Rapport HiJackThis - aide pour comprendre

Super, maintenant ça a marché, merci !! Au fait, à quoi sert ce contrôle des comptes utilisateurs ? Est-ce que c'est utile uniquement si on est plusieurs à utiliser le même PC ? Ou est-ce que ça protège contre les attaques extérieures aussi ?

En tout cas, voici le rapport de scan :

------- LOGFILE OF AD-REMOVER 1.1.1.6 | ONLY XP/VISTA -------

Updated by C_XX on 07/03/2009 at 21:40

Start at: 21:42:01 | Sun 08/03/2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
Computer Name: PC-DE-GUIMAUVE
Current User: Guimauve - Administrator
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\Windows\
System Directory: C:\Windows\System32\

--- Running Processes: 76
--- User Account Control is DISABLE

+-----------------| Boonty/Boonty Games Elements Found:

Service: Boonty Games
.
HKLM\Software\Boonty
HKLM\System\ControlSet001\Services\Boonty Games
HKLM\System\ControlSet002\Services\Boonty Games
HKLM\System\CurrentControlSet\Services\Boonty Games
.
C:\Program Files\Common Files\BOONTY Shared
C:\ProgramData\BOONTY

+-----------------| Eorezo Elements Found:

.

+-----------------| Infected Poker Softwares Elements Found:

.

+-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

.
.

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

.

+-----------------| Other Adwares Found:

.
.

+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.3 ----

ProfilePath: 9qlq1vpk.default
.
Prefs.js: Browser.Search.SelectedEngine: "Wikipédia (fr
.
.
.
.
.

---- Internet Explorer Version 7.0.6001.18000 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.asus.com
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.google.fr/

+-[HKEY_USERS\S-1-5-21-2906814218-1208887731-2317783580-1000\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.asus.com
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.google.fr/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.asus.com
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

2434 Byte(s) - C:\Ad-Report-Scan-08.03.2009.log

0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

End at: 21:42:52 | 08/03/2009
.
+-----------------| E.O.F - 66 Lines
.

Ok merci, dans ce cas, je le réactive tout de suite :)

Voici le rapport après action comme tu décris :


------- LOGFILE OF AD-REMOVER 1.1.1.6 | ONLY XP/VISTA -------

Updated by C_XX on 07/03/2009 at 21:40

**** LIMITED TO ****

Boonty/BoontyGames

********************

Start at: 22:08:05 | Sun 08/03/2009 | Boot mode: Normal Boot
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
Computer Name: PC-DE-GUIMAUVE
Current User: Guimauve - Administrator
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\Windows\
System Directory: C:\Windows\System32\

--- Running Processes: 77
--- User Account Control is DISABLE

(!) ---- IE start pages/Tabs reset

+-----------------| Boonty/Boonty Games Elements Deleted :

Service: "Boonty Games"
.
HKLM\Software\Boonty
HKLM\System\ControlSet002\Services\Boonty Games
.
C:\Program Files\Common Files\BOONTY Shared
C:\ProgramData\BOONTY

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+-----------------| Added Scan :

---- Mozilla FireFox Version 3.0.3 ----

ProfilePath: 9qlq1vpk.default
.
Prefs.js: Browser.Search.SelectedEngine: "Wikipédia (fr
.
.
.
.
.

---- Internet Explorer Version 7.0.6001.18000 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_USERS\S-1-5-21-2906814218-1208887731-2317783580-1000\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

2725 Byte(s) - C:\Ad-Report-Clean-08.03.2009.log
2674 Byte(s) - C:\Ad-Report-Scan-08.03.2009.log

1 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

End at: 22:08:46 | 08/03/2009
.
+-----------------| E.O.F - 61 Lines
.

Alors voici déjà le scan Antivir : apparemment, il n'a rien détecté. Normal ?


Avira AntiVir Personal
Report file date: dimanche 8 mars 2009 22:19

Scanning for 1288155 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (Service Pack 1) [6.0.6001]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PC-DE-GUIMAUVE

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 11:38:25
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:39:57
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 10:01:03
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 12:47:39
ANTIVIR3.VDF : 7.1.2.135 157696 Bytes 07/03/2009 09:10:02
Engineversion : 8.2.0.105
AEVDF.DLL : 8.1.1.0 106868 Bytes 31/01/2009 19:47:26
AESCRIPT.DLL : 8.1.1.57 356729 Bytes 06/03/2009 05:28:33
AESCN.DLL : 8.1.1.8 127346 Bytes 06/03/2009 05:28:33
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 11:40:43
AEPACK.DLL : 8.1.3.10 397686 Bytes 05/03/2009 12:52:44
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 27/02/2009 14:38:49
AEHEUR.DLL : 8.1.0.104 1634679 Bytes 06/03/2009 05:28:32
AEHELP.DLL : 8.1.2.2 119158 Bytes 27/02/2009 14:38:45
AEGEN.DLL : 8.1.1.25 336243 Bytes 06/03/2009 05:28:31
AEEMU.DLL : 8.1.0.9 393588 Bytes 16/10/2008 08:59:20
AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 21:50:00
AEBB.DLL : 8.1.0.3 53618 Bytes 16/10/2008 08:59:19
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 08/09/2008 13:27:52
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: C:\program files\internet\sécurité\antivir\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: dimanche 8 mars 2009 22:19

Starting search for hidden objects.
'84397' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'mcupdate.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
Scan process 'SynTPHelper.exe' - '1' Module(s) have been scanned
Scan process 'CCC.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'UnlockerAssistant.exe' - '1' Module(s) have been scanned
Scan process 'SpywareTerminatorShield.Exe' - '1' Module(s) have been scanned
Scan process 'SynAsus.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'DMedia.exe' - '1' Module(s) have been scanned
Scan process 'ATKOSD2.exe' - '1' Module(s) have been scanned
Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
Scan process 'MOM.exe' - '1' Module(s) have been scanned
Scan process 'WDC.exe' - '1' Module(s) have been scanned
Scan process 'KBFiltr.exe' - '1' Module(s) have been scanned
Scan process 'asghost.exe' - '1' Module(s) have been scanned
Scan process 'ATKOSD.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'ACEngSvr.exe' - '1' Module(s) have been scanned
Scan process 'ASPG.exe' - '1' Module(s) have been scanned
Scan process 'BatteryLife.exe' - '1' Module(s) have been scanned
Scan process 'ACMON.exe' - '1' Module(s) have been scanned
Scan process 'wcourier.exe' - '1' Module(s) have been scanned
Scan process 'MsgTranAgt.exe' - '1' Module(s) have been scanned
Scan process 'HControl.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'sensorsrv.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'SDWinSec.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sp_rsser.exe' - '1' Module(s) have been scanned
Scan process 'spmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'GFNEXSrv.exe' - '1' Module(s) have been scanned
Scan process 'AsLdrSrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
70 processes with 70 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '47' files ).


Starting the file scan:

Begin scan in 'C:\' <VistaOS>
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>


End of the scan: dimanche 8 mars 2009 23:19
Used time: 1:00:26 Hour(s)

The scan has been done completely.

17035 Scanning directories
323582 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
323581 Files not concerned
2096 Archives were scanned
1 Warnings
0 Notes
84397 Objects were scanned with rootkit scan
0 Hidden objects were found

Et voici le dernier rapport : apparemment, rien non plus ! :)

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1827
Windows 6.0.6001 Service Pack 1

09/03/2009 06:00:37
mbam-log-2009-03-09 (06-00-37).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 176647
Temps écoulé: 3 hour(s), 18 minute(s), 1 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Hello !

Merci de te donner autant de mal ! :) Alors je me suis seulement permis de garder la clé correspondant à Ebuyertools, qui est un logiciel que j'ai installé volontairement et qui me permet de poser des enchères sur ebay sans être derrière mon écran ;)

Pour le reste, voici déjà le premier scan "info.txt" :
info.txt logfile of random's system information tool 1.05 2009-03-09 08:27:57

======Uninstall list======

2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
7-Zip 4.57-->"C:\Program Files\Bureautique\Dezippeur\7-Zip\Uninstall.exe"
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Shockwave Player-->C:\Windows\System32\Adobe\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Adobe\SHOCKW~1\Install.log
Ad-remover-->C:\Program Files\Ad-remover\Uninstall ADR.exe
Alchemy 1.2-->C:\Program Files\Jeux\Alchemy\UnGins.exe "C:\Program Files\Jeux\Alchemy\install.log"
ASUS CopyProtect-->C:\Program Files\InstallShield Installation Information\{2396F815-84E0-4353-83D7-8B190556DA42}\SETUP.exe -runfromtemp -l0x0009 -removeonly
ASUS InstantFun-->MsiExec.exe /I{57B15AD4-8C9D-4164-82BB-E33D8644E757}
ASUS LifeFrame3-->MsiExec.exe /I{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}
ASUS Live Update-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}\setup.exe" -l0x9
ASUS Security Protect Manager-->rundll32.exe "C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SetupHelper.dll",ExecMain /Uninstall {D8D4AF9A-6ADE-4B14-A7F5-BA858792729E}
ASUS SmartLogon-->MsiExec.exe /I{64452561-169F-4A36-A2FF-B5E118EC65F5}
ASUS Splendid Video Enhancement Technology-->C:\Program Files\InstallShield Installation Information\{C0FC1C14-4824-4A73-87A6-9E888C9C3102}\SETUP.exe -runfromtemp -l0x0009 -removeonly
Asus_Camera_ScreenSaver-->"C:\Windows\ASUS Camera ScreenSaver Uninstaller.exe"
ATK Generic Function Service-->C:\Program Files\InstallShield Installation Information\{D3D54F3E-C5C3-443D-978F-87A72E5616E8}\SETUP.exe -runfromtemp -l0x0009 -removeonly
ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\SETUP.exe -runfromtemp -l0x0009 -removeonly
ATK Media-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}\SETUP.EXE" -l0x9
ATKOSD2-->C:\Program Files\InstallShield Installation Information\{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}\SETUP.exe -runfromtemp -l0x0009 -removeonly
AuthenTec Fingerprint Sensor Minimum Install-->MsiExec.exe /I{EB4DF30B-102B-4F0C-927A-D50E037A325D}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Internet\Sécurité\Antivir\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Buyertools Reminder-->"C:\Program Files\Internet\Utilitaires\Ebidder\Uninstall.exe" "C:\Program Files\Internet\Utilitaires\Ebidder\install.log" -u
ccc-Branding-->MsiExec.exe /I{6E32B134-CA8D-49DD-B94C-0DB155CE70B5}
CCleaner (remove only)-->"C:\Program Files\Système\CCleaner\uninst.exe"
ChkMail-->C:\Program Files\InstallShield Installation Information\{250F0996-1830-40C8-9B1D-6874D808DD95}\setup.exe -runfromtemp -l0x0009 -removeonly
CyberLink LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.exe" -uninstall
Delicious winter edition Deluxe English-->"C:\Program Files\Jeux\Delicious\Uninstall\uninstall.exe" "/U:C:\Program Files\Jeux\Delicious\Uninstall\uninstall.xml"
DS Legends of Aranna-->"C:\Program Files\Jeux\Dungeon Siege\UNINSTAL.EXE" /runtemp /addremove
eMule-->"C:\Program Files\Internet\Utilitaires\Emule\Uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Insaniquarium Deluxe 1.0-->C:\Windows\iun6002.exe "C:\Program Files\Jeux\Insaniquarium\irunin.ini"
Insaniquarium Deluxe-->"C:\Program Files\Jeux\Insaniquarium\Insaniquarium Deluxe\GameInstaller.exe" --uninstall UnInstall.log
ITECIR Driver-->C:\Program Files\InstallShield Installation Information\{FCED9B62-34FF-4C15-8A23-F65221F7874D}\SETUP.exe -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
JMB36X Raid Configurer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\SETUP.exe" -l0x9 -removeonly
Lame ACM MP3 Codec-->"C:\Windows\IFinst26.exe" -UC:\Program Files\Divertissements autres\Lecteur MP3\Lame MP3 Codec\IFU9469.inf
Le Maître de l'Olympe - Zeus.-->C:\Windows\IsUn040c.exe -f"c:\program files\jeux\zeus\Le Maître de l' Olympe Zeus\Uninst.isu"
Les Sims™ 2 Double Deluxe-->C:\Program Files\Jeux\Sims\EAUninstall.exe
LightScribe System Software 1.12.37.1-->MsiExec.exe /X{004C5DA2-2051-4D25-94BA-51CF810C91EB}
Macromedia Flash Player 8-->MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Macromedia Flash Player 8-->RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\swflash.inf,DefaultUninstall,5
Malwarebytes' Anti-Malware-->"C:\Program Files\Internet\Sécurité\Malware Bytes\Malwarebytes' Anti-Malware\unins000.exe"
Micro Application - Faire-part 2006-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{887B7708-C997-4CD9-B3F6-270B97633CD2}\SETUP.EXE" -l0x40c
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Money-->C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Picture It! Photo 2001-->MsiExec.exe /I{D28FDA7D-15C6-48A2-9868-6BCB28BE6254}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Motorola SM56 Speakerphone Modem-->rundll32.exe sm56co6a.dll,SM56UnInstaller
Mozilla Firefox (3.0.3)-->C:\Program Files\Internet\Navigateur\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NB Probe-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}\setup.exe" -l0x9
P4P-->C:\Program Files\InstallShield Installation Information\{FC3D290D-79BE-44B7-ABF9-FDD110925930}\setup.exe -runfromtemp -l0x0009 -removeonly
Pharaon-->C:\Windows\IsUn040c.exe -f"c:\program files\jeux\pharaon\SIERRA\Pharaon\Uninst.isu"
Pharaon-->C:\Windows\IsUn040c.exe -f"c:\program files\jeux\pharaon\SIERRA\Pharaon\Uninst.isu" -c"c:\program files\jeux\pharaon\SIERRA\Pharaon\customuninstall.dll"
Plus de 200 000 Cliparts et Photos-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{D01940CE-8BD3-4258-B4E2-42F185AE1968}
Power2Go-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe" -uninstall
Power4Gear eXtreme-->C:\Program Files\InstallShield Installation Information\{8CFEBE9C-F29F-4C49-80E0-7106970F8734}\SETUP.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.exe" -l0x9 -removeonly
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\SETUP.EXE" -l0x9 anything
Samsung Media Studio-->C:\Program Files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\Setup.exe -runfromtemp -l0x040c -removeonly
Shockwave-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\INSTALL.LOG
SnagIt 7-->C:\Program Files\Bureautique\Snag It\SnagIt 7\SIUNINST.EXE
Spybot - Search & Destroy-->"C:\Program Files\Internet\Sécurité\Spybot Search & Destroy\Spybot - Search & Destroy\unins000.exe"
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
Sweet Home 3D version 1.3-->"C:\Program Files\Divertissements autres\Architecture_Sweet Home\Sweet Home 3D\unins000.exe"
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Unlocker 1.8.5-->C:\Program Files\Système\Unlocker\uninst.exe
USB2.0 1.3M UVC WebCam-->C:\Windows\Uninstall.exe
Vilma Registry Explorer-->"C:\Program Files\Système\RegExplorer\Uninstall.exe" "C:\Program Files\Système\RegExplorer\install.log"
Windows Driver Package - ITE Tech.Inc. (itecir) HIDClass (06/20/2007 5.0.0004.2)-->C:\PROGRA~1\DIFX\F46A63020E122F0A\DPInst.exe /u C:\Windows\System32\DriverStore\FileRepository\itecir.inf_709ef2e8\itecir.inf
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinFlash-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE10AB76-4756-4913-BE25-55D1C1051F9A}\setup.exe" -l0x9
Wireless Console 2-->C:\Program Files\InstallShield Installation Information\{83F73CB1-7705-49D1-9852-84D839CA2A45}\SETUP.exe -runfromtemp -l0x0009 -removeonly
XviD MPEG-4 Video Codec-->"C:\Program Files\Divertissements autres\Lecteur MP3\XviD\unins000.exe"

=====HijackThis Backups=====

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AS: Spybot - Search and Destroy (disabled) (outdated)
AS: Windows Defender

System event log

Computer Name: PC-de-Guimauve
Event Code: 7036
Message: Le service Programme d’installation de modules Windows est entré dans l'état : en cours d'exécution.
Record Number: 67447
Source Name: Service Control Manager
Time Written: 20090309063957.000000-000
Event Type: Information
User:

Computer Name: PC-de-Guimauve
Event Code: 1
Message: L’heure du système est passée à 2009-03-09T06:46:01.089Z à partir de 2009-03-09T06:46:01.248Z.
Record Number: 67448
Source Name: Microsoft-Windows-Kernel-General
Time Written: 20090309064601.089000-000
Event Type: Information
User: PC-de-Guimauve\Guimauve

Computer Name: PC-de-Guimauve
Event Code: 7036
Message: Le service Programme d’installation de modules Windows est entré dans l'état : arrêté.
Record Number: 67449
Source Name: Service Control Manager
Time Written: 20090309064957.000000-000
Event Type: Information
User:

Computer Name: PC-de-Guimauve
Event Code: 7036
Message: Le service Service de découverte automatique de Proxy Web pour les services HTTP Windows est entré dans l'état : arrêté.
Record Number: 67450
Source Name: Service Control Manager
Time Written: 20090309065619.000000-000
Event Type: Information
User:

Computer Name: PC-de-Guimauve
Event Code: 1
Message: L’heure du système est passée à 2009-03-09T07:17:00.984Z à partir de 2009-03-09T07:17:00.880Z.
Record Number: 67451
Source Name: Microsoft-Windows-Kernel-General
Time Written: 20090309071700.984000-000
Event Type: Information
User: PC-de-Guimauve\Guimauve

Application event log

Computer Name: PC-de-Guimauve
Event Code: 8224
Message: Le service VSS s’arrête, car le délai d’inactivité est dépassé.
Record Number: 13867
Source Name: VSS
Time Written: 20090308220432.000000-000
Event Type: Information
User:

Computer Name: PC-de-Guimauve
Event Code: 8224
Message: Le service VSS s’arrête, car le délai d’inactivité est dépassé.
Record Number: 13868
Source Name: VSS
Time Written: 20090309011219.000000-000
Event Type: Information
User:

Computer Name: PC-de-Guimauve
Event Code: 1
Message: Le client des services de certification a démarré correctement.
Record Number: 13869
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20090309043843.930075-000
Event Type: Information
User: PC-de-Guimauve\Guimauve

Computer Name: PC-de-Guimauve
Event Code: 32
Message: Le magasin C:\Users\Guimauve\AppData\Local\Microsoft\Outlook\Outlook.pst a détecté un point de contrôle.
Record Number: 13870
Source Name: Outlook
Time Written: 20090309050333.000000-000
Event Type: Information
User:

Computer Name: PC-de-Guimauve
Event Code: 5
Message: Unsupported service control request (see data below)
Record Number: 13871
Source Name: LightScribeService
Time Written: 20090309072756.000000-000
Event Type: Information
User:

Security event log

Computer Name: PC-de-Guimauve
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21606
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090309072755.756000-000
Event Type: Échec de l'audit
User:

Computer Name: PC-de-Guimauve
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21607
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090309072755.777000-000
Event Type: Échec de l'audit
User:

Computer Name: PC-de-Guimauve
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21608
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090309072755.797000-000
Event Type: Échec de l'audit
User:

Computer Name: PC-de-Guimauve
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21609
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090309072755.818000-000
Event Type: Échec de l'audit
User:

Computer Name: PC-de-Guimauve
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21610
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090309072755.848000-000
Event Type: Échec de l'audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\bin;C:\Windows\Microsoft.NET\Framework\v2.0.50727
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=1706
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE

-----------------EOF-----------------

Et voici le deuxième "log.txt" :

Logfile of random's system information tool 1.05 (written by random/random)
Run by Guimauve at 2009-03-09 08:32:22
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 94 GB (62%) free of 153 GB
Total RAM: 3070 MB (40% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:32:26, on 09/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Internet\Sécurité\Antivir\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Synaptics\SynTP\SynAsus.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Système\Unlocker\UnlockerAssistant.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\explorer.exe
C:\Program Files\Internet\Utilitaires\Emule\emule.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\Internet\Utilitaires\Ebidder\Reminder.exe
C:\PROGRA~1\Internet\UTILIT~1\Ebidder\REMIND~1.EXE
C:\Program Files\Internet\Navigateur\firefox.exe
C:\Program Files\Internet\Sécurité\Spybot Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Guimauve\Documents\Distributions\Internet\Sécurité\Radom's System Information Tool.exe
C:\Program Files\Trend Micro\HijackThis\Guimauve.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.asus.com/fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.asus.com/fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\Bureautique\Snag It\SnagIt 7\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Internet\SCURIT~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Buyertools - {7C7A8947-5935-4430-AC0E-E7D04697414E} - C:\PROGRA~1\Internet\UTILIT~1\Ebidder\IEBUTT~1.DLL
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\Bureautique\Snag It\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Internet\Sécurité\Antivir\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Système\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Internet\Sécurité\Malware Bytes\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Buyertools Reminder] "C:\Program Files\Internet\Utilitaires\Ebidder\Reminder.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Internet\Sécurité\Spybot Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra button: Buyertools Reminder - {27914077-B4D6-4A0E-9763-76B6E9DD9A81} - C:\Program Files\Internet\Utilitaires\Ebidder\ReminderIE.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Internet\SCURIT~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Internet\SCURIT~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O20 - AppInit_DLLs: secuload.dll,apshook.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Internet\Sécurité\Antivir\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Internet\Sécurité\Antivir\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Internet\Sécurité\Spybot Search & Destroy\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Alors voici le rapport du premier logiciel : (je lance maintenant l'étape 2 de ce même fichier texte, puis le scan kaspersky)

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{376ccee3-016a-11de-a97c-00221535b9bb}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d22c70fa-7b2c-11dd-9295-00221535b9bb}\\ deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLS"|"" /E : value set successfully!
========== COMMANDS ==========
File delete failed. C:\Users\Guimauve\AppData\Local\Temp\etilqs_Agek8hdV0SBKTfyQPIAj scheduled to be deleted on reboot.
File delete failed. C:\Users\Guimauve\AppData\Local\Temp\fb_8148.lck scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03092009_085724

Files moved on Reboot...
File C:\Users\Guimauve\AppData\Local\Temp\etilqs_Agek8hdV0SBKTfyQPIAj not found!
File C:\Users\Guimauve\AppData\Local\Temp\fb_8148.lck not found!
C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_001_ moved successfully.
C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_002_ moved successfully.
C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_003_ moved successfully.
C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\urlclassifier3.sqlite moved successfully.
C:\Users\Guimauve\AppData\Local\Mozilla\Firefox\Profiles\9qlq1vpk.default\XUL.mfl moved successfully.