[Virus] a.bat Résolu

Question

Bonjour à tous,

Je suis infecté par le fichier a.bat qui apparaît à chaque démarrage dans c:/a.bat . Quand Avast me le détecte, je le supprime mais il revient. Mais, dès la suppression effectuée, Zone Alarm me demande si je peux donner l'accès au fichier windir.exe. Je n'ai jamais fait "accepter" de peur qu'il ne s'agisse d'une tentacule insidieuse de cette infection.

Je serai ravi si vous m'accorderiez quelques instants pour venir à bout de mon problèmes.

Bien à vous,

PS : je peux aisément vous transmettre le contenu de a.bat si vous le désirez.

Jtb.

tristan07 · Answer

http://www.bitdefender.fr/scan_fr/scan8/ie.html fais un scan avec bit defender et poste le rapport stp

jtb · Answer

Salut,

Impossible de faire ce scan : dès que la barre du module complémentaire apparaît, Internet Explorer 8.0 plante.

Bien à toi,

tristan07 · Answer

bon ok on va faire autrement desinstalle avast installe antivir9.0 https://www.clubic.com/telecharger-fiche10821-avira-antivir-personal-free-antivirus.html
installe le puis fais la mise a jour aprés avoir fais la mise il faut faire un scan avec et faire repair all a la fin du scan

jtb · Answer

Salut, merci de ta réponse.

Voilà tout d'abord un rapport HiJackThis avant le scan d'Antivir 9.0 :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45:06, on 13/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\EmvSmartCardReader\SmartMON.exe
C:\Program Files\EmvSmartCardReader\BePCSC.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\WINDOWS\system32\Windir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=BE&ceid=BE:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SmartMon] C:\Program Files\EmvSmartCardReader\SmartMON.exe
O4 - HKLM\..\Run: [BePCSC] C:\Program Files\EmvSmartCardReader\BePCSC.exe
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Manager System] Windir.exe
O4 - HKLM\..\RunServices: [Windows Manager System] Windir.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: eID CRL Service -  Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jtb · Answer

Re,

Voilà, Antivir ne détecte plus rien. a.bat n'apparaît plus dans c:/. 

Dois-je conclure que Avast est daubique ? Au, du moins, inférieur à Antivir ?

Bien à toi,

Jtb.

tristan07 · Answer

oui avast est inférieur a antivir mais antivir a fait des détections ou pas ?

jtb · Answer

Oui. En fait dans l'analyse en elle-même il n'a rien trouvé de spécial (des warnings et quelques cracks j'avoue) mais dès que je l'avais installé il a détecte le fameux a.bat et l'a supprimé. Il a aussi du supprimer le fichier source que le générait à chaque fois mais dans les rapports Antivir il n'y a rien de tel. Vois-tu quelque chose de suspect dans les HiJackThis ?

tristan07 · Answer

il me faudrait le rapport donc tu ouvre antivir tu va dans reports ensuite tu regarde la ou il y a dans la liste scan ( celui avec un triangle avec un "!") double clic dessus puis tu clic sur report file et ensuite il vas ouvrir un bloc note avec le rapport colle ici

jtb · Answer

Voilà le rapport (j'ai supprimé les trucs persos, du coup il ne reste plus grand chose) :



Avira AntiVir Personal
Report file date: lundi 13 avril 2009  11:56

Scanning for 1347111 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows XP
Windows version : (Service Pack 3)  [5.1.2600]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : JOHN-BUREAU

Version information:
BUILD.DAT       : 9.0.0.387     17962 Bytes  24/03/2009 11:04:00
AVSCAN.EXE      : 9.0.3.3      464641 Bytes  24/02/2009 10:13:26
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  27/02/2009 08:58:24
LUKE.DLL        : 9.0.3.2      209665 Bytes  20/02/2009 09:35:49
LUKERES.DLL     : 9.0.2.0       12033 Bytes  27/02/2009 08:58:52
ANTIVIR0.VDF    : 7.1.0.0    15603712 Bytes  27/10/2008 10:30:36
ANTIVIR1.VDF    : 7.1.2.12    3336192 Bytes  11/02/2009 18:33:26
ANTIVIR2.VDF    : 7.1.3.0     1330176 Bytes   1/04/2009 09:55:39
ANTIVIR3.VDF    : 7.1.3.42     169984 Bytes  11/04/2009 09:55:40
Engineversion   : 8.2.0.138
AEVDF.DLL       : 8.1.1.0      106868 Bytes  27/01/2009 15:36:42
AESCRIPT.DLL    : 8.1.1.73     373114 Bytes  13/04/2009 09:55:46
AESCN.DLL       : 8.1.1.10     127348 Bytes  13/04/2009 09:55:46
AERDL.DLL       : 8.1.1.3      438645 Bytes  29/10/2008 16:24:41
AEPACK.DLL      : 8.1.3.12     397687 Bytes  13/04/2009 09:55:45
AEOFFICE.DLL    : 8.1.0.36     196987 Bytes  26/02/2009 18:01:56
AEHEUR.DLL      : 8.1.0.114   1700214 Bytes  13/04/2009 09:55:44
AEHELP.DLL      : 8.1.2.2      119158 Bytes  26/02/2009 18:01:56
AEGEN.DLL       : 8.1.1.33     340340 Bytes  13/04/2009 09:55:41
AEEMU.DLL       : 8.1.0.9      393588 Bytes   9/10/2008 12:32:40
AECORE.DLL      : 8.1.6.7      176502 Bytes  13/04/2009 09:55:40
AEBB.DLL        : 8.1.0.3       53618 Bytes   9/10/2008 12:32:40
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  12/12/2008 06:47:59
AVPREF.DLL      : 9.0.0.1       43777 Bytes   5/12/2008 08:32:15
AVREP.DLL       : 8.0.0.3      155905 Bytes  20/01/2009 12:34:28
AVREG.DLL       : 9.0.0.0       36609 Bytes   5/12/2008 08:32:09
AVARKT.DLL      : 9.0.0.1      292609 Bytes   9/02/2009 05:52:24
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  30/01/2009 08:37:08
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  28/01/2009 13:03:49
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes   2/02/2009 06:21:33
NETNT.DLL       : 9.0.0.0       11521 Bytes   5/12/2008 08:32:10
RCIMAGE.DLL     : 9.0.0.21    2438401 Bytes   9/02/2009 09:45:45
RCTEXT.DLL      : 9.0.35.0      87297 Bytes  11/03/2009 13:55:12

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: lundi 13 avril 2009  11:56

Starting search for hidden objects.
'43701' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'msiexec.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'BTSTAC~1.EXE' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned
Scan process 'Windir.exe' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'BTTray.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'ACDaemon.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'vsnpstd.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'beidsystemtray.exe' - '1' Module(s) have been scanned
Scan process 'BePCSC.exe' - '1' Module(s) have been scanned
Scan process 'SmartMON.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
Scan process 'oodag.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'beidservicecrl.exe' - '1' Module(s) have been scanned
Scan process 'btwdins.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'ACService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
59 processes with 59 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).
The registry was scanned ( '76' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\WINDOWS\system32\drivers\sptd.sys
    [WARNING]   The file could not be opened!
Begin scan in 'D:\' <Disque Local 2>

  [0] Archive type: RAR SFX (self extracting)
    --> Cab\4D801849.cab
      [1] Archive type: CAB (Microsoft)
      --> NeroSearchAdvanced3C3D1DE3.exe
        [WARNING]   The file could not be written!
    --> Cab\85F58EAC.cab
      [1] Archive type: CAB (Microsoft)
      --> InCDshxD3515FC4.dll
        [WARNING]   The file could not be written!
    --> Cab\A75C16D6.cab
      [1] Archive type: CAB (Microsoft)
      --> MMCA56CDF51.dll
        [WARNING]   The file could not be written!
      --> nero50DEFBE1.txt
        [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> Cab\B1EFF3E9.cab
      [1] Archive type: CAB (Microsoft)
      --> NMDataServicesFA9ABD74.dll
        [WARNING]   The file could not be written!
      --> NMFirstStart4C0FBCE6.exe
        [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> Cab\C1447997.cab
      [1] Archive type: CAB (Microsoft)
      --> NMBCInterfacePSAE565723.dll
        [WARNING]   The file could not be written!
      --> NMBCWriterDC0FE966.exe
        [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> Cab\D6C89E66.cab
      [1] Archive type: CAB (Microsoft)
      --> KARAOKE3DE180FF.DLL
        [WARNING]   The file could not be written!
      --> nero920D0564.exe
        [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> Cab\DC682368.cab
      [1] Archive type: CAB (Microsoft)
      --> DXEnumD7927B84.exe
        [WARNING]   The file could not be written!
      --> VSTBridge02A75A4C.dll
        [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> Cab\DD3AACFD.cab
      [1] Archive type: CAB (Microsoft)
      --> gaa87623F1A.bin
        [WARNING]   The file could not be written!
      --> incd1252685369A4.txt
        [WARNING]   No further files can be extracted from this archive. The archive will be closed


Beginning disinfection:



End of the scan: lundi 13 avril 2009  12:37
Used time: 40:48 Minute(s)

The scan has been done completely.

  11205 Scanned directories
 608261 Files were scanned
      8 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      7 Files were moved to quarantine
      0 Files were renamed
      2 Files cannot be scanned
 608251 Files not concerned
   6218 Archives were scanned
     16 Warnings
      8 Notes
  43701 Objects were scanned with rootkit scan
      0 Hidden objects were found

tristan07 · Answer

pourquoi tu as enlever "les trucs perso " c'est des film porno c'est sa ? au pire c pas grave tu sais suivant l'infection qui ect détecter on le sais sa ..

jtb · Answer

Non pas du tout. Il s'agit de serial détectés en tant que crack. :-)

Ce qui est embêtant c'est que j'ai redémarré mon PC il le a.bat est revenu. o//

jlpjlp · Answer

slt je pense a une infection par disque amovible: pour verifier: Télécharge et installe UsbFix de C_XX & Chiquitine29 Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir # Double clic sur le raccourci UsbFix présent sur ton bureau . # Choisi l option 1 ( Recherche ) # Laisse travailler l outil. # Ensuite post le rapport UsbFix.txt qui apparaitra. # Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt ) ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) # Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

jtb · Answer

Salut et merci de ton attention à mon égard.

Voici le rapport en question : 


############################## [ UsbFix V3.006 ] 

# User : Jonathan (Administrateurs) # JOHN-BUREAU
# Update on 11/04/09 by C_XX & Chiquitine29
# Start at: 16:46:43 | 13/04/2009

# Processeur Intel Pentium III Xeon
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]
# FW : ZoneAlarm Firewall[ Enabled ]7.0.483.000

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 465,76 Go (419,96 Go free) # NTFS
# D:\ # Disque fixe local # 931,51 Go (375,9 Go free) [Disque Local 2] # NTFS
# E:\ # Disque fixe local # 232,88 Go (75,38 Go free) [My Book] # NTFS
# F:\ # Disque CD-ROM
# G:\ # Disque CD-ROM
# H:\ # Disque amovible # 7,45 Go (7,45 Go free) [USB DISK] # FAT32
# I:\ # Disque amovible # 1,86 Go (1,86 Go free) [KINGSTON] # FAT
# J:\ # Disque fixe local # 232,88 Go (232,78 Go free) [Maxtor Portable] # NTFS
 
############################## [ Processus actifs ] 
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\Scardsvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\EmvSmartCardReader\SmartMON.exe
C:\Program Files\EmvSmartCardReader\BePCSC.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\Windir.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

################## [  Registre # Startup ] 

HKCU_Main:  "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:  "Start Page"="https://news.google.com/topstories?hl=fr&gl=BE&ceid=BE:fr" 
HKLM_logon: "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon: "DefaultUserName"="Jonathan" 
HKLM_logon: "AltDefaultUserName"="Jonathan" 
HKLM_logon: "LegalNoticeCaption"="" 
HKLM_logon: "LegalNoticeText"="" 
HKLM_Run:    IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 
HKLM_Run:    PHIME2002ASync=C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC 
HKLM_Run:    PHIME2002A=C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName 
HKLM_Run:    NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
HKLM_Run:    nwiz=nwiz.exe /install 
HKLM_Run:    Kernel and Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    SmartMon=C:\Program Files\EmvSmartCardReader\SmartMON.exe 
HKLM_Run:    BePCSC=C:\Program Files\EmvSmartCardReader\BePCSC.exe 
HKLM_Run:    beidsystemtray=C:\Program Files\Belgium Identity Card\beidsystemtray.exe 
HKLM_Run:    HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe 
HKLM_Run:    BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
HKLM_Run:    snpstd=C:\WINDOWS\vsnpstd.exe 
HKLM_Run:    OODefragTray=C:\WINDOWS\system32\oodtray.exe 
HKLM_Run:    ZoneAlarm Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
HKLM_Run:    RTHDCPL=RTHDCPL.EXE 
HKLM_Run:    Alcmtr=ALCMTR.EXE 
HKLM_Run:    NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
HKLM_Run:    ArcSoft Connection Service=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe 
HKLM_Run:    SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" 
HKLM_Run:    iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe" 
HKLM_Run:    Windows Manager System=Windir.exe 
HKLM_Run:    avgnt="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe  

################## [ Informations ] 
 

################## [ Fichiers # Dossiers infectieux ] 

 
################## [ Registre # Clés infectieuses ] 
 
# -> Not Found !  
 
################## [ Registre # Mountpoint2 ] 
 
# -> Not Found !  

################## [ ! Fin du rapport # UsbFix V3.006 ! ]

jlpjlp · Answer

télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.


:files
 c:/a.bat


clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

_____________________

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

jtb · Answer

Resalut,

Le fichier a.bat n'est plus présent dans c:/. Donc l'erreur de OTMove doit provenir de cela je suppose. voici ce qu'il me dit : "Invalid time flag! [a.bat] Must be numerical".

Voici les deux rapports de RSIT :

Info.txt :

info.txt logfile of random's system information tool 1.06 2009-04-13 17:41:00

======Uninstall list======

-->MsiExec /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
3DMark06-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9  -removeonly
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft Software Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{497A1721-088F-41EF-8876-B43C9DA5528B}\Setup.exe" -l0x40c 
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
ASUSUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\setup.exe" -l0x40c 
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\Setup.exe" -runfromtemp -l0x040c -removeonly
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Azureus-->C:\Program Files\Azureus\Uninstall.exe
Belgium Identity Card Run-time 2.6-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EA248851-A7D5-4906-8C46-A3CA267F6A24} /l1036 
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
E-Microscope-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57383270-6F61-4DC8-A9B8-C1745FC29F38}\Setup.exe" -l0x9 
ffdshow [rev 2527] [2008-12-19]-->"C:\Program Files\ffdshow\unins000.exe"
Free Download Manager 2.5-->"C:\Program Files\Free Download Manager\unins000.exe"
Gadwin PrintScreen-->C:\Program Files\Gadwin Systems\PrintScreen\Uninstall.exe
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_11CB06797F2F038A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HDD Health v3.2 Beta-->"C:\Program Files\HDD Health\unins000.exe"
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
HP Imaging Device Functions 7.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Solution Center 7.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
IE7Pro-->C:\Program Files\IEPro\uninst.exe
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0}
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
K!TV-->C:\Program Files\K!TV\UninstKTV.exe
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
Ma-Config.com-->MsiExec.exe /X{1C02A760-1682-49AE-BB54-FA7D63BD3504}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.21)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSI 8624 BDA Driver-->C:\WINDOWS\p3xunist.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 9-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
O&O Defrag Professional Edition-->MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
OCCT Perestroika 2.0.1-->"C:\Program Files\OCCT\unins000.exe"
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Package de base Microsoft de service de chiffrement pour cartes à puce-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Philips SA19XX Device Manager-->"C:\Program Files\InstallShield Installation Information\{57B18739-7A22-44D7-A263-6E2A2180D3BC}\setup.exe" -runfromtemp -l0x040c -removeonly
PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre Studio\Uninst.exe"
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
PowerArchiver 2006 v9.64 French-->"C:\Program Files\PowerArchiver\unins000.exe"
PowerQuest PartitionMagic 8.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804} 
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
RivaTuner v2.11-->"C:\Program Files\RivaTuner v2.11\uninstall.exe"
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SmartCard Reader Driver Installation-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{C6D91586-9F98-4CFD-9BC3-FC0800911005} /l1033 
SpeedFan (remove only)-->"C:\Program Files\SpeedFan\uninstall.exe"
Spelling Check Dictionary From OpenOffice.org-->"C:\Program Files\IEPro\unins000.exe"
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SUPER © Version 2009.bld.35 (Jan 5, 2009)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TuneUp Utilities 2007-->MsiExec.exe /I{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}
TV@Anywhere Utilities-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{477AB148-138C-46D2-820B-0DBFA744CEE8}\setup.exe" -l0x40c  -uninst 
Uniblue DriverScanner 2009-->"C:\Documents and Settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}\DriverScanner_Setup.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue DriverScanner 2009-->C:\Documents and Settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}\DriverScanner_Setup.exe
Uniblue RegistryBooster 2009-->"C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue RegistryBooster 2009-->C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe
Uniblue SpeedUpMyPC 2009-->"C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}\SpeedUpMyPC.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue SpeedUpMyPC 2009-->C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}\SpeedUpMyPC.exe
Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {49E314EE-81FA-4007-8F1A-8D39BDBB4498}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb962871)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {297857BF-4011-449B-BD74-DB64D182821C}
UsbFix-->C:\UsbFix\Uninstal.exe
VLC media player 0.9.6-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Watchtower Library 2008 - Français-->C:\Program Files\Watchtower\Watchtower Library 2008\F\uninst.exe
WIDCOMM Bluetooth Software-->MsiExec.exe /X{FE90E9E7-A158-4687-8853-DF677A939A61}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{01523985-2098-43AF-9C97-12B07BE02A9B}
Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
ZoneAlarm-->C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AV: AntiVir Desktop
FW: ZoneAlarm Firewall

======System event log======

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 18872
Source Name: Service Control Manager
Time Written: 20090325175213.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 18836
Source Name: Service Control Manager
Time Written: 20090325124714.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 18798
Source Name: Service Control Manager
Time Written: 20090324233425.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 18749
Source Name: Service Control Manager
Time Written: 20090324232014.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 18673
Source Name: Tcpip
Time Written: 20090324225956.000000+060
Event Type: warning
User: 

=====Application event log=====

Computer Name: JOHN-BUREAU
Event Code: 1000
Message: Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d.

Record Number: 1513
Source Name: Application Error
Time Written: 20081224214829.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1000
Message: Application défaillante iexplore.exe, version 7.0.6000.16762, module défaillant unknown, version 0.0.0.0, adresse de défaillance 0x03fd79b0.

Record Number: 1512
Source Name: Application Error
Time Written: 20081224214825.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1
Message: 
Record Number: 1503
Source Name: nview_info
Time Written: 20081223230244.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1517
Message: Windows a sauvegardé le Registre utilisateur JOHN-BUREAU\Jonathan alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé. 


Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

Record Number: 1484
Source Name: Userenv
Time Written: 20081222073334.000000+060
Event Type: warning
User: AUTORITE NT\SYSTEM

Computer Name: JOHN-BUREAU
Event Code: 1517
Message: Windows a sauvegardé le Registre utilisateur JOHN-BUREAU\Jonathan alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé. 


Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

Record Number: 1460
Source Name: Userenv
Time Written: 20081219040845.000000+060
Event Type: warning
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=170a
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"tvdumpflags"=8
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jonathan at 2009-04-13 17:40:47
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 431 GB (90%) free of 477 GB
Total RAM: 2047 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:40:58, on 13/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\EmvSmartCardReader\SmartMON.exe
C:\Program Files\EmvSmartCardReader\BePCSC.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\Windir.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jonathan\Bureau\OTMoveIt3.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jonathan\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Jonathan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=BE&ceid=BE:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SmartMon] C:\Program Files\EmvSmartCardReader\SmartMON.exe
O4 - HKLM\..\Run: [BePCSC] C:\Program Files\EmvSmartCardReader\BePCSC.exe
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Manager System] Windir.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\RunServices: [Windows Manager System] Windir.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: eID CRL Service -  Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jlpjlp · Answer

pour otmovit

tu as bien mis


:files         ???   avant le fichier?



puis colle un rapoprt antivir pour voir si encore infecté

jtb · Answer

Re,

En fait j'ai inversé la bare "/" en "\ et sa a marché.

========== FILES ==========
c:\a.bat moved successfully.
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04132009_190048

Je fais pour le moment un Antivir.

A+

jtb · Answer

Resalut,

Antivir a détecte le fichier a.bat que l'autre programmé à mové, mais rien de plus :



Avira AntiVir Personal
Report file date: lundi 13 avril 2009  19:03

Scanning for 1347764 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows XP
Windows version : (Service Pack 3)  [5.1.2600]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : JOHN-BUREAU

Version information:
BUILD.DAT       : 9.0.0.387     17962 Bytes  24/03/2009 11:04:00
AVSCAN.EXE      : 9.0.3.3      464641 Bytes  24/02/2009 10:13:26
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  27/02/2009 08:58:24
LUKE.DLL        : 9.0.3.2      209665 Bytes  20/02/2009 09:35:49
LUKERES.DLL     : 9.0.2.0       12033 Bytes  27/02/2009 08:58:52
ANTIVIR0.VDF    : 7.1.0.0    15603712 Bytes  27/10/2008 10:30:36
ANTIVIR1.VDF    : 7.1.2.12    3336192 Bytes  11/02/2009 18:33:26
ANTIVIR2.VDF    : 7.1.3.0     1330176 Bytes   1/04/2009 09:55:39
ANTIVIR3.VDF    : 7.1.3.43     178688 Bytes  13/04/2009 17:03:26
Engineversion   : 8.2.0.138
AEVDF.DLL       : 8.1.1.0      106868 Bytes  27/01/2009 15:36:42
AESCRIPT.DLL    : 8.1.1.73     373114 Bytes  13/04/2009 09:55:46
AESCN.DLL       : 8.1.1.10     127348 Bytes  13/04/2009 09:55:46
AERDL.DLL       : 8.1.1.3      438645 Bytes  29/10/2008 16:24:41
AEPACK.DLL      : 8.1.3.12     397687 Bytes  13/04/2009 09:55:45
AEOFFICE.DLL    : 8.1.0.36     196987 Bytes  26/02/2009 18:01:56
AEHEUR.DLL      : 8.1.0.114   1700214 Bytes  13/04/2009 09:55:44
AEHELP.DLL      : 8.1.2.2      119158 Bytes  26/02/2009 18:01:56
AEGEN.DLL       : 8.1.1.33     340340 Bytes  13/04/2009 09:55:41
AEEMU.DLL       : 8.1.0.9      393588 Bytes   9/10/2008 12:32:40
AECORE.DLL      : 8.1.6.7      176502 Bytes  13/04/2009 09:55:40
AEBB.DLL        : 8.1.0.3       53618 Bytes   9/10/2008 12:32:40
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  12/12/2008 06:47:59
AVPREF.DLL      : 9.0.0.1       43777 Bytes   5/12/2008 08:32:15
AVREP.DLL       : 8.0.0.3      155905 Bytes  20/01/2009 12:34:28
AVREG.DLL       : 9.0.0.0       36609 Bytes   5/12/2008 08:32:09
AVARKT.DLL      : 9.0.0.1      292609 Bytes   9/02/2009 05:52:24
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  30/01/2009 08:37:08
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  28/01/2009 13:03:49
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes   2/02/2009 06:21:33
NETNT.DLL       : 9.0.0.0       11521 Bytes   5/12/2008 08:32:10
RCIMAGE.DLL     : 9.0.0.21    2438401 Bytes   9/02/2009 09:45:45
RCTEXT.DLL      : 9.0.35.0      87297 Bytes  11/03/2009 13:55:12

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: lundi 13 avril 2009  19:03

Starting search for hidden objects.
'43635' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'BTSTAC~1.EXE' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'Windir.exe' - '1' Module(s) have been scanned
Scan process 'BTTray.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'ACDaemon.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'vsnpstd.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'beidsystemtray.exe' - '1' Module(s) have been scanned
Scan process 'BePCSC.exe' - '1' Module(s) have been scanned
Scan process 'SmartMON.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
Scan process 'oodag.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'beidservicecrl.exe' - '1' Module(s) have been scanned
Scan process 'btwdins.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'ACService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
55 processes with 55 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).
The registry was scanned ( '76' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\WINDOWS\system32\drivers\sptd.sys
    [WARNING]   The file could not be opened!
C:\_OTMoveIt\MovedFiles\04132009_190048\a.bat
    [DETECTION] Contains recognition pattern of the BAT/REG.Zapchast batch virus
Begin scan in 'D:\' <Disque Local 2>

Beginning disinfection:
C:\_OTMoveIt\MovedFiles\04132009_190048\a.bat
    [DETECTION] Contains recognition pattern of the BAT/REG.Zapchast batch virus
    [NOTE]      The file was moved to '4a4578ab.qua'!


End of the scan: lundi 13 avril 2009  19:38
Used time: 34:20 Minute(s)

The scan has been done completely.

  11027 Scanned directories
 579918 Files were scanned
      1 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      1 Files were moved to quarantine
      0 Files were renamed
      2 Files cannot be scanned
 579915 Files not concerned
   5064 Archives were scanned
      2 Warnings
      2 Notes
  43635 Objects were scanned with rootkit scan
      0 Hidden objects were found

jlpjlp · Answer

ok vire le fichier movedfiles en allant dans poste de travail puis c puis 
C:\_OTMoveIt\MovedFiles\


____________________

lance tool cleaner pour virer ce qui a été utilisé: 

http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
_____________________

en complément d'antivir mets SPYBOT sans activer le tea timer:  

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html

jtb · Answer

_ Le répertoire en question supprimé.

_ J'ai exécuté l'utilitaire Toolscleaner.

_ Je possédais déjà Spybot. J'ai refais un test mais il n'a rien trouvé.

jlpjlp · Answer

ok

encore des soucis?




tu peux aussi mettre en gratos malwarebyte qui est top:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/













pour protéger gratos ton ordi
http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

ANTIVIR
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MALWAREBYTE ANTIMALWARE + SPYBOT
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

--------
un pare feu :
(celui de Windows) ou mieux COMODO ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

http://www.clubic.com/telecharger-fiche11071-sunbelt-persona­l-firewall-e(...)
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.commentcamarche.net/telecharger/ 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf

jtb · Answer

Salut,

Oui, le a.bat revient encore. -_-

J'ai déjà Malwarebyte antimalware. Je vais installer SPYWAREBLASTER. On n'arrive pas à en être quitte de ce machin. :-(

Bon aprèm',

Jtb.

jlpjlp · Answer

ok il revient mais entre temps tu branche un disque , une clé ???


télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

___________

colle un rapport avec ceci option 1:  smitfraudfix:
http://siri.urz.free.fr/Fix/SmitfraudFix.php

jtb · Answer

Salut,

Non, je ne branche strictement rien dessus. Le fichier revient quand je redémarre mon pc. 

Avira Antivir ne nomme l'infaction : BAT/REG.ZAPCHAST.

Voici le rapport ComboFix :

ComboFix 09-04-14.09 - Jonathan 14/04/2009 18:45.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.32.1036.18.2047.1453 [GMT 2:00]
Lancé depuis: c:\documents and settings\Jonathan\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *disabled*
 * Un nouveau point de restauration a été créé

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-03-14 au 2009-04-14  ))))))))))))))))))))))))))))))))))))
.

2009-04-14 16:39 . 2009-04-14 16:39	--------	d-----w	c:\documents and settings\All Users\Application Data\TEMP
2009-04-14 16:39 . 2009-04-14 16:39	--------	d-----w	c:\program files\SpywareBlaster
2009-04-13 20:37 . 2009-04-13 20:37	--------	d-----w	c:\documents and settings\All Users\Application Data\Grisoft
2009-04-13 10:38 . 2009-04-13 11:21	--------	d-----r	c:\documents and settings\LocalService\Mes documents
2009-04-13 09:55 . 2009-04-13 09:55	--------	d-sh--w	c:\documents and settings\LocalService\IETldCache
2009-04-13 09:53 . 2009-02-13 09:31	55640	----a-w	c:\windows\system32\drivers\avgntflt.sys
2009-04-13 09:53 . 2009-04-13 09:53	--------	d-----w	c:\program files\Avira
2009-04-13 09:53 . 2009-04-13 09:53	--------	d-----w	c:\documents and settings\All Users\Application Data\Avira
2009-04-13 09:44 . 2009-04-13 19:00	--------	d-----w	c:\program files\Trend Micro
2009-04-11 18:14 . 2009-04-11 18:14	271386	----a-w	c:\windows\system32\Windir.exe
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\program files\iPod
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\program files\iTunes
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-03-27 13:12 . 2009-03-27 13:12	--------	d-----w	c:\program files\Watchtower
2009-03-26 21:05 . 2009-03-26 21:11	--------	d-----w	c:\documents and settings\Jonathan\Application Data\ArcSoft
2009-03-26 21:05 . 2009-03-26 21:05	--------	d-----w	c:\documents and settings\Jonathan\Local Settings\Application Data\ArcSoft
2009-03-26 20:52 . 2009-03-26 20:52	26	----a-w	C:\UpdaterforApp.ini
2009-03-26 20:44 . 2005-04-27 15:36	245408	----a-w	c:\windows\system32\unicows.dll
2009-03-26 20:44 . 2005-02-23 13:58	11776	----a-w	c:\windows\system32\drivers\afc.sys
2009-03-26 20:44 . 2009-03-26 20:52	--------	d-----w	c:\program files\Fichiers communs\ArcSoft
2009-03-26 20:44 . 2007-03-07 15:05	126976	----a-w	c:\windows\system32\MediaImpression Slideshow.scr
2009-03-26 20:44 . 2009-03-26 20:44	--------	d-----w	c:\windows\system32\MediaImpression Slideshow
2009-03-26 20:44 . 2009-03-26 20:44	--------	d-----w	c:\program files\ArcSoft
2009-03-24 22:29 . 2005-08-05 01:32	77824	----a-w	c:\windows\system32\TvRate.dll
2009-03-24 22:29 . 2005-07-12 02:33	49152	----a-w	c:\windows\system32\Macrovision.dll
2009-03-24 22:29 . 2009-03-25 16:58	--------	d-----w	c:\program files\AGEIA Technologies
2009-03-24 22:29 . 2009-03-24 22:29	--------	d-----w	c:\windows\system32\AGEIA
2009-03-24 22:29 . 2009-02-18 13:44	212711	----a-w	c:\windows\system32\nvapps.nvb
2009-03-24 22:16 . 2009-03-24 22:17	--------	d-----w	c:\documents and settings\All Users\Application Data\DriverScanner
2009-03-24 22:14 . 2009-03-24 22:16	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-03-24 22:07 . 2009-04-11 14:19	190328	----a-w	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-24 22:03 . 2009-03-24 22:04	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-03-24 22:02 . 2009-03-24 22:16	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Uniblue
2009-03-24 22:02 . 2009-03-24 22:16	--------	d-----w	c:\program files\Uniblue
2009-03-24 22:01 . 2009-03-24 22:02	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-03-23 17:54 . 2009-03-23 17:54	--------	d-----w	c:\program files\Windows Sidebar
2009-03-23 17:47 . 2009-03-23 17:55	--------	d-----w	c:\program files\Nero
2009-03-21 21:24 . 2009-03-21 21:24	--------	d-----w	c:\program files\Fichiers communs\xing shared
2009-03-19 22:34 . 2009-03-19 22:34	--------	d-sh--w	c:\documents and settings\Jonathan\IECompatCache
2009-03-19 22:32 . 2009-03-19 22:32	--------	d-sh--w	c:\documents and settings\Jonathan\PrivacIE
2009-03-19 22:29 . 2009-03-19 22:29	--------	d-sh--w	c:\documents and settings\NetworkService\IETldCache
2009-03-19 22:28 . 2009-03-19 22:28	--------	d-sh--w	c:\documents and settings\Jonathan\IETldCache
2009-03-19 22:18 . 2009-03-19 22:18	--------	d-----w	c:\windows\ie8updates
2009-03-19 22:16 . 2009-03-19 22:18	--------	dc-h--w	c:\windows\ie8
2009-03-19 22:15 . 2009-02-28 04:55	105984	-c----w	c:\windows\system32\dllcache\iecompat.dll
2009-03-15 21:22 . 2008-06-24 11:45	1414440	----a-w	c:\windows\system32\ShellManager310E2D762.dll
2009-03-15 21:22 . 2008-06-23 15:36	773120	----a-w	c:\windows\system32\NEROINSTAEC43759.DB
2009-03-15 21:21 . 2009-03-15 21:21	0	----a-w	c:\windows\Irremote.ini
2009-03-15 20:27 . 2009-03-23 18:02	--------	d-----w	c:\program files\Fichiers communs\Nero
2009-03-15 17:36 . 2009-03-15 17:44	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Hamachi
2009-03-15 17:36 . 2009-03-15 17:36	25280	----a-w	c:\windows\system32\drivers\hamachi.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 16:46 . 2009-03-14 21:19	14923808	--sha-w	c:\windows\system32\drivers\fidbox.dat
2009-04-14 16:46 . 2009-03-14 21:19	14923808	--sha-w	c:\windows\system32\drivers\fidbox.dat
2009-04-14 16:36 . 2008-10-28 17:17	--------	d-----w	c:\program files\Mozilla Thunderbird
2009-04-14 11:06 . 2009-03-14 21:19	176288	--sha-w	c:\windows\system32\drivers\fidbox.idx
2009-04-13 19:00 . 2009-04-13 19:00	1554	----a-w	C:\TCleaner.txt
2009-04-13 12:50 . 2008-10-27 18:30	--------	d-----w	c:\program files\PowerArchiver
2009-04-11 18:51 . 2008-10-31 18:26	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Azureus
2009-04-11 14:07 . 2008-11-17 18:17	--------	d-----w	c:\documents and settings\Jonathan\Application Data\dvdcss
2009-04-11 12:50 . 2008-11-02 19:20	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-04-11 07:06 . 2008-12-17 22:48	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Free Download Manager
2009-04-08 21:32 . 2008-10-27 19:46	--------	d-----w	c:\program files\Fichiers communs\Apple
2009-04-06 20:43 . 2008-11-17 17:32	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Nero
2009-04-06 13:32 . 2008-11-02 19:20	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-11-02 19:20	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-03-31 15:59 . 2008-10-31 22:25	--------	d-----w	c:\program files\Java
2009-03-29 14:37 . 2002-08-30 12:00	85404	----a-w	c:\windows\system32\perfc00C.dat
2009-03-29 14:37 . 2002-08-30 12:00	513080	----a-w	c:\windows\system32\perfh00C.dat
2009-03-29 14:32 . 2008-12-26 08:16	4535628	----a-w	c:\windows\Internet Logs\tvDebug.zip
2009-03-26 20:44 . 2008-10-27 07:39	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-03-25 16:59 . 2008-10-26 23:08	--------	d-----w	c:\program files\Fichiers communs\Wise Installation Wizard
2009-03-23 17:47 . 2008-11-17 17:29	--------	d-----w	c:\documents and settings\All Users\Application Data\Nero
2009-03-21 22:14 . 2008-10-27 20:02	--------	d-----w	c:\program files\Fichiers communs\Adobe
2009-03-21 21:24 . 2008-12-09 21:41	--------	d-----w	c:\program files\Fichiers communs\Real
2009-03-19 14:32 . 2008-10-27 19:48	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-18 23:10 . 2008-10-27 18:31	--------	d-----w	c:\program files\TuneUp Utilities 2007
2009-03-17 12:05 . 2009-03-17 18:38	1440256	----a-w	c:\windows\Internet Logs\xDBA.tmp
2009-03-15 14:57 . 2008-10-27 20:20	--------	d-----w	c:\documents and settings\Jonathan\Application Data\IEPro
2009-03-15 14:51 . 2009-03-15 14:51	--------	d-----w	c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-15 14:50 . 2009-03-15 14:49	--------	d-----w	c:\program files\QuickTime
2009-03-14 14:04 . 2008-10-26 23:14	4212	---h--w	c:\windows\system32\zllictbl.dat
2009-03-13 15:30 . 2008-10-30 17:59	--------	d-----w	c:\program files\Spybot - Search & Destroy
2009-03-13 12:56 . 2008-11-07 20:19	--------	d-----w	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-09 03:19 . 2008-10-31 22:26	410984	----a-w	c:\windows\system32\deploytk.dll
2009-03-08 03:34 . 2002-08-30 12:00	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 03:34 . 2002-08-30 12:00	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 03:33 . 2002-08-30 12:00	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 03:33 . 2002-08-30 12:00	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 03:32 . 2002-08-30 12:00	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 03:32 . 2002-08-30 12:00	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 03:31 . 2002-08-30 12:00	34816	----a-w	c:\windows\system32\imgutil.dll
2009-03-08 03:31 . 2002-08-30 12:00	48128	----a-w	c:\windows\system32\mshtmler.dll
2009-03-08 03:31 . 2002-08-30 12:00	45568	----a-w	c:\windows\system32\mshta.exe
2009-03-08 03:22 . 2002-08-30 12:00	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-06 21:09 . 2009-03-06 21:09	--------	d-----w	c:\program files\OO Software
2009-03-02 20:42 . 2008-10-27 20:06	--------	d-----w	c:\program files\eChanblard
2009-03-01 20:15 . 2009-03-01 20:15	--------	d-----w	c:\program files\eRightSoft
2009-03-01 20:13 . 2008-11-07 20:52	--------	d-----w	c:\program files\ffdshow
2009-03-01 15:52 . 2008-12-09 22:08	--------	d-----w	c:\program files\Fichiers communs\DVDVideoSoft
2009-03-01 15:52 . 2008-10-31 19:31	--------	d-----w	c:\program files\ASUS
2009-03-01 11:50 . 2008-10-27 00:10	91584	----a-w	c:\documents and settings\Jonathan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-27 13:17 . 2008-10-27 06:43	--------	d-----w	c:\program files\Microsoft Silverlight
2009-02-16 22:17 . 2008-10-27 00:04	453152	----a-w	c:\windows\system32\NVUNINST.EXE
2009-02-09 14:05 . 2002-08-30 12:00	1846912	----a-w	c:\windows\system32\win32k.sys
2009-01-16 17:24 . 2009-01-16 17:24	70936	----a-w	c:\windows\system32\PhysXLoader.dll
2008-11-02 17:28 . 2008-11-02 17:28	38976	----a-w	c:\documents and settings\Jonathan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-27 06:32 . 2008-10-27 06:32	131	----a-w	c:\documents and settings\Jonathan\Local Settings\Application Data\fusioncache.dat
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"SmartMon"="c:\program files\EmvSmartCardReader\SmartMON.exe" [2006-12-04 73826]
"BePCSC"="c:\program files\EmvSmartCardReader\BePCSC.exe" [2007-05-03 27136]
"beidsystemtray"="c:\program files\Belgium Identity Card\beidsystemtray.exe" [2007-02-19 188416]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-06-28 2512128]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-21 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-10-11 31232]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-12-26 18081280]
"Windows Manager System"="Windir.exe" - c:\windows\system32\Windir.exe [2009-04-11 271386]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2003-9-15 503869]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-27 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42	72208	----a-w	c:\program files\fichiers communs\logishrd\bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\[u]0/uOODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PhilipsDM\SA1916"=c:\program files\Philips\SA19XX\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.11\RivaTuner.exe" /S
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\IEPro\MiniDM.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\iTunes\iTunes.exe"=

R3 AIDA32Driver;AIDA32Driver; [x]
R3 eID Privacy Service;eID Privacy Service;c:\windows\system32\beidservicepcsc.exe [2007-02-19 331776]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1e51x86.sys [2008-08-24 37376]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-05 108289]
S2 eID CRL Service;eID CRL Service;c:\windows\system32\beidservicecrl.exe [2007-02-19 225280]
S3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-26 2831232]
S3 EMVSCARD;EMVSCARD;c:\windows\system32\Drivers\EMVSCARD.sys [2006-09-18 20269]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://news.google.be/news?ned=fr_be
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: {{000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\IEPro\iepro.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jonathan\Application Data\Mozilla\Firefox\Profiles\z87h1j0x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.lycos.fr/
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 18:46
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="BB5DAE0BD4A137D592B1C78D2CA3232180AB05FB8E2FC8C0AA4916B776E6F5AC1A34C1B1C88CB4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6171C11EC38DE3D9DB7CE019D40AA5C585E08E17CF14B42FDAA812E6CA05A7ED51C5ABB1113867F21C090AA2E13B928C43E9A4A4DA20485F369BD86EE76B56BE21DFAA8473295D791660A6C0E0526AE1F84E0DA5A07F0C33030537C95F272AF66BDB55B74A60479E98420538B7EE290789F32B0E76EC192147971224382E967B325B2F93D1B72A60B8C933B2E85FAD0657286FE005E865905346CA1A547577E9FEFBEC18F6CE36F5E6A4B964255DBC6FED1FD8C6F8D3755EDC4BA332897D83705AE4803192E423BCFFA4E6B585FD79F6188D7B2C6EAAE98BBFE75A7FDFAF1A7C365E422CBA659C4CD8C4AD0444522D92DD4FB5F5C16A9855F32DD621D320C38BE0BCB16E0D0591CCCE610F59D5F56C98868F317C7624CD6CE1AD5D9C02B7029DA8C576C535B572245C1149BC1B96F171A686C6DE7D91B98856B649A658DD08A844A89C6E027CA8EB04BEF164F13513D8F70390EDB3982AAFD4CB4424E32BD422A9806D50D4C11EC8F22DFCF2D5E3F8D980ECEB70B6FCE443DD8160502A6AF8A3D3D14E421156A9A66DD4546004564296B4248BB9D22B46B461E79AA482D8270B4769F4F2500F9CB3C87250A3621CD0A3F83620000A9C9FEA3A0770DB2BA76570C73B805EABE49859C9AA8BF0002EB7BD1BC7F7FE49287AE63584A9D90F8ACF2C1D8930A83B9C5A318889BA250AB151D62CB25C8BF9DCCFE17ADD15DF9C42E4ED7BC07F7C6893D55C136EEFDDF9602E13782FDFD4B3E5C4A53028F6447306647D5AD117AD07D669CB07DB934AB6CD01319255855031EDCBBB3282CDE9702A40F462B4F510098D7D080AAB1BAF20F824BD2712499A99957D4D3E4EF8B4EB09A2BB5A886D0F6118F1C51FE3619B810FBFAB691782743C0BB6AD675CCBC8FEC62773A8D9F611ED06DFDC730C76F483787E418AA90F199595C256189D35BC516F51FE7B6A4011FF6B5C88966896C2A00D2A25150C7803AD96E809DC0BC61A043B4A45BF347BCEA561023443EC6D6B01BED1E3D0E22EBF4EF8C4FB9B5605E113D62DD3189D93BB2740A07A549EA08EFEACF183D6044E2E07DB6B666F0C0764D0125F50D2FD5B4EE0C14C5E20D876C408750A437BBF7A8D4144D2D59F3FEDECEC00B68959056F3DA8C817FB2025105BCBC2E2B12852C926F7E9800CDAFE1E556620189F5CE1A5AF4180DAC5196A0E8C50909673A95728A9139C1D17E8B5568627E5B7D5BFD07DB0185CF177EA973BF00206868A2BB801060F25695B062685ABCE3D1BDF9A42481055DCBDE7D116947D36B35133D3AAF34C5124B9427"
"OODEFRAG10.00.00.01WORKSTATION"="9561824B1F5232CAA3F84684FE3321904F15EFFCE6F8F5B912F05EEC1E8109E4AA8483EC9C1EAAD141A1974FFC52E3A9955ADF4DEF66C30FC73B05844DC2408624D1FBC52AA8A2A68A04F82984290421DF3FF9067EFC61178DE659A62922B43818A674D6DC4C28BDBF83E744A5A6D0A93448CC253CE1FCDF54BE973B9418178781347B1870F90F4106D3DE4214505D280152649BF6CF8C2EF1E201211433DB35BEFD227445B26D8F6100E3BCA73E8039178B57CD9D9247781F46D92AD296BC3591DEFD4BDB0F9BB84065FABEDC9CD5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B5559DB7CE019D40AA5C3D0367E6ADEB8E0E17778336B937408E5C35EAB931393811EF9E5B04F7755B1B2396A7C0B27B72D4EDE0872EE319AA0BEE16C821578A68B944A5C31DDC4E63AC2FE82578D9F8192C84C106971FA20F3EF6D6D2AC9BE2E1F3A7C90615D5D625458C9231BBB8BE938524DDD38FAD2A12DAF982828B102EFD527B7F62CDE0324E7A1C13F1BBDACB8416C9DB1C3AC8266BD63389A8F1387DA92C58216DAB6FAC2224724E5DAEBEC2A2D928C75BBC1CB1E6ED90C0E5188D86659F886A8E9667B2F5E0D788C24DD8EA3A8CA31065C2C70E659F3560B2B77D21C80B8CFE81FBA3D63491486C42560F2FA9B2D5095D7ADF1FDA2F7605D891E84A7A1418E255CB71CD5BD9F5894F8A3D1EE4900CEA3D976B6C502360AFF769A4A3B8A292FE6E7B13737D24C3D1B330B0EA73B1C84E5550E7A1E047B0C282877A7155E1172284823EC4C19DCA9B0D90AE6DEF6341B4465EC40FBE2A59083E36A51EB443757D24DE9DE2E037579FCAF96D1E0938DD020401E6282C9F82ACC6465934D079B1A52C10CE162A26EAFEB2BD979D03073E7B5AFA258502BE063F0B8AB965B7FD0194D01CE44500E339BA5CB04C2F356832CE66134B622DE1F036CDDADE88880DD227980B637F582CABB936AD1E388ABBBF891A13999FACA98867261457137A25431FE0E8C6F63D025DC67F9115C503A221A0BACA45BF17F641127D1424A5D48B2822D847FC82CD2A9F8E4CBEAA053183C26A620C75EA12F1C5D494BF387EF748873A05B9E5993B2DF5A48899D048BB87C622002FC56E5B0875B47C7DFE83D1A81DD23BD959DCCC571B7FEE0DE688DE9E0368D38B47B94365E2989C3AD3BCE9BA59BEA9C3228BDBBBF9F98F07C65FE9F9FEBFF282FCDEAD7D53CF2F6489585854DEB34E987B0ED6AEB2D050F73A0CBF8FFB8FC9765F979209C188C4F063A6CB0D05497D7D99EC41499BA86A568171581AE7A3144D5BBF7E82DDD7BD561B9C03C0D87FDF99235530E8BB85E99ACD163D96E92BE3F14FD512A889B6D3915D53D50F9836EE992F1BCD2FCF"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2112)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSFR.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: ~,10time:~,-3
ComboFix-quarantined-files.txt  2009-04-14 16:47

Avant-CF: 451.331.395.584 octets libres
Après-CF: 451.377.709.056 octets libres

271	--- E O F ---	2009-03-17 18:46


Voici le rapport de SmitfraudFix :

SmitFraudFix v2.408

Rapport fait à 18:57:01,90, mar. 14/04/2009
Executé à partir de C:\Documents and Settings\Jonathan\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\EmvSmartCardReader\SmartMON.exe
C:\Program Files\EmvSmartCardReader\BePCSC.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\Windir.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
C:\Documents and Settings\Jonathan\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jonathan


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jonathan\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jonathan\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jonathan\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Bien à toi,

Jtb.

jlpjlp · Answer

Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :





File::
c:\a.bat




Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


___________________

repare windows
https://www.pcastuces.com/pratique/windows/xp/default.htm
____________________

utilise  pour supprimer tes traces 

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo 
(dans les options puis avancé :désactive la case: effacer les fichiers de plus de 48 heures)
https://www.malekal.com/tutoriel-ccleaner/
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

___________________

Désactive ta restauration systeme puis redemarre ton ordi puis réactive là comme ceci:
https://www.informatruc.com

____________________


Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

jtb · Answer

Salut,

Rapport Combofix :

ComboFix 09-04-14.09 - Jonathan 14/04/2009 21:19.3 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.32.1036.18.2047.1535 [GMT 2:00]
Lancé depuis: c:\documents and settings\Jonathan\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Jonathan\Bureau\CFscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *disabled*
 * Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-03-14 au 2009-04-14  ))))))))))))))))))))))))))))))))))))
.

2009-04-14 18:46 . 2001-08-23 15:47	24576	-c--a-w	c:\windows\system32\dllcache\agcgauge.ax
2009-04-14 18:42 . 2009-04-14 18:42	--------	d-----w	c:\program files\CCleaner
2009-04-14 16:51 . 2009-04-14 16:51	--------	d-----r	c:\documents and settings\LocalService\Favoris
2009-04-14 16:39 . 2009-04-14 16:39	--------	d-----w	c:\documents and settings\All Users\Application Data\TEMP
2009-04-14 16:39 . 2009-04-14 16:39	--------	d-----w	c:\program files\SpywareBlaster
2009-04-13 20:37 . 2009-04-13 20:37	--------	d-----w	c:\documents and settings\All Users\Application Data\Grisoft
2009-04-13 10:38 . 2009-04-13 11:21	--------	d-----r	c:\documents and settings\LocalService\Mes documents
2009-04-13 09:55 . 2009-04-13 09:55	--------	d-sh--w	c:\documents and settings\LocalService\IETldCache
2009-04-13 09:53 . 2009-02-13 09:31	55640	----a-w	c:\windows\system32\drivers\avgntflt.sys
2009-04-13 09:53 . 2009-04-13 09:53	--------	d-----w	c:\program files\Avira
2009-04-13 09:53 . 2009-04-13 09:53	--------	d-----w	c:\documents and settings\All Users\Application Data\Avira
2009-04-13 09:44 . 2009-04-13 19:00	--------	d-----w	c:\program files\Trend Micro
2009-04-11 18:14 . 2009-04-11 18:14	271386	----a-w	c:\windows\system32\Windir.exe
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\program files\iPod
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\program files\iTunes
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-03-27 13:12 . 2009-03-27 13:12	--------	d-----w	c:\program files\Watchtower
2009-03-26 21:05 . 2009-03-26 21:11	--------	d-----w	c:\documents and settings\Jonathan\Application Data\ArcSoft
2009-03-26 21:05 . 2009-03-26 21:05	--------	d-----w	c:\documents and settings\Jonathan\Local Settings\Application Data\ArcSoft
2009-03-26 20:52 . 2009-03-26 20:52	26	----a-w	C:\UpdaterforApp.ini
2009-03-26 20:44 . 2005-04-27 15:36	245408	----a-w	c:\windows\system32\unicows.dll
2009-03-26 20:44 . 2005-02-23 13:58	11776	----a-w	c:\windows\system32\drivers\afc.sys
2009-03-26 20:44 . 2009-03-26 20:52	--------	d-----w	c:\program files\Fichiers communs\ArcSoft
2009-03-26 20:44 . 2007-03-07 15:05	126976	----a-w	c:\windows\system32\MediaImpression Slideshow.scr
2009-03-26 20:44 . 2009-03-26 20:44	--------	d-----w	c:\windows\system32\MediaImpression Slideshow
2009-03-26 20:44 . 2009-03-26 20:44	--------	d-----w	c:\program files\ArcSoft
2009-03-24 22:29 . 2005-08-05 01:32	77824	----a-w	c:\windows\system32\TvRate.dll
2009-03-24 22:29 . 2005-07-12 02:33	49152	----a-w	c:\windows\system32\Macrovision.dll
2009-03-24 22:29 . 2009-03-25 16:58	--------	d-----w	c:\program files\AGEIA Technologies
2009-03-24 22:29 . 2009-03-24 22:29	--------	d-----w	c:\windows\system32\AGEIA
2009-03-24 22:29 . 2009-02-18 13:44	212711	----a-w	c:\windows\system32\nvapps.nvb
2009-03-24 22:16 . 2009-03-24 22:17	--------	d-----w	c:\documents and settings\All Users\Application Data\DriverScanner
2009-03-24 22:14 . 2009-03-24 22:16	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-03-24 22:07 . 2009-04-11 14:19	190328	----a-w	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-24 22:03 . 2009-03-24 22:04	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-03-24 22:02 . 2009-03-24 22:16	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Uniblue
2009-03-24 22:02 . 2009-03-24 22:16	--------	d-----w	c:\program files\Uniblue
2009-03-24 22:01 . 2009-03-24 22:02	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-03-23 17:54 . 2009-03-23 17:54	--------	d-----w	c:\program files\Windows Sidebar
2009-03-23 17:47 . 2009-03-23 17:55	--------	d-----w	c:\program files\Nero
2009-03-21 21:24 . 2009-03-21 21:24	--------	d-----w	c:\program files\Fichiers communs\xing shared
2009-03-19 22:34 . 2009-03-19 22:34	--------	d-sh--w	c:\documents and settings\Jonathan\IECompatCache
2009-03-19 22:32 . 2009-03-19 22:32	--------	d-sh--w	c:\documents and settings\Jonathan\PrivacIE
2009-03-19 22:29 . 2009-03-19 22:29	--------	d-sh--w	c:\documents and settings\NetworkService\IETldCache
2009-03-19 22:28 . 2009-03-19 22:28	--------	d-sh--w	c:\documents and settings\Jonathan\IETldCache
2009-03-19 22:18 . 2009-03-19 22:18	--------	d-----w	c:\windows\ie8updates
2009-03-19 22:16 . 2009-03-19 22:18	--------	dc-h--w	c:\windows\ie8
2009-03-19 22:15 . 2009-02-28 04:55	105984	-c----w	c:\windows\system32\dllcache\iecompat.dll
2009-03-15 21:22 . 2008-06-24 11:45	1414440	----a-w	c:\windows\system32\ShellManager310E2D762.dll
2009-03-15 21:22 . 2008-06-23 15:36	773120	----a-w	c:\windows\system32\NEROINSTAEC43759.DB
2009-03-15 21:21 . 2009-03-15 21:21	0	----a-w	c:\windows\Irremote.ini
2009-03-15 20:27 . 2009-03-23 18:02	--------	d-----w	c:\program files\Fichiers communs\Nero

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 19:21 . 2009-03-14 21:19	15247392	--sha-w	c:\windows\system32\drivers\fidbox.dat
2009-04-14 19:21 . 2009-03-14 21:19	15247392	--sha-w	c:\windows\system32\drivers\fidbox.dat
2009-04-14 18:56 . 2009-04-13 19:00	720	----a-w	C:\TCleaner.txt
2009-04-14 18:39 . 2009-04-14 18:39	62643	----a-w	c:\windows\Internet Logs\zlclient_2nd_2009_04_14_20_36_00_small.dmp.zip
2009-04-14 18:39 . 2009-04-14 18:39	60077	----a-w	c:\windows\Internet Logs\zlclient_2nd_2009_04_14_20_35_59_small.dmp.zip
2009-04-14 18:39 . 2009-04-14 18:39	41830	----a-w	c:\windows\Internet Logs\zlclient_2nd_2009_04_14_20_35_58_small.dmp.zip
2009-04-14 17:00 . 2009-03-14 21:19	179432	--sha-w	c:\windows\system32\drivers\fidbox.idx
2009-04-14 16:57 . 2009-04-14 16:57	5026	----a-w	C:\rapport.txt
2009-04-14 16:36 . 2008-10-28 17:17	--------	d-----w	c:\program files\Mozilla Thunderbird
2009-04-13 12:50 . 2008-10-27 18:30	--------	d-----w	c:\program files\PowerArchiver
2009-04-11 18:51 . 2008-10-31 18:26	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Azureus
2009-04-11 14:07 . 2008-11-17 18:17	--------	d-----w	c:\documents and settings\Jonathan\Application Data\dvdcss
2009-04-11 12:50 . 2008-11-02 19:20	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-04-11 07:06 . 2008-12-17 22:48	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Free Download Manager
2009-04-08 21:32 . 2008-10-27 19:46	--------	d-----w	c:\program files\Fichiers communs\Apple
2009-04-06 20:43 . 2008-11-17 17:32	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Nero
2009-04-06 13:32 . 2008-11-02 19:20	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-11-02 19:20	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-03-31 15:59 . 2008-10-31 22:25	--------	d-----w	c:\program files\Java
2009-03-29 14:37 . 2002-08-30 12:00	85404	----a-w	c:\windows\system32\perfc00C.dat
2009-03-29 14:37 . 2002-08-30 12:00	513080	----a-w	c:\windows\system32\perfh00C.dat
2009-03-29 14:32 . 2008-12-26 08:16	4535628	----a-w	c:\windows\Internet Logs\tvDebug.zip
2009-03-26 20:44 . 2008-10-27 07:39	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-03-25 16:59 . 2008-10-26 23:08	--------	d-----w	c:\program files\Fichiers communs\Wise Installation Wizard
2009-03-23 17:47 . 2008-11-17 17:29	--------	d-----w	c:\documents and settings\All Users\Application Data\Nero
2009-03-21 22:14 . 2008-10-27 20:02	--------	d-----w	c:\program files\Fichiers communs\Adobe
2009-03-21 21:24 . 2008-12-09 21:41	--------	d-----w	c:\program files\Fichiers communs\Real
2009-03-19 14:32 . 2008-10-27 19:48	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-18 23:10 . 2008-10-27 18:31	--------	d-----w	c:\program files\TuneUp Utilities 2007
2009-03-17 12:05 . 2009-03-17 18:38	1440256	----a-w	c:\windows\Internet Logs\xDBA.tmp
2009-03-15 17:44 . 2009-03-15 17:36	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Hamachi
2009-03-15 17:36 . 2009-03-15 17:36	25280	----a-w	c:\windows\system32\drivers\hamachi.sys
2009-03-15 14:57 . 2008-10-27 20:20	--------	d-----w	c:\documents and settings\Jonathan\Application Data\IEPro
2009-03-15 14:51 . 2009-03-15 14:51	--------	d-----w	c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-15 14:50 . 2009-03-15 14:49	--------	d-----w	c:\program files\QuickTime
2009-03-14 14:04 . 2008-10-26 23:14	4212	---h--w	c:\windows\system32\zllictbl.dat
2009-03-13 15:30 . 2008-10-30 17:59	--------	d-----w	c:\program files\Spybot - Search & Destroy
2009-03-13 12:56 . 2008-11-07 20:19	--------	d-----w	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-09 03:19 . 2008-10-31 22:26	410984	----a-w	c:\windows\system32\deploytk.dll
2009-03-08 03:34 . 2002-08-30 12:00	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 03:34 . 2002-08-30 12:00	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 03:33 . 2002-08-30 12:00	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 03:33 . 2002-08-30 12:00	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 03:32 . 2002-08-30 12:00	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 03:32 . 2002-08-30 12:00	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 03:31 . 2002-08-30 12:00	34816	----a-w	c:\windows\system32\imgutil.dll
2009-03-08 03:31 . 2002-08-30 12:00	48128	----a-w	c:\windows\system32\mshtmler.dll
2009-03-08 03:31 . 2002-08-30 12:00	45568	----a-w	c:\windows\system32\mshta.exe
2009-03-08 03:22 . 2002-08-30 12:00	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-06 21:09 . 2009-03-06 21:09	--------	d-----w	c:\program files\OO Software
2009-03-02 20:42 . 2008-10-27 20:06	--------	d-----w	c:\program files\eChanblard
2009-03-01 20:15 . 2009-03-01 20:15	--------	d-----w	c:\program files\eRightSoft
2009-03-01 20:13 . 2008-11-07 20:52	--------	d-----w	c:\program files\ffdshow
2009-03-01 15:52 . 2008-12-09 22:08	--------	d-----w	c:\program files\Fichiers communs\DVDVideoSoft
2009-03-01 15:52 . 2008-10-31 19:31	--------	d-----w	c:\program files\ASUS
2009-03-01 11:50 . 2008-10-27 00:10	91584	----a-w	c:\documents and settings\Jonathan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-27 13:17 . 2008-10-27 06:43	--------	d-----w	c:\program files\Microsoft Silverlight
2009-02-16 22:17 . 2008-10-27 00:04	453152	----a-w	c:\windows\system32\NVUNINST.EXE
2009-02-09 14:05 . 2002-08-30 12:00	1846912	----a-w	c:\windows\system32\win32k.sys
2009-01-16 17:24 . 2009-01-16 17:24	70936	----a-w	c:\windows\system32\PhysXLoader.dll
2008-11-02 17:28 . 2008-11-02 17:28	38976	----a-w	c:\documents and settings\Jonathan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-27 06:32 . 2008-10-27 06:32	131	----a-w	c:\documents and settings\Jonathan\Local Settings\Application Data\fusioncache.dat
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"= "c:\windows\system32\ieframe.dll" [2009-03-08 11063808]

[HKEY_CLASSES_ROOT\clsid\{cfbfae00-17a6-11d0-99cb-00c04fd64497}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2009-02-17 15:11	408440	----a-w	c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2008-11-26 22:04	251504	----a-w	c:\program files\Google\Google Toolbar\GoogleToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2009-04-06 10:49	668656	----a-w	c:\program files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
2008-11-26 22:04	522224	----a-w	c:\program files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2009-03-09 03:18	35840	----a-w	c:\program files\Java\jre6\bin\jp2ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2009-03-09 03:18	73728	----a-w	c:\program files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"= "c:\windows\system32\ieframe.dll" [2009-03-08 11063808]

[HKEY_CLASSES_ROOT\clsid\{f2cf5485-4e02-4f68-819c-b92de9277049}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"SmartMon"="c:\program files\EmvSmartCardReader\SmartMON.exe" [2006-12-04 73826]
"BePCSC"="c:\program files\EmvSmartCardReader\BePCSC.exe" [2007-05-03 27136]
"beidsystemtray"="c:\program files\Belgium Identity Card\beidsystemtray.exe" [2007-02-19 188416]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-06-28 2512128]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-21 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-10-11 31232]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-12-26 18081280]
"Windows Manager System"="Windir.exe" - c:\windows\system32\Windir.exe [2009-04-11 271386]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2003-9-15 503869]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-27 805392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2009-03-08 236544]
"WPDShServiceObj"= {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42	72208	----a-w	c:\program files\fichiers communs\logishrd\bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\[u]0/uOODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PhilipsDM\SA1916"=c:\program files\Philips\SA19XX\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.11\RivaTuner.exe" /S
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\IEPro\MiniDM.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\iTunes\iTunes.exe"=

R3 AIDA32Driver;AIDA32Driver; [x]
R3 eID Privacy Service;eID Privacy Service;c:\windows\system32\beidservicepcsc.exe [2007-02-19 331776]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1e51x86.sys [2008-08-24 37376]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-05 108289]
S2 eID CRL Service;eID CRL Service;c:\windows\system32\beidservicecrl.exe [2007-02-19 225280]
S3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-26 2831232]
S3 EMVSCARD;EMVSCARD;c:\windows\system32\Drivers\EMVSCARD.sys [2006-09-18 20269]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

SharedTaskScheduler-{8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\System32\browseui.dll
ShellExecuteHooks-{AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://news.google.be/news?ned=fr_be
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: {{CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
IE: {{000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\IEPro\iepro.dll
IE: {{92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\MICROS~3\Office12\REFIEBAR.DLL
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Handler: http\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: msdaipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
Name-Space Handler: mk\* - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jonathan\Application Data\Mozilla\Firefox\Profiles\z87h1j0x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.lycos.fr/
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 21:21
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="BB5DAE0BD4A137D592B1C78D2CA3232180AB05FB8E2FC8C0AA4916B776E6F5AC1A34C1B1C88CB4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6171C11EC38DE3D9DB7CE019D40AA5C585E08E17CF14B42FDAA812E6CA05A7ED51C5ABB1113867F21C090AA2E13B928C43E9A4A4DA20485F369BD86EE76B56BE21DFAA8473295D791660A6C0E0526AE1F84E0DA5A07F0C33030537C95F272AF66BDB55B74A60479E98420538B7EE290789F32B0E76EC192147971224382E967B325B2F93D1B72A60B8C933B2E85FAD0657286FE005E865905346CA1A547577E9FEFBEC18F6CE36F5E6A4B964255DBC6FED1FD8C6F8D3755EDC4BA332897D83705AE4803192E423BCFFA4E6B585FD79F6188D7B2C6EAAE98BBFE75A7FDFAF1A7C365E422CBA659C4CD8C4AD0444522D92DD4FB5F5C16A9855F32DD621D320C38BE0BCB16E0D0591CCCE610F59D5F56C98868F317C7624CD6CE1AD5D9C02B7029DA8C576C535B572245C1149BC1B96F171A686C6DE7D91B98856B649A658DD08A844A89C6E027CA8EB04BEF164F13513D8F70390EDB3982AAFD4CB4424E32BD422A9806D50D4C11EC8F22DFCF2D5E3F8D980ECEB70B6FCE443DD8160502A6AF8A3D3D14E421156A9A66DD4546004564296B4248BB9D22B46B461E79AA482D8270B4769F4F2500F9CB3C87250A3621CD0A3F83620000A9C9FEA3A0770DB2BA76570C73B805EABE49859C9AA8BF0002EB7BD1BC7F7FE49287AE63584A9D90F8ACF2C1D8930A83B9C5A318889BA250AB151D62CB25C8BF9DCCFE17ADD15DF9C42E4ED7BC07F7C6893D55C136EEFDDF9602E13782FDFD4B3E5C4A53028F6447306647D5AD117AD07D669CB07DB934AB6CD01319255855031EDCBBB3282CDE9702A40F462B4F510098D7D080AAB1BAF20F824BD2712499A99957D4D3E4EF8B4EB09A2BB5A886D0F6118F1C51FE3619B810FBFAB691782743C0BB6AD675CCBC8FEC62773A8D9F611ED06DFDC730C76F483787E418AA90F199595C256189D35BC516F51FE7B6A4011FF6B5C88966896C2A00D2A25150C7803AD96E809DC0BC61A043B4A45BF347BCEA561023443EC6D6B01BED1E3D0E22EBF4EF8C4FB9B5605E113D62DD3189D93BB2740A07A549EA08EFEACF183D6044E2E07DB6B666F0C0764D0125F50D2FD5B4EE0C14C5E20D876C408750A437BBF7A8D4144D2D59F3FEDECEC00B68959056F3DA8C817FB2025105BCBC2E2B12852C926F7E9800CDAFE1E556620189F5CE1A5AF4180DAC5196A0E8C50909673A95728A9139C1D17E8B5568627E5B7D5BFD07DB0185CF177EA973BF00206868A2BB801060F25695B062685ABCE3D1BDF9A42481055DCBDE7D116947D36B35133D3AAF34C5124B9427"
"OODEFRAG10.00.00.01WORKSTATION"="9561824B1F5232CAA3F84684FE3321904F15EFFCE6F8F5B912F05EEC1E8109E4AA8483EC9C1EAAD141A1974FFC52E3A9955ADF4DEF66C30FC73B05844DC2408624D1FBC52AA8A2A68A04F82984290421DF3FF9067EFC61178DE659A62922B43818A674D6DC4C28BDBF83E744A5A6D0A93448CC253CE1FCDF54BE973B9418178781347B1870F90F4106D3DE4214505D280152649BF6CF8C2EF1E201211433DB35BEFD227445B26D8F6100E3BCA73E8039178B57CD9D9247781F46D92AD296BC3591DEFD4BDB0F9BB84065FABEDC9CD5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B5559DB7CE019D40AA5C3D0367E6ADEB8E0E17778336B937408E5C35EAB931393811EF9E5B04F7755B1B2396A7C0B27B72D4EDE0872EE319AA0BEE16C821578A68B944A5C31DDC4E63AC2FE82578D9F8192C84C106971FA20F3EF6D6D2AC9BE2E1F3A7C90615D5D625458C9231BBB8BE938524DDD38FAD2A12DAF982828B102EFD527B7F62CDE0324E7A1C13F1BBDACB8416C9DB1C3AC8266BD63389A8F1387DA92C58216DAB6FAC2224724E5DAEBEC2A2D928C75BBC1CB1E6ED90C0E5188D86659F886A8E9667B2F5E0D788C24DD8EA3A8CA31065C2C70E659F3560B2B77D21C80B8CFE81FBA3D63491486C42560F2FA9B2D5095D7ADF1FDA2F7605D891E84A7A1418E255CB71CD5BD9F5894F8A3D1EE4900CEA3D976B6C502360AFF769A4A3B8A292FE6E7B13737D24C3D1B330B0EA73B1C84E5550E7A1E047B0C282877A7155E1172284823EC4C19DCA9B0D90AE6DEF6341B4465EC40FBE2A59083E36A51EB443757D24DE9DE2E037579FCAF96D1E0938DD020401E6282C9F82ACC6465934D079B1A52C10CE162A26EAFEB2BD979D03073E7B5AFA258502BE063F0B8AB965B7FD0194D01CE44500E339BA5CB04C2F356832CE66134B622DE1F036CDDADE88880DD227980B637F582CABB936AD1E388ABBBF891A13999FACA98867261457137A25431FE0E8C6F63D025DC67F9115C503A221A0BACA45BF17F641127D1424A5D48B2822D847FC82CD2A9F8E4CBEAA053183C26A620C75EA12F1C5D494BF387EF748873A05B9E5993B2DF5A48899D048BB87C622002FC56E5B0875B47C7DFE83D1A81DD23BD959DCCC571B7FEE0DE688DE9E0368D38B47B94365E2989C3AD3BCE9BA59BEA9C3228BDBBBF9F98F07C65FE9F9FEBFF282FCDEAD7D53CF2F6489585854DEB34E987B0ED6AEB2D050F73A0CBF8FFB8FC9765F979209C188C4F063A6CB0D05497D7D99EC41499BA86A568171581AE7A3144D5BBF7E82DDD7BD561B9C03C0D87FDF99235530E8BB85E99ACD163D96E92BE3F14FD512A889B6D3915D53D50F9836EE992F1BCD2FCF"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2984)
c:\windows\system32\ieframe.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: ~,10time:~,-3
ComboFix-quarantined-files.txt  2009-04-14 19:21

Avant-CF: 450.718.457.856 octets libres
Après-CF: 450.708.627.456 octets libres

318	--- E O F ---	2009-03-17 18:46


Rapport Toolcleaner :

[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\Jonathan\Bureau\ComboFix.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\Jonathan\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: supprimé !
C:\Qoobox: supprimé !




Pour ce qui est de la réparation de Windows, on me demande WinXP Pro alors que j'ai le Familial. Il ne veut pas accepter ce dernier.

Ok pour Ccleaner.

Ok pour la restauration système.

Bien à toi,

Jtb.

jlpjlp · Answer

ok encore present?

jtb · Answer

Hé oui. Il est du genre coriace on dirait.

jlpjlp · Answer

ok j'avais mal lu ton premier message où tu par de windir


analyse ce fichier sur virus total et colle le  rapport  https://www.virustotal.com/gui/
c:\windows\system32\Windir.exe





je me mets ceci de coté:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Manager System"="Windir.exe" - c:\windows\system32\Windir.exe [2009-04-11 271386]

jtb · Answer

Salutations,

Rapport de Virus Total pour Windir.exe : 

Rien de nouveau.

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.0.0.101 2009.04.15 - 
AhnLab-V3 5.0.0.2 2009.04.15 - 
AntiVir 7.9.0.143 2009.04.15 - 
Antiy-AVL 2.0.3.1 2009.04.15 - 
Authentium 5.1.2.4 2009.04.15 - 
Avast 4.8.1335.0 2009.04.15 - 
AVG 8.5.0.287 2009.04.15 - 
CAT-QuickHeal 10.00 2009.04.15 - 
ClamAV 0.94.1 2009.04.15 - 
Comodo 1115 2009.04.15 - 
DrWeb 4.44.0.09170 2009.04.15 - 
eSafe 7.0.17.0 2009.04.13 - 
eTrust-Vet 31.6.6455 2009.04.14 - 
F-Prot 4.4.4.56 2009.04.15 - 
F-Secure 8.0.14470.0 2009.04.15 - 
Fortinet 3.117.0.0 2009.04.15 - 
GData 19 2009.04.15 - 
Ikarus T3.1.1.49.0 2009.04.15 - 
K7AntiVirus 7.10.704 2009.04.15 - 
Kaspersky 7.0.0.125 2009.04.15 - 
McAfee 5585 2009.04.15 - 
McAfee+Artemis 5585 2009.04.15 - 
McAfee-GW-Edition 6.7.6 2009.04.15 - 
Microsoft 1.4502 2009.04.15 - 
NOD32 4011 2009.04.15 - 
Norman 6.00.06 2009.04.15 - 
nProtect 2009.1.8.0 2009.04.15 - 
Panda 10.0.0.14 2009.04.15 - 
PCTools 4.4.2.0 2009.04.15 - 
Prevx1 V2 2009.04.15 - 
Rising 21.25.24.00 2009.04.15 - 
Sophos 4.40.0 2009.04.15 - 
Sunbelt 3.2.1858.2 2009.04.15 - 
Symantec 1.4.4.12 2009.04.15 - 
TheHacker 6.3.4.0.309 2009.04.15 - 
TrendMicro 8.700.0.1004 2009.04.15 - 
ViRobot 2009.4.15.1694 2009.04.15 - 
VirusBuster 4.6.5.0 2009.04.15 - 
Information additionnelle 
File size: 271386 bytes 
MD5...: 88432595d8e0db8ff855d0b34d404f65 
SHA1..: a2d537772d37d974f793334e6c24f7703d7757c9 
SHA256: 696dc730ad988579776fa5a8df9dc7b979bca979d58af0f0858b15fe541bc6ea 
SHA512: 6b662b1c220d091b3430f04b274d511185166f2f34312d81394e212fe856bdd2
e9cf0bde3de4242320bcce9d598567033c47639cf5957d06be95d716581b4c5e 
ssdeep: 3072:+4zEaBo/OFsFAZHnYm7d9MANIyhfLpjbSdGTXdl15pPw3zSexNkP4xet:Pz
EaIOFsFAZHNZ1fLpHSQtl15G3TmPws
 
PEiD..: - 
TrID..: File type identification
Win32 Executable Microsoft Visual Basic 6 (90.9%)
Win32 Executable Generic (6.1%)
Generic Win/DOS Executable (1.4%)
DOS Executable Generic (1.4%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1660
timedatestamp.....: 0x49cf8ffb (Sun Mar 29 15:12:59 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1d64c 0x1e000 5.15 68f029463dededadb191f2100cbd5e89
.data 0x1f000 0xc04 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x20000 0x5d0c 0x6000 1.54 43eef63abb05cc8a2a896011d20b2108

( 1 imports ) 
> MSVBVM60.DLL: __vbaVarSub, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarMove, __vbaVarVargNofree, __vbaAryMove, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaGosubReturn, __vbaFreeVarList, _adj_fdiv_m64, __vbaRaiseEvent, __vbaGetFxStr3, -, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, __vbaLsetFixstr, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, -, __vbaExitProc, -, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarIndexLoad, -, __vbaStrFixstr, __vbaRefVarAry, _CIsin, -, __vbaErase, -, __vbaVarZero, __vbaChkstk, -, __vbaFileClose, __vbaGosubFree, EVENT_SINK_AddRef, __vbaGenerateBoundsError, -, __vbaStrCmp, __vbaGet3, __vbaPutOwner3, __vbaAryConstruct2, DllFunctionCall, __vbaRedimPreserve, __vbaLbound, _adj_fpatan, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, -, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, -, _adj_fprem, _adj_fdivr_m64, __vbaGosub, -, -, __vbaFPException, -, __vbaGetOwner3, __vbaUbound, __vbaStrVarVal, __vbaVarCat, __vbaLsetFixstrFree, __vbaFileSeek, -, _CIlog, __vbaErrorOverflow, __vbaFileOpen, -, __vbaVar2Vec, -, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, -, -, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, -, -, -, __vbaI4Var, __vbaAryLock, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, -, _CIatan, __vbaStrMove, -, __vbaUI1Str, __vbaR8IntI4, __vbaStrVarCopy, _allmul, _CItan, __vbaUI1Var, __vbaAryUnlock, _CIexp, __vbaFreeStr, __vbaFreeObj, -

( 0 exports ) 
 
RDS...: NSRL Reference Data Set
- 

Je me demande à quoi sert ce fichier quand même.

jlpjlp · Answer

oui cela correspond au debut de tes souci le 11/4/9?

si oui



télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(bien mettre   :files)



:files
c:\windows\system32\Windir.exe
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Run]
"Windows Manager System"=-




clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.



car pour info je pense qu'il est infecté :

https://www.broadcom.com/

http://www.prevx.com/filenames/X2475219079195684350-X1/WINDIR.EXE.html

jtb · Answer

Resalut et merci pour l'intérêt que tu me manifestes. Oui, j'ai posté le jour où j'ai eu ce problème. Je pense aussi que Windir.exe est infecté. Quand je regardais ses propriétés, je vois qu'il avait été créé et modifié le samedi 11 avril 2009, 20:14:35. C'est suspect je trouve. La suppression n'a malheureusement pas fonctionné : Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found. OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04152009_230543 Bien à toi, Jtb.

jtb · Answer

(second message)

Re,

Je pense qu'il s'agit bel et bien de Windir. 

1) Microsoft Update a fait la mise à jour de son outil de suppression des logiciels malveillants. Il m'a détecté ceci : Backd/Rbot.gen!A

2) J'ai tout bonnement supprimé Windir.exe de System32 (je l'ai conservé en archivé quand même) et le fichier WINDIR.EXE-29C5CF71 de C:\WINDOWS\Prefetch. Sa doit être une espèce de sauvegarde compressée.

Edit : après vérification, Windir.exe ainsi que son homologue compressé, n'existent pas sur un autre OS Windows XP SP3. J'ai vérifié cela sur mon pc portable.

jlpjlp · Answer

pour otmovit tu avais bien mis 



:files 



_____________________

tu les a viré?

_____________________
et si oui
encore des soucis?
_____________________

remets un rapport RSIT

jtb · Answer

Salut,

Oui, j'avais bien mis ":files".

Oui, j'ai tout supprimé avec le logiciel Windows.

Et oui, a.bat revient encore. :-(

Voici le rapport de RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jonathan at 2009-04-16 18:11:36
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 429 GB (90%) free of 477 GB
Total RAM: 2047 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:11:59, on 16/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\EmvSmartCardReader\SmartMON.exe
C:\Program Files\EmvSmartCardReader\BePCSC.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\WINDOWS\system32\winoper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\DOCUME~1\Jonathan\LOCALS~1\Temp\Google Toolbar\gtbF.tmp.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Jonathan\Bureau\RSIT.exe
C:\Program Files	rend micro\Jonathan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=BE&ceid=BE:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SmartMon] C:\Program Files\EmvSmartCardReader\SmartMON.exe
O4 - HKLM\..\Run: [BePCSC] C:\Program Files\EmvSmartCardReader\BePCSC.exe
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Manager System] winoper.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\RunServices: [Windows Manager System] winoper.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: eID CRL Service -  Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jtb · Answer

(Second message)

Second rapport :

info.txt logfile of random's system information tool 1.06 2009-04-16 18:12:01

======Uninstall list======

-->MsiExec /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
3DMark06-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9  -removeonly
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft Software Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{497A1721-088F-41EF-8876-B43C9DA5528B}\Setup.exe" -l0x40c 
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
ASUSUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\setup.exe" -l0x40c 
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\Setup.exe" -runfromtemp -l0x040c -removeonly
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Azureus-->C:\Program Files\Azureus\Uninstall.exe
Belgium Identity Card Run-time 2.6-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EA248851-A7D5-4906-8C46-A3CA267F6A24} /l1036 
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
E-Microscope-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57383270-6F61-4DC8-A9B8-C1745FC29F38}\Setup.exe" -l0x9 
ffdshow [rev 2527] [2008-12-19]-->"C:\Program Files\ffdshow\unins000.exe"
Free Download Manager 2.5-->"C:\Program Files\Free Download Manager\unins000.exe"
Gadwin PrintScreen-->C:\Program Files\Gadwin Systems\PrintScreen\Uninstall.exe
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_11CB06797F2F038A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HDD Health v3.2 Beta-->"C:\Program Files\HDD Health\unins000.exe"
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
HP Imaging Device Functions 7.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Solution Center 7.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
IE7Pro-->C:\Program Files\IEPro\uninst.exe
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0}
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
K!TV-->C:\Program Files\K!TV\UninstKTV.exe
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
Ma-Config.com-->MsiExec.exe /X{1C02A760-1682-49AE-BB54-FA7D63BD3504}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.21)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSI 8624 BDA Driver-->C:\WINDOWS\p3xunist.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 9-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
O&O Defrag Professional Edition-->MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
OCCT Perestroika 2.0.1-->"C:\Program Files\OCCT\unins000.exe"
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Package de base Microsoft de service de chiffrement pour cartes à puce-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Philips SA19XX Device Manager-->"C:\Program Files\InstallShield Installation Information\{57B18739-7A22-44D7-A263-6E2A2180D3BC}\setup.exe" -runfromtemp -l0x040c -removeonly
PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre Studio\Uninst.exe"
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
PowerArchiver 2006 v9.64 French-->"C:\Program Files\PowerArchiver\unins000.exe"
PowerQuest PartitionMagic 8.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804} 
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
RivaTuner v2.11-->"C:\Program Files\RivaTuner v2.11\uninstall.exe"
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB960003)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F04F8702-18D0-458D-921E-146FB7CD38CF}
Security Update for Microsoft Office Excel 2007 (KB959997)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {9EAC3AEC-5C81-4856-A05B-DE9DC236D740}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SmartCard Reader Driver Installation-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{C6D91586-9F98-4CFD-9BC3-FC0800911005} /l1033 
SpeedFan (remove only)-->"C:\Program Files\SpeedFan\uninstall.exe"
Spelling Check Dictionary From OpenOffice.org-->"C:\Program Files\IEPro\unins000.exe"
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster 4.2-->"C:\Program Files\SpywareBlaster\unins000.exe"
SUPER © Version 2009.bld.35 (Jan 5, 2009)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TuneUp Utilities 2007-->MsiExec.exe /I{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}
TV@Anywhere Utilities-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{477AB148-138C-46D2-820B-0DBFA744CEE8}\setup.exe" -l0x40c  -uninst 
Uniblue DriverScanner 2009-->"C:\Documents and Settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}\DriverScanner_Setup.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue DriverScanner 2009-->C:\Documents and Settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}\DriverScanner_Setup.exe
Uniblue RegistryBooster 2009-->"C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue RegistryBooster 2009-->C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe
Uniblue SpeedUpMyPC 2009-->"C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}\SpeedUpMyPC.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue SpeedUpMyPC 2009-->C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}\SpeedUpMyPC.exe
Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {49E314EE-81FA-4007-8F1A-8D39BDBB4498}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb962871)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {297857BF-4011-449B-BD74-DB64D182821C}
VLC media player 0.9.6-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Watchtower Library 2008 - Français-->C:\Program Files\Watchtower\Watchtower Library 2008\F\uninst.exe
WIDCOMM Bluetooth Software-->MsiExec.exe /X{FE90E9E7-A158-4687-8853-DF677A939A61}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{01523985-2098-43AF-9C97-12B07BE02A9B}
Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
ZoneAlarm-->C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: AntiVir Desktop
FW: ZoneAlarm Firewall

======System event log======

Computer Name: JOHN-BUREAU
Event Code: 8003
Message: Le maître explorateur a reçu une annonce de serveur de l'ordinateur GREG_PORTABLE
qui pense qu'il est le maître explorateur sur le domaine pour le transport NetBT_Tcpip_{DB549FA6-C2A1-.
Le maître explorateur s'arrête ou une élection est provoquée.

Record Number: 19079
Source Name: MRxSmb
Time Written: 20090326220930.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 19049
Source Name: Service Control Manager
Time Written: 20090326215527.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 19009
Source Name: Service Control Manager
Time Written: 20090326211045.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 7001
Message: Le service Service Partage réseau du Lecteur Windows Media dépend du service Hôte de périphérique universel Plug-and-Play qui n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 18976
Source Name: Service Control Manager
Time Written: 20090326174844.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 8003
Message: Le maître explorateur a reçu une annonce de serveur de l'ordinateur ACER-29569F1E48
qui pense qu'il est le maître explorateur sur le domaine pour le transport NetBT_Tcpip_{DB549FA6-C2A.
Le maître explorateur s'arrête ou une élection est provoquée.

Record Number: 18946
Source Name: MRxSmb
Time Written: 20090325180434.000000+060
Event Type: error
User: 

=====Application event log=====

Computer Name: JOHN-BUREAU
Event Code: 1
Message: 
Record Number: 1586
Source Name: nview_info
Time Written: 20081230173441.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1
Message: 
Record Number: 1585
Source Name: nview_info
Time Written: 20081230170120.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1
Message: 
Record Number: 1579
Source Name: nview_info
Time Written: 20081230105759.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1000
Message: Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d.

Record Number: 1575
Source Name: Application Error
Time Written: 20081229235504.000000+060
Event Type: error
User: 

Computer Name: JOHN-BUREAU
Event Code: 1000
Message: Application défaillante iexplore.exe, version 7.0.6000.16762, module défaillant unknown, version 0.0.0.0, adresse de défaillance 0x042173c0.

Record Number: 1574
Source Name: Application Error
Time Written: 20081229235500.000000+060
Event Type: error
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=170a
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"tvdumpflags"=8
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Le pense que le processus Winoper.exe (ce n'est pas un fichier) a avoir dans l'infection car il me demande l'accès à Internet quand je supprime a.bat.

Bien à toi,

Jtb.

jlpjlp · Answer

telecharge hijackthis 
 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html


lance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Manager System] winoper.exe
O4 - HKLM\..\RunServices: [Windows Manager System] winoper.exe


______________________


Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :




Driver ::
a7tc68fi
File::
c:\a.bat
C:\WINDOWS\system32\winoper.exe
C:\WINDOWS\system32\drivers\a7tc68fi.sys
Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Manager System"= -







Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


___________________


Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
guide: http://site-naheulbeuk.com/
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Si SDfix ne se lance pas (ça arrive!) 

* Démarrer->Exécuter 
* Copie/colle ceci dans la fenêtre : 

%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe 


* Clique sur ok, et valide. 
* Redémarre et essaye de nouveau de lancer SDfix. 

________________________

encore des soucis???

jtb · Answer

Salut et merci beaucoup de ton aide.

J'ai fais ce qu'il fallait pour HiJackThis.

Voici le rapport ComboFix :

ComboFix 09-04-14.09 - Jonathan 16/04/2009 22:47.4 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.32.1036.18.2047.1433 [GMT 2:00]
Lancé depuis: c:\documents and settings\Jonathan\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Jonathan\Bureau\CFscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *enabled*
 * Un nouveau point de restauration a été créé

FILE ::
c:\a.bat
c:\windows\system32\drivers\a7tc68fi.sys
c:\windows\system32\winoper.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winoper.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-03-16 au 2009-04-16  ))))))))))))))))))))))))))))))))))))
.

2009-04-16 16:11 . 2009-04-16 16:12	--------	d-----w	C:\rsit
2009-04-15 21:08 . 2009-04-15 21:08	118	----a-w	c:\windows\system32\MRT.INI
2009-04-15 21:04 . 2008-12-16 12:31	354304	-c----w	c:\windows\system32\dllcache\winhttp.dll
2009-04-15 21:03 . 2009-02-06 10:10	227840	-c----w	c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 21:03 . 2009-03-06 14:20	286720	-c----w	c:\windows\system32\dllcache\pdh.dll
2009-04-15 21:03 . 2009-02-09 11:23	111104	-c----w	c:\windows\system32\dllcache\services.exe
2009-04-15 21:03 . 2009-02-09 10:53	473600	-c----w	c:\windows\system32\dllcache\fastprox.dll
2009-04-15 21:03 . 2009-02-09 10:53	401408	-c----w	c:\windows\system32\dllcache\rpcss.dll
2009-04-15 21:03 . 2009-02-09 10:53	453120	-c----w	c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 21:02 . 2008-04-21 21:15	219136	-c----w	c:\windows\system32\dllcache\wordpad.exe
2009-04-14 19:41 . 2009-04-14 19:41	579584	-c--a-w	c:\windows\system32\dllcache\user32.dll
2009-04-14 19:40 . 2009-04-14 19:57	--------	d-----w	c:\windows\ERUNT
2009-04-14 19:40 . 2009-04-14 19:48	--------	d-----w	C:\Backups
2009-04-14 18:46 . 2001-08-23 15:47	24576	-c--a-w	c:\windows\system32\dllcache\agcgauge.ax
2009-04-14 18:42 . 2009-04-14 18:42	--------	d-----w	c:\program files\CCleaner
2009-04-14 16:51 . 2009-04-14 16:51	--------	d-----r	c:\documents and settings\LocalService\Favoris
2009-04-14 16:39 . 2009-04-14 16:39	--------	d-----w	c:\documents and settings\All Users\Application Data\TEMP
2009-04-14 16:39 . 2009-04-14 16:39	--------	d-----w	c:\program files\SpywareBlaster
2009-04-13 20:37 . 2009-04-13 20:37	--------	d-----w	c:\documents and settings\All Users\Application Data\Grisoft
2009-04-13 10:38 . 2009-04-13 11:21	--------	d-----r	c:\documents and settings\LocalService\Mes documents
2009-04-13 09:55 . 2009-04-13 09:55	--------	d-sh--w	c:\documents and settings\LocalService\IETldCache
2009-04-13 09:53 . 2009-02-13 09:31	55640	----a-w	c:\windows\system32\drivers\avgntflt.sys
2009-04-13 09:53 . 2009-04-13 09:53	--------	d-----w	c:\program files\Avira
2009-04-13 09:53 . 2009-04-13 09:53	--------	d-----w	c:\documents and settings\All Users\Application Data\Avira
2009-04-13 09:44 . 2009-04-16 20:37	--------	d-----w	c:\program files\Trend Micro
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\program files\iPod
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\program files\iTunes
2009-04-08 21:32 . 2009-04-08 21:32	--------	d-----w	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-03-27 13:12 . 2009-03-27 13:12	--------	d-----w	c:\program files\Watchtower
2009-03-26 21:05 . 2009-03-26 21:11	--------	d-----w	c:\documents and settings\Jonathan\Application Data\ArcSoft
2009-03-26 21:05 . 2009-03-26 21:05	--------	d-----w	c:\documents and settings\Jonathan\Local Settings\Application Data\ArcSoft
2009-03-26 20:52 . 2009-03-26 20:52	26	----a-w	C:\UpdaterforApp.ini
2009-03-26 20:44 . 2005-04-27 15:36	245408	----a-w	c:\windows\system32\unicows.dll
2009-03-26 20:44 . 2005-02-23 13:58	11776	----a-w	c:\windows\system32\drivers\afc.sys
2009-03-26 20:44 . 2009-03-26 20:52	--------	d-----w	c:\program files\Fichiers communs\ArcSoft
2009-03-26 20:44 . 2007-03-07 15:05	126976	----a-w	c:\windows\system32\MediaImpression Slideshow.scr
2009-03-26 20:44 . 2009-03-26 20:44	--------	d-----w	c:\windows\system32\MediaImpression Slideshow
2009-03-26 20:44 . 2009-03-26 20:44	--------	d-----w	c:\program files\ArcSoft
2009-03-24 22:29 . 2005-08-05 01:32	77824	----a-w	c:\windows\system32\TvRate.dll
2009-03-24 22:29 . 2005-07-12 02:33	49152	----a-w	c:\windows\system32\Macrovision.dll
2009-03-24 22:29 . 2009-03-25 16:58	--------	d-----w	c:\program files\AGEIA Technologies
2009-03-24 22:29 . 2009-03-24 22:29	--------	d-----w	c:\windows\system32\AGEIA
2009-03-24 22:29 . 2009-02-18 13:44	212711	----a-w	c:\windows\system32\nvapps.nvb
2009-03-24 22:16 . 2009-03-24 22:17	--------	d-----w	c:\documents and settings\All Users\Application Data\DriverScanner
2009-03-24 22:14 . 2009-03-24 22:16	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-03-24 22:07 . 2009-04-11 14:19	190328	----a-w	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-24 22:03 . 2009-03-24 22:04	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-03-24 22:02 . 2009-03-24 22:16	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Uniblue
2009-03-24 22:02 . 2009-03-24 22:16	--------	d-----w	c:\program files\Uniblue
2009-03-24 22:01 . 2009-03-24 22:02	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-03-23 17:54 . 2009-03-23 17:54	--------	d-----w	c:\program files\Windows Sidebar
2009-03-23 17:47 . 2009-03-23 17:55	--------	d-----w	c:\program files\Nero
2009-03-21 21:24 . 2009-03-21 21:24	--------	d-----w	c:\program files\Fichiers communs\xing shared
2009-03-19 22:34 . 2009-03-19 22:34	--------	d-sh--w	c:\documents and settings\Jonathan\IECompatCache
2009-03-19 22:32 . 2009-03-19 22:32	--------	d-sh--w	c:\documents and settings\Jonathan\PrivacIE
2009-03-19 22:29 . 2009-03-19 22:29	--------	d-sh--w	c:\documents and settings\NetworkService\IETldCache
2009-03-19 22:28 . 2009-03-19 22:28	--------	d-sh--w	c:\documents and settings\Jonathan\IETldCache
2009-03-19 22:18 . 2009-03-19 22:18	--------	d-----w	c:\windows\ie8updates
2009-03-19 22:16 . 2009-03-19 22:18	--------	dc-h--w	c:\windows\ie8
2009-03-19 22:15 . 2009-02-28 04:55	105984	-c----w	c:\windows\system32\dllcache\iecompat.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-16 20:49 . 2009-03-14 21:19	16193568	--sha-w	c:\windows\system32\drivers\fidbox.dat
2009-04-16 20:49 . 2009-03-14 21:19	16193568	--sha-w	c:\windows\system32\drivers\fidbox.dat
2009-04-16 16:07 . 2008-10-28 17:17	--------	d-----w	c:\program files\Mozilla Thunderbird
2009-04-16 05:32 . 2009-03-14 21:19	190784	--sha-w	c:\windows\system32\drivers\fidbox.idx
2009-04-15 21:18 . 2002-08-30 12:00	85404	----a-w	c:\windows\system32\perfc00C.dat
2009-04-15 21:18 . 2002-08-30 12:00	513080	----a-w	c:\windows\system32\perfh00C.dat
2009-04-15 21:16 . 2008-10-27 18:30	--------	d-----w	c:\program files\PowerArchiver
2009-04-15 21:05 . 2008-11-07 20:19	--------	d-----w	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-14 19:57 . 2009-04-13 19:00	466	----a-w	C:\TCleaner.txt
2009-04-14 18:39 . 2009-04-14 18:39	62643	----a-w	c:\windows\Internet Logs\zlclient_2nd_2009_04_14_20_36_00_small.dmp.zip
2009-04-14 18:39 . 2009-04-14 18:39	60077	----a-w	c:\windows\Internet Logs\zlclient_2nd_2009_04_14_20_35_59_small.dmp.zip
2009-04-14 18:39 . 2009-04-14 18:39	41830	----a-w	c:\windows\Internet Logs\zlclient_2nd_2009_04_14_20_35_58_small.dmp.zip
2009-04-14 16:57 . 2009-04-14 16:57	5026	----a-w	C:\rapport.txt
2009-04-11 18:51 . 2008-10-31 18:26	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Azureus
2009-04-11 14:07 . 2008-11-17 18:17	--------	d-----w	c:\documents and settings\Jonathan\Application Data\dvdcss
2009-04-11 12:50 . 2008-11-02 19:20	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-04-11 07:06 . 2008-12-17 22:48	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Free Download Manager
2009-04-08 21:32 . 2008-10-27 19:46	--------	d-----w	c:\program files\Fichiers communs\Apple
2009-04-06 20:43 . 2008-11-17 17:32	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Nero
2009-04-06 13:32 . 2008-11-02 19:20	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-11-02 19:20	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-03-31 15:59 . 2008-10-31 22:25	--------	d-----w	c:\program files\Java
2009-03-29 14:32 . 2008-12-26 08:16	4535628	----a-w	c:\windows\Internet Logs\tvDebug.zip
2009-03-26 20:44 . 2008-10-27 07:39	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-03-25 16:59 . 2008-10-26 23:08	--------	d-----w	c:\program files\Fichiers communs\Wise Installation Wizard
2009-03-23 18:02 . 2009-03-15 20:27	--------	d-----w	c:\program files\Fichiers communs\Nero
2009-03-23 17:47 . 2008-11-17 17:29	--------	d-----w	c:\documents and settings\All Users\Application Data\Nero
2009-03-21 22:14 . 2008-10-27 20:02	--------	d-----w	c:\program files\Fichiers communs\Adobe
2009-03-21 21:24 . 2008-12-09 21:41	--------	d-----w	c:\program files\Fichiers communs\Real
2009-03-19 14:32 . 2008-10-27 19:48	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-18 23:10 . 2008-10-27 18:31	--------	d-----w	c:\program files\TuneUp Utilities 2007
2009-03-17 12:05 . 2009-03-17 18:38	1440256	----a-w	c:\windows\Internet Logs\xDBA.tmp
2009-03-15 17:44 . 2009-03-15 17:36	--------	d-----w	c:\documents and settings\Jonathan\Application Data\Hamachi
2009-03-15 17:36 . 2009-03-15 17:36	25280	----a-w	c:\windows\system32\drivers\hamachi.sys
2009-03-15 14:57 . 2008-10-27 20:20	--------	d-----w	c:\documents and settings\Jonathan\Application Data\IEPro
2009-03-15 14:51 . 2009-03-15 14:51	--------	d-----w	c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-15 14:50 . 2009-03-15 14:49	--------	d-----w	c:\program files\QuickTime
2009-03-14 14:04 . 2008-10-26 23:14	4212	---h--w	c:\windows\system32\zllictbl.dat
2009-03-13 15:30 . 2008-10-30 17:59	--------	d-----w	c:\program files\Spybot - Search & Destroy
2009-03-09 03:19 . 2008-10-31 22:26	410984	----a-w	c:\windows\system32\deploytk.dll
2009-03-08 03:34 . 2002-08-30 12:00	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 03:34 . 2002-08-30 12:00	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 03:33 . 2002-08-30 12:00	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 03:33 . 2002-08-30 12:00	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 03:32 . 2002-08-30 12:00	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 03:32 . 2002-08-30 12:00	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 03:31 . 2002-08-30 12:00	34816	----a-w	c:\windows\system32\imgutil.dll
2009-03-08 03:31 . 2002-08-30 12:00	48128	----a-w	c:\windows\system32\mshtmler.dll
2009-03-08 03:31 . 2002-08-30 12:00	45568	----a-w	c:\windows\system32\mshta.exe
2009-03-08 03:22 . 2002-08-30 12:00	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-06 21:09 . 2009-03-06 21:09	--------	d-----w	c:\program files\OO Software
2009-03-06 14:20 . 2002-08-30 12:00	286720	----a-w	c:\windows\system32\pdh.dll
2009-03-02 20:42 . 2008-10-27 20:06	--------	d-----w	c:\program files\eChanblard
2009-03-01 20:15 . 2009-03-01 20:15	--------	d-----w	c:\program files\eRightSoft
2009-03-01 20:13 . 2008-11-07 20:52	--------	d-----w	c:\program files\ffdshow
2009-03-01 15:52 . 2008-12-09 22:08	--------	d-----w	c:\program files\Fichiers communs\DVDVideoSoft
2009-03-01 15:52 . 2008-10-31 19:31	--------	d-----w	c:\program files\ASUS
2009-03-01 11:50 . 2008-10-27 00:10	91584	----a-w	c:\documents and settings\Jonathan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-27 13:17 . 2008-10-27 06:43	--------	d-----w	c:\program files\Microsoft Silverlight
2009-02-16 22:17 . 2008-10-27 00:04	453152	----a-w	c:\windows\system32\NVUNINST.EXE
2009-02-09 14:05 . 2002-08-30 12:00	1846912	----a-w	c:\windows\system32\win32k.sys
2009-02-09 11:23 . 2002-08-29 11:42	2025984	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:23 . 2002-08-30 12:00	2147328	----a-w	c:\windows\system32\ntoskrnl.exe
2009-02-09 11:23 . 2002-08-30 12:00	111104	----a-w	c:\windows\system32\services.exe
2009-02-09 10:53 . 2002-08-30 12:00	735744	----a-w	c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2002-08-30 12:00	739840	----a-w	c:\windows\system32\ntdll.dll
2009-02-09 10:53 . 2002-08-30 12:00	685568	----a-w	c:\windows\system32\advapi32.dll
2009-02-09 10:53 . 2002-08-30 12:00	401408	----a-w	c:\windows\system32\rpcss.dll
2009-02-06 10:39 . 2002-08-30 12:00	35328	----a-w	c:\windows\system32\sc.exe
2009-02-03 19:58 . 2002-08-30 12:00	56832	----a-w	c:\windows\system32\secur32.dll
2008-11-02 17:28 . 2008-11-02 17:28	38976	----a-w	c:\documents and settings\Jonathan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-27 06:32 . 2008-10-27 06:32	131	----a-w	c:\documents and settings\Jonathan\Local Settings\Application Data\fusioncache.dat
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"SmartMon"="c:\program files\EmvSmartCardReader\SmartMON.exe" [2006-12-04 73826]
"BePCSC"="c:\program files\EmvSmartCardReader\BePCSC.exe" [2007-05-03 27136]
"beidsystemtray"="c:\program files\Belgium Identity Card\beidsystemtray.exe" [2007-02-19 188416]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-06-28 2512128]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-21 198160]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-10-11 31232]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-12-26 18081280]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2003-9-15 503869]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-27 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42	72208	----a-w	c:\program files\fichiers communs\logishrd\bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\[u]0/uOODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PhilipsDM\SA1916"=c:\program files\Philips\SA19XX\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.11\RivaTuner.exe" /S
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\IEPro\MiniDM.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=

R3 AIDA32Driver;AIDA32Driver; [x]
R3 eID Privacy Service;eID Privacy Service;c:\windows\system32\beidservicepcsc.exe [2007-02-19 331776]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1e51x86.sys [2008-08-24 37376]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-05 108289]
S2 eID CRL Service;eID CRL Service;c:\windows\system32\beidservicecrl.exe [2007-02-19 225280]
S3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-26 2831232]
S3 EMVSCARD;EMVSCARD;c:\windows\system32\Drivers\EMVSCARD.sys [2006-09-18 20269]


--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - GUSVC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://news.google.be/news?ned=fr_be
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: {{000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\IEPro\iepro.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jonathan\Application Data\Mozilla\Firefox\Profiles\z87h1j0x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.lycos.fr/
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-16 22:49
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="BB5DAE0BD4A137D592B1C78D2CA3232180AB05FB8E2FC8C0AA4916B776E6F5AC1A34C1B1C88CB4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6171C11EC38DE3D9DB7CE019D40AA5C585E08E17CF14B42FDAA812E6CA05A7ED51C5ABB1113867F21C090AA2E13B928C43E9A4A4DA20485F369BD86EE76B56BE21DFAA8473295D791660A6C0E0526AE1F84E0DA5A07F0C33030537C95F272AF66BDB55B74A60479E98420538B7EE290789F32B0E76EC192147971224382E967B325B2F93D1B72A60B8C933B2E85FAD0657286FE005E865905346CA1A547577E9FEFBEC18F6CE36F5E6A4B964255DBC6FED1FD8C6F8D3755EDC4BA332897D83705AE4803192E423BCFFA4E6B585FD79F6188D7B2C6EAAE98BBFE75A7FDFAF1A7C365E422CBA659C4CD8C4AD0444522D92DD4FB5F5C16A9855F32DD621D320C38BE0BCB16E0D0591CCCE610F59D5F56C98868F317C7624CD6CE1AD5D9C02B7029DA8C576C535B572245C1149BC1B96F171A686C6DE7D91B98856B649A658DD08A844A89C6E027CA8EB04BEF164F13513D8F70390EDB3982AAFD4CB4424E32BD422A9806D50D4C11EC8F22DFCF2D5E3F8D980ECEB70B6FCE443DD8160502A6AF8A3D3D14E421156A9A66DD4546004564296B4248BB9D22B46B461E79AA482D8270B4769F4F2500F9CB3C87250A3621CD0A3F83620000A9C9FEA3A0770DB2BA76570C73B805EABE49859C9AA8BF0002EB7BD1BC7F7FE49287AE63584A9D90F8ACF2C1D8930A83B9C5A318889BA250AB151D62CB25C8BF9DCCFE17ADD15DF9C42E4ED7BC07F7C6893D55C136EEFDDF9602E13782FDFD4B3E5C4A53028F6447306647D5AD117AD07D669CB07DB934AB6CD01319255855031EDCBBB3282CDE9702A40F462B4F510098D7D080AAB1BAF20F824BD2712499A99957D4D3E4EF8B4EB09A2BB5A886D0F6118F1C51FE3619B810FBFAB691782743C0BB6AD675CCBC8FEC62773A8D9F611ED06DFDC730C76F483787E418AA90F199595C256189D35BC516F51FE7B6A4011FF6B5C88966896C2A00D2A25150C7803AD96E809DC0BC61A043B4A45BF347BCEA561023443EC6D6B01BED1E3D0E22EBF4EF8C4FB9B5605E113D62DD3189D93BB2740A07A549EA08EFEACF183D6044E2E07DB6B666F0C0764D0125F50D2FD5B4EE0C14C5E20D876C408750A437BBF7A8D4144D2D59F3FEDECEC00B68959056F3DA8C817FB2025105BCBC2E2B12852C926F7E9800CDAFE1E556620189F5CE1A5AF4180DAC5196A0E8C50909673A95728A9139C1D17E8B5568627E5B7D5BFD07DB0185CF177EA973BF00206868A2BB801060F25695B062685ABCE3D1BDF9A42481055DCBDE7D116947D36B35133D3AAF34C5124B9427"
"OODEFRAG10.00.00.01WORKSTATION"="9561824B1F5232CAA3F84684FE3321904F15EFFCE6F8F5B912F05EEC1E8109E4AA8483EC9C1EAAD141A1974FFC52E3A9955ADF4DEF66C30FC73B05844DC2408624D1FBC52AA8A2A68A04F82984290421DF3FF9067EFC61178DE659A62922B43818A674D6DC4C28BDBF83E744A5A6D0A93448CC253CE1FCDF54BE973B9418178781347B1870F90F4106D3DE4214505D280152649BF6CF8C2EF1E201211433DB35BEFD227445B26D8F6100E3BCA73E8039178B57CD9D9247781F46D92AD296BC3591DEFD4BDB0F9BB84065FABEDC9CD5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B5559DB7CE019D40AA5C3D0367E6ADEB8E0E17778336B937408E5C35EAB931393811EF9E5B04F7755B1B2396A7C0B27B72D4EDE0872EE319AA0BEE16C821578A68B944A5C31DDC4E63AC2FE82578D9F8192C84C106971FA20F3EF6D6D2AC9BE2E1F3A7C90615D5D625458C9231BBB8BE938524DDD38FAD2A12DAF982828B102EFD527B7F62CDE0324E7A1C13F1BBDACB8416C9DB1C3AC8266BD63389A8F1387DA92C58216DAB6FAC2224724E5DAEBEC2A2D928C75BBC1CB1E6ED90C0E5188D86659F886A8E9667B2F5E0D788C24DD8EA3A8CA31065C2C70E659F3560B2B77D21C80B8CFE81FBA3D63491486C42560F2FA9B2D5095D7ADF1FDA2F7605D891E84A7A1418E255CB71CD5BD9F5894F8A3D1EE4900CEA3D976B6C502360AFF769A4A3B8A292FE6E7B13737D24C3D1B330B0EA73B1C84E5550E7A1E047B0C282877A7155E1172284823EC4C19DCA9B0D90AE6DEF6341B4465EC40FBE2A59083E36A51EB443757D24DE9DE2E037579FCAF96D1E0938DD020401E6282C9F82ACC6465934D079B1A52C10CE162A26EAFEB2BD979D03073E7B5AFA258502BE063F0B8AB965B7FD0194D01CE44500E339BA5CB04C2F356832CE66134B622DE1F036CDDADE88880DD227980B637F582CABB936AD1E388ABBBF891A13999FACA98867261457137A25431FE0E8C6F63D025DC67F9115C503A221A0BACA45BF17F641127D1424A5D48B2822D847FC82CD2A9F8E4CBEAA053183C26A620C75EA12F1C5D494BF387EF748873A05B9E5993B2DF5A48899D048BB87C622002FC56E5B0875B47C7DFE83D1A81DD23BD959DCCC571B7FEE0DE688DE9E0368D38B47B94365E2989C3AD3BCE9BA59BEA9C3228BDBBBF9F98F07C65FE9F9FEBFF282FCDEAD7D53CF2F6489585854DEB34E987B0ED6AEB2D050F73A0CBF8FFB8FC9765F979209C188C4F063A6CB0D05497D7D99EC41499BA86A568171581AE7A3144D5BBF7E82DDD7BD561B9C03C0D87FDF99235530E8BB85E99ACD163D96E92BE3F14FD512A889B6D3915D53D50F9836EE992F1BCD2FCF"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll
.
Heure de fin: ~,10time:~,-3
ComboFix-quarantined-files.txt  2009-04-16 20:50

Avant-CF: 449.845.211.136 octets libres
Après-CF: 449.818.120.192 octets libres

292	--- E O F ---	2009-03-17 18:46

Et le rapport SDFix :


[b]SDFix: Version 1.240 /b
Run by Administrateur on jeu. 16/04/2009 at 22:58

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files /b: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check /b:
 


                                 [b]Final Check /b:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-16 23:03:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d3c20ef28]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:2d,1f,1a,a2,ff,5a,92,92,ab,df,44,e6,eb,f6,4f,68,b0,98,08,15,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2e,be,75,ee,06,c5,9a,24,92,3f,13,c8,0e,a6,82,61,40,..
"khjeh"=hex:37,42,16,8a,05,a7,15,2f,0d,9c,80,37,5f,aa,10,af,47,c0,36,0a,93,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:99,b7,e1,2e,3c,38,72,2f,45,46,13,3e,2a,05,76,8b,ff,d0,68,d3,3d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\000d3c20ef28]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:2d,1f,1a,a2,ff,5a,92,92,ab,df,44,e6,eb,f6,4f,68,b0,98,08,15,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2e,be,75,ee,06,c5,9a,24,92,3f,13,c8,0e,a6,82,61,40,..
"khjeh"=hex:37,42,16,8a,05,a7,15,2f,0d,9c,80,37,5f,aa,10,af,47,c0,36,0a,93,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:99,b7,e1,2e,3c,38,72,2f,45,46,13,3e,2a,05,76,8b,ff,d0,68,d3,3d,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="BB5DAE0BD4A137D592B1C78D2CA3232180AB05FB8E2FC8C0AA4916B776E6F5AC1A34C1B1C88CB4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6171C11EC38DE3D9DB7CE019D40AA5C585E08E17CF14B42FDAA812E6CA05A7ED51C5ABB1113867F21C090AA2E13B928C43E9A4A4DA20485F369BD86EE76B56BE21DFAA8473295D791660A6C0E0526AE1F84E0DA5A07F0C33030537C95F272AF66BDB55B74A60479E98420538B7EE290789F32B0E76EC192147971224382E967B325B2F93D1B72A60B8C933B2E85FAD0657286FE005E865905346CA1A547577E9FEFBEC18F6CE36F5E6A4B964255DBC6FED1FD8C6F8D3755EDC4BA332897D83705AE4803192E423BCFFA4E6B585FD79F6188D7B2C6EAAE98BBFE75A7FDFAF1A7C365E422CBA659C4CD8C4AD0444522D92DD4FB5F5C16A9855F32DD621D320C38BE0BCB16E0D0591CCCE610F59D5F56C98868F317C7624CD6CE1AD5D9C02B7029DA8C576C535B572245C1149BC1B96F171A686C6DE7D91B98856B649A658DD08A844A89C6E027CA8EB04BEF164F13513D8F70390EDB3982AAFD4CB4424E32BD422A9806D50D4C11EC8F22DFCF2D5E3F8D980ECEB70B6FCE443DD8160502A6AF8A3D3D14E421156A9A66DD4546004564296B4248BB9D22B46B461E79AA482D8270B4769F4F2500F9CB3C87250A3621CD0A3F83620000A9C9FEA3A0770DB2BA76570C73B805EABE49859C9AA8BF0002EB7BD1BC7F7FE49287AE63584A9D90F8ACF2C1D8930A83B9C5A318889BA250AB151D62CB25C8BF9DCCFE17ADD15DF9C42E4ED7BC07F7C6893D55C136EEFDDF9602E13782FDFD4B3E5C4A53028F6447306647D5AD117AD07D669CB07DB934AB6CD01319255855031EDCBBB3282CDE9702A40F462B4F510098D7D080AAB1BAF20F824BD2712499A99957D4D3E4EF8B4EB09A2BB5A886D0F6118F1C51FE3619B810FBFAB691782743C0BB6AD675CCBC8FEC62773A8D9F611ED06DFDC730C76F483787E418AA90F199595C256189D35BC516F51FE7B6A4011FF6B5C88966896C2A00D2A25150C7803AD96E809DC0BC61A043B4A45BF347BCEA561023443EC6D6B01BED1E3D0E22EBF4EF8C4FB9B5605E113D62DD3189D93BB2740A07A549EA08EFEACF183D6044E2E07DB6B666F0C0764D0125F50D2FD5B4EE0C14C5E20D876C408750A437BBF7A8D4144D2D59F3FEDECEC00B68959056F3DA8C817FB2025105BCBC2E2B12852C926F7E9800CDAFE1E556620189F5CE1A5AF4180DAC5196A0E8C50909673A95728A9139C1D17E8B5568627E5B7D5BFD07DB0185CF177EA973BF00206868A2BB801060F25695B062685ABCE3D1BDF9A42481055DCBDE7D116947D36B35133D3AAF34C5124B9427"
"OODEFRAG10.00.00.01WORKSTATION"="9561824B1F5232CAA3F84684FE3321904F15EFFCE6F8F5B912F05EEC1E8109E4AA8483EC9C1EAAD141A1974FFC52E3A9955ADF4DEF66C30FC73B05844DC2408624D1FBC52AA8A2A68A04F82984290421DF3FF9067EFC61178DE659A62922B43818A674D6DC4C28BDBF83E744A5A6D0A93448CC253CE1FCDF54BE973B9418178781347B1870F90F4106D3DE4214505D280152649BF6CF8C2EF1E201211433DB35BEFD227445B26D8F6100E3BCA73E8039178B57CD9D9247781F46D92AD296BC3591DEFD4BDB0F9BB84065FABEDC9CD5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B5559DB7CE019D40AA5C3D0367E6ADEB8E0E17778336B937408E5C35EAB931393811EF9E5B04F7755B1B2396A7C0B27B72D4EDE0872EE319AA0BEE16C821578A68B944A5C31DDC4E63AC2FE82578D9F8192C84C106971FA20F3EF6D6D2AC9BE2E1F3A7C90615D5D625458C9231BBB8BE938524DDD38FAD2A12DAF982828B102EFD527B7F62CDE0324E7A1C13F1BBDACB8416C9DB1C3AC8266BD63389A8F1387DA92C58216DAB6FAC2224724E5DAEBEC2A2D928C75BBC1CB1E6ED90C0E5188D86659F886A8E9667B2F5E0D788C24DD8EA3A8CA31065C2C70E659F3560B2B77D21C80B8CFE81FBA3D63491486C42560F2FA9B2D5095D7ADF1FDA2F7605D891E84A7A1418E255CB71CD5BD9F5894F8A3D1EE4900CEA3D976B6C502360AFF769A4A3B8A292FE6E7B13737D24C3D1B330B0EA73B1C84E5550E7A1E047B0C282877A7155E1172284823EC4C19DCA9B0D90AE6DEF6341B4465EC40FBE2A59083E36A51EB443757D24DE9DE2E037579FCAF96D1E0938DD020401E6282C9F82ACC6465934D079B1A52C10CE162A26EAFEB2BD979D03073E7B5AFA258502BE063F0B8AB965B7FD0194D01CE44500E339BA5CB04C2F356832CE66134B622DE1F036CDDADE88880DD227980B637F582CABB936AD1E388ABBBF891A13999FACA98867261457137A25431FE0E8C6F63D025DC67F9115C503A221A0BACA45BF17F641127D1424A5D48B2822D847FC82CD2A9F8E4CBEAA053183C26A620C75EA12F1C5D494BF387EF748873A05B9E5993B2DF5A48899D048BB87C622002FC56E5B0875B47C7DFE83D1A81DD23BD959DCCC571B7FEE0DE688DE9E0368D38B47B94365E2989C3AD3BCE9BA59BEA9C3228BDBBBF9F98F07C65FE9F9FEBFF282FCDEAD7D53CF2F6489585854DEB34E987B0ED6AEB2D050F73A0CBF8FFB8FC9765F979209C188C4F063A6CB0D05497D7D99EC41499BA86A568171581AE7A3144D5BBF7E82DDD7BD561B9C03C0D87FDF99235530E8BB85E99ACD163D96E92BE3F14FD512A889B6D3915D53D50F9836EE992F1BCD2FCF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000016f

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\IEPro\MiniDM.exe"="C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files /b:



[b]Files with Hidden Attributes /b:

Mon 26 Jan 2009     1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 26 Jan 2009     5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Thu  5 Mar 2009     2,260,480 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed  3 May 2006       163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007        31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Sun 16 Mar 2008       216,064 ..SHR --- "C:\WINDOWS\system32\nbDX.dll"
Sun 26 Jun 2005       616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005        45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Sun  1 Mar 2009        90,624 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Mon 20 Oct 2008        16,447 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Mon 27 Oct 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue  4 Jun 2002        84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue  4 Jun 2002        44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002        73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002        65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun  9 Jun 2002        36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue  4 Jun 2002        20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002       102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002       176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002       208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002       217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun  9 Jun 2002        40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun  4 Nov 2001       225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001       225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004       232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Sun  9 Jun 2002       525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002       245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002        45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002        98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002        94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002        90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002       102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun  9 Jun 2002        49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Thu 20 Mar 2008         5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"

[b]Finished!/b


Au redémarrage, a.bat n'est plus venu en c:. C'est plutôt bon signe. Si je résume, je dois surveiller a.bat, Windir.exe et Winoper.exe. Si ces trucs ne se ramènent plus, sa doit être bon, non?

Je te tiens au courant.

A+ et encore merci,

Jtb.

jtb · Answer

Salut à toi,

Voilà, c'est fait pour Toolcleaner. Je laisse la discussion en "non-résolu" jusque ce soir vois demain pour quand même tout revérifier. Sait-on jamais !

[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\SDFIX: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Jonathan\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\Jonathan\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Jonathan\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Jonathan\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Jonathan\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Jonathan\Bureau\Rsit.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Jonathan\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\Jonathan\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Jonathan\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Jonathan\Bureau\HJTInstall.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\Jonathan\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\Jonathan\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !


J'aimerais en tout cas te remercier pour tout le temps que tu m'as consacré. Merci infiniment. :-)

Passe un très bon après-midi.

Jtb.

jlpjlp · Answer

ok vire combofix


C:\Documents and Settings\Jonathan\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !! 



a plus tu diras

jtb · Answer

Salut,

J'ai supprimé ComboFix.

J'ai bien vérifié et tout. J'ai fait toutes les analyses qu'il m'était possible de pratiquer: rien n'est réapparu et rien ne fût détecté.

C'est clean, plus aucun problème.

Merci pour tout. :-)

Passe une bonne journée,

Jtb.

PS : sais-tu ce que faisait ce virus/trojan ?

jlpjlp · Answer

je pense que ton infection etait du style ircbot et donc possibilité de prendre a distance le controle d'un ordi (mais apparement cela va si détécté par ton antivirus, et si le parefeu bloque l'infection)


pour info
http://www.secuser.com/alertes/2007/ircbotacd.htm
http://www.malekal.com/Backdoor.Win32.IRCBot.aaq.php

jtb · Answer

Ok, merci.

Encore bien que je n'ai jamais autorisé l'accès au net à l'une de ses applications donc. Je suis toujours assez méfiant quand un truc que je ne connais pas veut accéder à Internet.

Merci pour tout,

Jtb.

jlpjlp · Answer

ok avast sinon c'est pas le mieux en gratuit: antivir c'est meiux mais bon ...











pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite


vacciner son ordi après avoir branché toutes ses clés usb avec usbfix ou flash disinfector ou rav antivirus car beaucoup actuellement transitent par les supports externes :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus 
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe 
http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

---------
mettre un antivirus

ANTIVIR  ou AVG8 ou (AVAST ) 
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
https://www.avira.com/fr/free-antivirus-windows
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/-    si tea timer non active de spybot: 
 WINDOWS    DEFENDER ou  SPYWARE TERMINATOR ou SPYWARE GUARD
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot …  sortent de nouvelles versions régulièrement, vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/18128.html
https://www.zonealarm.com/software/free-firewall

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus  touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

jtb · Answer

Merci pour ces excellents conseils.  :-)

[Virus] a.bat

45 réponses

Votre réponse

Discussions similaires

Newsletters