47
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.34.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.340.47
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.341.47
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.349.50
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.35.48
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.350.50
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.351.51
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.352.54
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.353.51
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.354.51
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.357.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.358.52
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.359.52
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.360.53
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.361.54
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.362.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.363.58
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.364.54
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.365.53
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.367.56
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.368.58
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.369.55
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.370.56
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.371.56
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.372.57
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.373.55
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.375.56
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.376.57
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.377.55
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.378.65
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.384.58
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.386.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.387.59
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.388.59
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.389.59
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.390.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.391.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.392.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.393.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.394.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.396.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.397.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.398.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.399.60
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.403.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.404.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.405.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.406.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.407.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.408.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.409.61
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.412.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.413.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.414.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.415.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.416.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.417.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.418.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.419.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.420.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.421.62
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.423.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.424.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.425.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.426.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.427.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.428.65
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.429.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.430.63
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.432.65
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.433.64
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.434.65
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.435.64
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.436.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.437.64
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.438.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.439.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.440.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.442.73
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.443.73
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.444.73
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.445.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.446.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.450.67
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.451.67
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.452.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.453.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.454.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.456.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.457.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.458.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.459.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.460.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.462.74
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.463.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.464.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.465.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.468.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.469.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.470.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.471.73
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.472.70
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.478.74
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.479.73
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.480.68
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.481.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.482.74
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.49.67
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.50.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.500.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.501.74
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.502.71
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.51.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.52.72
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.520.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.521.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.522.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.53.51
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.531.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.532.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.534.75
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.54.47
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.55.45
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.56.69
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.57.43
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.58.47
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.593.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.595.76
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\rules\rules.1.63.57
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\dealio-13953.log
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\dealio-13954.log
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\dod_cache.xml
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_1900_5752_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_3024_6100_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_3440_4740_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_4268_4852_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_4620_3744_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_4652_4280_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_4772_5852_5.html
                    C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126\temp\_toolbar_tmp_5344_4936_5.html
                    C:\Program Files\GamesBar
                    C:\Program Files\GamesBar\oberontb.dll
                    C:\DOCUME~1\Thibaut\Cookies\thibaut@hotbar[1].txt
                    C:\DOCUME~1\Thibaut\Cookies\thibaut@mysearch[2].txt
                    C:\DOCUME~1\Thibaut\Cookies\thibaut@myway[1].txt
                    C:\DOCUME~1\Thibaut\Cookies\thibaut@mywebsearch[1].txt
                    C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
                    C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings
                    C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings\kb126
                    C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings\kb126\res
                    C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings\kb126\temp
                    C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings\kb126\temp\ws-14272.log
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126\res
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126\temp
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126\temp\ws-14271.log
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126\temp\ws-14272.log
                    C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126\temp\ws-14273.log
                    C:\Program Files\Search Settings
                    C:\Program Files\Search Settings\kb126
                    C:\Program Files\Search Settings\SearchSettings.exe
                    C:\Program Files\Search Settings\kb126\res
                    C:\Program Files\Search Settings\kb126\SearchSettings.dll
                    C:\Program Files\Search Settings\kb126\temp
                    C:\DOCUME~1\Thibaut\Cookies\thibaut@cs.shopperreports[1].txt
                    C:\WINDOWS\iun6002.exe

                    -----------\\ Extensions

                    (HP_Administrateur) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

                    -----------\\ [..\Internet Explorer\Main]

                    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                    "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                    "Start Page"="https://www.orange.fr/portail"
                    "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                    "Search Bar"="https://www.orange.fr/portail"

                    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                    "Default_Page_URL"="https://fr.yahoo.com/"
                    "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                    "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                    "Start Page"="https://fr.yahoo.com/"

                    --------------------\\ Recherche d'autres infections

                    --------------------\\ Cracks & Keygens ..

                    C:\DOCUME~1\Thibaut\Mes documents\crack NSR
                    C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing
                    C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack
                    C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack\crack.exe
                    C:\DOCUME~1\Thibaut\Mes documents\Jeux\mc2\Motocross_Madness_2_No-CD_Crack.zip
                    C:\DOCUME~1\Thibaut\Recent\crack mc 2.lnk

                    1 - "C:\ToolBar SD\TB_1.txt" - 29/01/2009|15:13 - Option : [1]

                    -----------\\ Fin du rapport a 15:13:26.78
                    0
                    1. kevin05 Contributeur sécurité
                      ? Relance Toolbar-S&D en double-cliquant sur le raccourci.
                      ? Tape sur "2" puis valide en appuyant sur "Entrée".
                      /!\ Ne ferme pas la fenêtre lors de la suppression !
                      ? Un rapport sera généré, poste son contenu ici.

                      NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
                      Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
                      Tape explorer puis valide.
                      0
                      1. crossman611
                        -----------\\ ToolBar S&D 1.2.8 XP/Vista

                        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                        X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3800+ )
                        BIOS : Phoenix - Award BIOS v6.00PG
                        USER : Thibaut ( Administrator )
                        BOOT : Normal boot
                        Antivirus : Norton Internet Security 2005 (Activated)
                        Firewall : Norton Internet Security 2005 (Activated)
                        C:\ (Local Disk) - NTFS - Total:226 Go (Free:137 Go)
                        D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
                        E:\ (CD or DVD)
                        F:\ (USB)
                        G:\ (USB)
                        H:\ (USB)
                        I:\ (USB)

                        "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                        Option : [2] ( 29/01/2009|15:17 )

                        -----------\\ SUPPRESSION

                        Supprime! - C:\DOCUME~1\Thibaut\APPLIC~1\Dealio\kb126
                        Supprime! - C:\Program Files\GamesBar\oberontb.dll
                        Supprime! - C:\DOCUME~1\Thibaut\Cookies\thibaut@hotbar[1].txt
                        Supprime! - C:\DOCUME~1\Thibaut\Cookies\thibaut@mysearch[2].txt
                        Supprime! - C:\DOCUME~1\Thibaut\Cookies\thibaut@myway[1].txt
                        Supprime! - C:\DOCUME~1\Thibaut\Cookies\thibaut@mywebsearch[1].txt
                        Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
                        Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings\kb126
                        Supprime! - C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings\kb126
                        Supprime! - C:\Program Files\Search Settings\kb126
                        Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
                        Supprime! - C:\DOCUME~1\Thibaut\Cookies\thibaut@cs.shopperreports[1].txt
                        Supprime! - C:\WINDOWS\iun6002.exe
                        Supprime! - C:\DOCUME~1\Thibaut\APPLIC~1\Dealio
                        Supprime! - C:\Program Files\GamesBar
                        Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\Search Settings
                        Supprime! - C:\DOCUME~1\Thibaut\APPLIC~1\Search Settings
                        Supprime! - C:\Program Files\Search Settings

                        -----------\\ Recherche de Fichiers / Dossiers ...

                        -----------\\ Extensions

                        (HP_Administrateur) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

                        -----------\\ [..\Internet Explorer\Main]

                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                        "Start Page"="https://www.orange.fr/portail"
                        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Search Bar"="https://www.orange.fr/portail"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                        "Default_Page_URL"="https://fr.yahoo.com/"
                        "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                        "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                        "Start Page"="https://www.msn.com/fr-fr/"

                        --------------------\\ Recherche d'autres infections

                        --------------------\\ Cracks & Keygens ..

                        C:\DOCUME~1\Thibaut\Mes documents\crack NSR
                        C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing
                        C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack
                        C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack\crack.exe
                        C:\DOCUME~1\Thibaut\Mes documents\Jeux\mc2\Motocross_Madness_2_No-CD_Crack.zip
                        C:\DOCUME~1\Thibaut\Recent\crack mc 2.lnk

                        1 - "C:\ToolBar SD\TB_1.txt" - 29/01/2009|15:13 - Option : [1]
                        2 - "C:\ToolBar SD\TB_2.txt" - 29/01/2009|15:19 - Option : [2]

                        -----------\\ Fin du rapport a 15:19:25.21
                        0
                      2. crossman611
                        je fais koi maintenant?
                        0
                    2. kevin05 Contributeur sécurité
                      ---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

                      ---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :

                      ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

                      ---> Copie (Ctrl+C) le texte suivant ci-dessous :

                      :processes
                      explorer.exe

                      :file
                      C:\DOCUME~1\Thibaut\Mes documents\crack NSR
                      C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing
                      C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack
                      C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack\crack.exe
                      C:\DOCUME~1\Thibaut\Mes documents\Jeux\mc2\Motocross_Madness_2_No-CD_Crack.zip
                      C:\DOCUME~1\Thibaut\Recent\crack mc 2.lnk

                      :commands
                      [purity]
                      [emptytemp]
                      [start explorer]
                      [reboot]

                      ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

                      ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

                      Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
                      Accepte en cliquant sur YES.

                      ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
                      Le nom du rapport correspond au moment de sa création : date_heure.log
                      0
                      1. crossman611
                        C bien ça?

                        ========== PROCESSES ==========
                        Process explorer.exe killed successfully.
                        Error: Unable to interpret <:file> in the current context!
                        Error: Unable to interpret <C:\DOCUME~1\Thibaut\Mes documents\crack NSR> in the current context!
                        Error: Unable to interpret <C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing> in the current context!
                        Error: Unable to interpret <C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack> in the current context!
                        Error: Unable to interpret <C:\DOCUME~1\Thibaut\Mes documents\crack NSR\Nitro Stunt Racing\Crack\crack.exe> in the current context!
                        Error: Unable to interpret <C:\DOCUME~1\Thibaut\Mes documents\Jeux\mc2\Motocross_Madness_2_No-CD_Crack.zip> in the current context!
                        Error: Unable to interpret <C:\DOCUME~1\Thibaut\Recent\crack mc 2.lnk> in the current context!
                        ========== COMMANDS ==========
                        File delete failed. C:\DOCUME~1\Thibaut\LOCALS~1\Temp\etilqs_D9hwnbfSx1Z7bmJfFyZk scheduled to be deleted on reboot.
                        User's Temp folder emptied.
                        User's Temporary Internet Files folder emptied.
                        User's Internet Explorer cache folder emptied.
                        File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
                        Local Service Temp folder emptied.
                        File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                        Local Service Temporary Internet Files folder emptied.
                        File delete failed. C:\WINDOWS\temp\CustomB scheduled to be deleted on reboot.
                        Windows Temp folder emptied.
                        Java cache emptied.
                        File delete failed. C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
                        File delete failed. C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\XUL.mfl scheduled to be deleted on reboot.
                        FireFox cache emptied.
                        Temp folders emptied.
                        Explorer started successfully

                        OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01292009_154518

                        Files moved on Reboot...
                        File C:\DOCUME~1\Thibaut\LOCALS~1\Temp\etilqs_D9hwnbfSx1Z7bmJfFyZk not found!
                        File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot.
                        File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be moved on reboot.
                        File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.
                        File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
                        File C:\WINDOWS\temp\CustomB not found!
                        C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_001_ moved successfully.
                        C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_002_ moved successfully.
                        C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_003_ moved successfully.
                        C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\Cache\_CACHE_MAP_ moved successfully.
                        C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\urlclassifier3.sqlite moved successfully.
                        C:\Documents and Settings\Thibaut\Local Settings\Application Data\Mozilla\Firefox\Profiles\k93eoy7w.default\XUL.mfl moved successfully.
                        0
                    3. kevin05 Contributeur sécurité
                      Bien poste

                      Relance RSIT poste le log.txt stp
                      0
                      1. crossman611
                        Logfile of random's system information tool 1.05 (written by random/random)
                        Run by Thibaut at 2009-01-29 13:39:54
                        Microsoft Windows XP Professionnel Service Pack 3
                        System drive C: has 141 GB (61%) free of 232 GB
                        Total RAM: 1022 MB (45% free)

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 13:41:34, on 29/01/2009
                        Platform: Windows XP SP3 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16762)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                        c:\Program Files\Norton Internet Security\ISSVC.exe
                        c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\Explorer.EXE
                        c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\arservice.exe
                        C:\WINDOWS\eHome\ehRecvr.exe
                        C:\WINDOWS\eHome\ehSched.exe
                        C:\WINDOWS\System32\FTRTSVC.exe
                        C:\WINDOWS\runservice.exe
                        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                        C:\WINDOWS\system32\PnkBstrA.exe
                        C:\WINDOWS\system32\PnkBstrB.exe
                        C:\WINDOWS\ehome\ehtray.exe
                        C:\WINDOWS\ARPWRMSG.EXE
                        C:\WINDOWS\system32\svchost.exe
                        C:\windows\system\hpsysdrv.exe
                        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                        C:\WINDOWS\ALCXMNTR.EXE
                        C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE
                        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                        C:\Program Files\Gamevance\gamevance32.exe
                        C:\HP\KBD\KBD.EXE
                        C:\Program Files\Search Settings\SearchSettings.exe
                        C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                        C:\Program Files\Hercules\WiFi Station\WifiStation.exe
                        C:\WINDOWS\eHome\ehmsas.exe
                        C:\WINDOWS\system32\dllhost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Windows Live\Contacts\wlcomm.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
                        C:\Program Files\Internet Explorer\IEXPLORE.EXE
                        C:\Documents and Settings\Thibaut\Local Settings\Temporary Internet Files\Content.IE5\2EJM0FQ1\RSIT[1].exe
                        C:\Program Files\Trend Micro\HijackThis\Thibaut.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                        R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
                        R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
                        R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                        O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                        O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
                        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
                        O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
                        O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
                        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                        O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
                        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
                        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
                        O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
                        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                        O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                        O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                        O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                        O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"
                        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                        O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
                        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                        O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
                        O4 - HKLM\..\Run: [Gamevance] C:\Program Files\Gamevance\gamevance32.exe
                        O4 - HKLM\..\Run: [TXP] c:\program files\topthemesxp\txp.exe
                        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                        O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
                        O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
                        O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [18Wheels_of_Steel.exe] C:\DOWNLO~1\18WHEE~3.EXE /r
                        O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                        O4 - Global Startup: WiFi Station.lnk = ?
                        O8 - Extra context menu item: &Search - ?p=ZCxdm451YYFR
                        O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
                        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                        O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Thibaut\Application Data\Dealio\kb126\res\DealioSearch.html
                        O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
                        O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O15 - Trusted Zone: *.canalplay.com (HKLM)
                        O15 - Trusted Zone: *.canalplusactive.com (HKLM)
                        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
                        O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
                        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/insaniquarium/zylomgamesplayer.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxentelechargement.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
                        O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                        O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/popinsaniquarium/popcaploader_v10.cab
                        O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://jeuxentelechargement.orange.fr/online2/insaniquarium/Oberongamesloader.cab
                        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
                        O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
                        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                        O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
                        O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
                        O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
                        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                        O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe
                        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                        0
                    4. kevin05 Contributeur sécurité
                      Scan saved at 13:41:34, on 29/01/2009 *

                      Un nouveau log stp celui là c'étais le 1er j'en veux un nouveau !
                      0
                      1. crossman611
                        et il est ou le nouveau?
                        0
                      2. crossman611
                        le nouveau log est il est où?
                        0
                    5. kevin05 Contributeur sécurité
                      Bah comme tous a l'heure

                      Y'as un bloc not qui s'ouvre
                      0
                      1. crossman611
                        g pas de bloc note ouvert la
                        0
                    6. kevin05 Contributeur sécurité
                      Télécharge HijackThis Version 2.02 :

                      - Enregistre HJTInstall.exe sur ton bureau.
                      - Fais un double-clic (gauche) sur HJTInstall.exe afin de lancer l’installation
                      - Clique sur Install ensuite sur « I Accept »
                      - Clique sur « Do a scan system and save log file »
                      - Le bloc-notes s’ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
                      0
                      1. crossman611
                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 16:39:58, on 29/01/2009
                        Platform: Windows XP SP3 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16762)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                        c:\Program Files\Norton Internet Security\ISSVC.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\arservice.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\eHome\ehRecvr.exe
                        C:\WINDOWS\eHome\ehSched.exe
                        C:\WINDOWS\System32\FTRTSVC.exe
                        C:\WINDOWS\runservice.exe
                        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                        C:\WINDOWS\system32\PnkBstrA.exe
                        C:\WINDOWS\system32\PnkBstrB.exe
                        C:\WINDOWS\system32\svchost.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                        C:\WINDOWS\system32\dllhost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\ehome\ehtray.exe
                        C:\WINDOWS\ARPWRMSG.EXE
                        C:\windows\system\hpsysdrv.exe
                        C:\WINDOWS\eHome\ehmsas.exe
                        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                        C:\WINDOWS\ALCXMNTR.EXE
                        C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE
                        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                        C:\HP\KBD\KBD.EXE
                        C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                        C:\Program Files\Hercules\WiFi Station\WifiStation.exe
                        C:\Program Files\Windows Live\Contacts\wlcomm.exe
                        c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                        c:\Program Files\Fichiers communs\Symantec Shared\NMain.exe
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                        R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                        O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
                        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
                        O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
                        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
                        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                        O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
                        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                        O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                        O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                        O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                        O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"
                        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
                        O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
                        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                        O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
                        O4 - HKLM\..\Run: [TXP] c:\program files\topthemesxp\txp.exe
                        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                        O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [18Wheels_of_Steel.exe] C:\DOWNLO~1\18WHEE~3.EXE /r
                        O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                        O4 - Global Startup: WiFi Station.lnk = ?
                        O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
                        O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
                        O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
                        O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O15 - Trusted Zone: *.canalplay.com (HKLM)
                        O15 - Trusted Zone: *.canalplusactive.com (HKLM)
                        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
                        O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab
                        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/insaniquarium/zylomgamesplayer.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O16 - DPF: {C9E17F58-564C-41C6-989F-AB0FE0D2C9D1} (PopcapLoader Object) - http://jeuxentelechargement.orange.fr/orange2.0/OnlineHSS/insaniquarium/Popcap.cab
                        O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                        O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://jeuxentelechargement.orange.fr/online2/insaniquarium/Oberongamesloader.cab
                        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
                        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
                        O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
                        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
                        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                        O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
                        O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
                        O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
                        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
                        O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe
                        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
                        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
                        0
                    7. kevin05 Contributeur sécurité
                      1/ vire eorozo

                      2/Purge de la restauration système
                      *Désactive ta restauration :
                      Clique droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK
                      --->Redémarre ton PC ...

                      *Réactive ta restauration :
                      Clique droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK
                      --->Redémarre ton PC ...

                      ( Note : tu peux aussi y accéder via panneau de configuration->" système "->" restauration système " ).

                      Attention : ne pas toucher au PC pendant qu'il travaille !
                      0
                      1. crossman611
                        c quoi eorozo?
                        0
                        1. crossman611
                          il est ou eorozo?
                          0

                      Discussions similaires

                      Cheval de Troie- e.tre456.worm.windows
                      Ninou037

                      13 réponses
                      Virus potentiel
                      Ramon1

                      29 réponses
                      virus et ou cheval de troie
                      FLORE+60

                      1 réponse
                      cheval dans oblivion
                      sernaldo53

                      12 réponses
                      supprimer un cheval de troie
                      Blandine1964

                      10 réponses