Comment suprimer net-worm.win32.kido.ih

bonjour,

fichier log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by ribenmalek at 2009-08-07 10:27:49
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 6 GB (19%) free of 31 GB
Total RAM: 1013 MB (36% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:51, on 07/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$ONDSQL\Binn\sqlservr.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\OCS Inventory Agent\ocsservice.exe
c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\Symantec\Ghost\bin\rteng7.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ribenmalek\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\ribenmalek\Bureau\ribenmalek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.54.25:8888
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NGServer] C:\Program Files\Symantec\Ghost\ngserver.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE"
O4 - HKLM\..\Run: [RegGenie Scheduler] C:\Program Files\RegGenie\RegGenieScheduler.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=about:blank
O15 - Trusted Zone: http://*.crossknowledge.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = galaxie.tp
O17 - HKLM\Software\..\Telephony: DomainName = galaxie.tp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = galaxie.tp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = galaxie.tp
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Service Google Update (gupdate1ca0eaef0a79f6b) (gupdate1ca0eaef0a79f6b) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kaspersky Network Agent (klnagent) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
O23 - Service: Service de base de données Symantec Ghost (ngdbserv) - Symantec Corporation - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Serveur de configuration Symantec Ghost (NGServer) - Symantec Corporation - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - https://ocsinventory-ng.org/?lang=fr - C:\Program Files\OCS Inventory Agent\ocsservice.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
O24 - Desktop Component 0: (no name) - http://www.rustletheleaf.com/media/rustle/wallpapers/EarthDayGlobe_1024x768.jpg

bonjour,

fichier info.txt :

info.txt logfile of random's system information tool 1.06 2009-08-07 10:27:56

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
001Micron MSI to EXE Creator Demo-->"C:\Program Files\001Micron MSI to EXE Creator Demo\Uninstall.exe"
1.0-->"C:\Program Files\File Audit\unins000.exe"
3D Screen Creator 0.3.5-->"C:\Program Files\3D Screen Creator\unins000.exe"
7-Zip 4.32-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
Advanced IP Address Calculator v1.1-->C:\Program Files\Advanced IP Address Calculator\uninstal.exe
AppDeploy Repackager-->MsiExec.exe /I{7EB06EA7-915F-4261-849A-B58D1A6E509F}
Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AutoCAD 2007 - English-->MsiExec.exe /I{5783F2D7-5001-0409-0002-0060B0CE6BBA}
Autodesk DWF Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove /q0
Avaya CMS Supervisor R14-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F81ACFA5-1F96-470C-A923-195FF7730B92}\Setup.exe"
AVI-MPG-WMV Screensaver Trial-->"C:\Program Files\AVI-MPG-WMV Screensaver Trial\unins000.exe"
CutePDF Writer 2.7-->C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe
DameWare NT Utilities-->MsiExec.exe /I{0A558EA7-50CE-48CC-8FBF-D42C843B5BEF}
DameWare NT Utilities-->MsiExec.exe /I{0E5765EE-35A4-4715-AC95-090F1A2FECDA}
Documalis Free Scanner 1.0-->"C:\WINDOWS\Documalis Free Scanner 1.0\uninstall.exe" "/U:C:\Program Files\Documalis Free\FreeScanner\Uninstall\uninstall.xml"
DWG TrueView 2007-->MsiExec.exe /I{2CD6BBA0-17C8-4789-9B9B-B36F7E815F6A}
Eye On Network (désinstallation)-->"C:\Program Files\Eye On Network\uninst-Eye On Network.exe"
FileAudit-->MsiExec.exe /I{BB04AFEE-2BF2-4F75-9650-C825F63F2BBC}
Free PDF to Word Doc Converter v1.1-->"C:\Program Files\Free PDF to Word Doc Converter\unins000.exe"
FUSION WOL v1.0-->"C:\Program Files\Fusion\FUSION WOL\unins000.exe"
Ghost AI Snapshot-->C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\Ghost\AUTOIN~1\INSTAL~1\~0000.exe cfg="C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\Ghost\AUTOIN~1\INSTAL~1\{83AE8~1\UNINST~1.CFG" /all
GIMP 2.6.6-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Google Talk (remove only)-->"C:\Program Files\Google\Google Talk\uninstall.exe"
Google Talk Plugin-->MsiExec.exe /I{F6B1D53B-2A68-377D-AC39-C8FD359FF6F1}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HijackThis 2.0.2-->"C:\Documents and Settings\ribenmalek\Bureau\HijackThis.exe" /uninstall
Hotfix for Windows Media Format SDK (KB942423)-->"C:\WINDOWS\$NtUninstallKB942423$\spuninst\spuninst.exe"
HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9 anything
Inno Setup version 5.2.3-->"C:\Program Files\Inno Setup 5\unins000.exe"
Intel(R) Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall
IP Calculator-->MsiExec.exe /I{56B09FD6-8D5A-4C8D-BA28-B0B7FF9F4E8F}
iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
Japanese Fonts Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5760-0000-900000000003}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Kaspersky Administration Kit-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{12C259B1-8E8C-498D-927D-60040190BF79}
Kaspersky Anti-Virus 5.0 for Windows File Servers Console Plugin-->MsiExec.exe /X{91607FF0-D28A-48CC-9E39-E0882716A88B}
Kaspersky Anti-Virus 6.0 Console Plugin-->MsiExec.exe /X{F80373B5-40DD-46E9-8D56-EEA1AE6DB63E}
Kaspersky Anti-Virus 6.0 for Windows Workstations-->MsiExec.exe /I{79B986AD-54D8-4498-AA06-89808829ACC0}
Kaspersky Anti-Virus 6.0 for Windows Workstations-->MsiExec.exe /I{79B986AD-54D8-4498-AA06-89808829ACC0}
Kaspersky Network Agent-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{7C72AAB5-8A7D-4882-950C-A1F26A949DA3}
La boite a couleurs version 1.6.14-->"C:\Program Files\LaBoiteACouleurs\unins000.exe"
LiveProject-->MsiExec.exe /I{8E82BF91-3044-44F0-A0AB-57A1F466C17D}
LiveUpdate 1.6 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Project MUI (French) 2007-->MsiExec.exe /X{90120000-00B4-040C-0000-0000000FF1CE}
Microsoft Office Project Standard 2007 Trial-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJSTDR /dll OSETUP.DLL
Microsoft Office Project Standard 2007-->MsiExec.exe /X{91120000-003A-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Visio Professional 2003-->MsiExec.exe /I{9051040C-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server Desktop Engine (ONDSQL)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft Virtual PC 2007-->MsiExec.exe /X{8A7CAA24-7B23-410B-A7C3-F994B0944160}
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
MobileMe Control Panel-->MsiExec.exe /I{CADBCBBA-6CDD-4119-B5ED-4AE075B153E7}
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSIBuilder-->MsiExec.exe /I{03F39E93-14B1-4590-879F-EDCB52AFB44F}
MSXML 6.0 Parser (KB927977)-->MsiExec.exe /I{5A710547-B58E-488B-828D-CA9A25A0533C}
Net Profiles-->C:\Program Files\Net Profiles\uninstall.exe
Nullsoft Install System-->"C:\Program Files\NSIS\uninst-nsis.exe"
OCS Inventory Agent 4.0.5.0-->C:\Program Files\OCS Inventory Agent\uninst.exe
OpenOffice.org 3.1-->MsiExec.exe /I{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Packet Tracer 4.01-->"C:\Program Files\Packet Tracer 4.01\unins000.exe"
PDFCreator Toolbar-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_7687.exe" _?=C:\Program Files\PDFCreator Toolbar
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
PingPlotter Pro-->C:\PROGRA~1\PINGPL~1\UNWISE.EXE C:\PROGRA~1\PINGPL~1\INSTALL.LOG
Product Key Explorer 2.1.6-->"C:\Program Files\Nsasoft\ProductKeyExplorer\unins000.exe"
Quick Zip 4.60.019-->"C:\Program Files\QuickZip4\unins000.exe"
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
RealArcade-->C:\Program Files\Real\RealArcade\Update\rnuninst.exe RealNetworks|RealArcade|1.2
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
Safari-->MsiExec.exe /I{2D6ED011-055B-4041-B198-BB903827EBFB}
Scalable WinINSTALL LE-->MsiExec.exe /X{072704A7-00D6-4751-ADB6-BC8DD02EA356}
Seavus Project Viewer 4.0.0 Trial-->MsiExec.exe /X{5AA7A269-BAC3-4FB7-8D4C-764984C41B53}
Setup Generator-->C:\Program Files\Setup Generator\uninstall.exe
SimpleOCR 3.1-->C:\PROGRA~1\SIMPLE~1\UNWISE.EXE C:\PROGRA~1\SIMPLE~1\INSTALL.LOG
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
Symantec Ghost-->MsiExec.exe /I{4FFDE761-5EA2-4196-0B2F-A758F13F1088}
UltraVnc v1.0.3-->"C:\Program Files\UltraVnc\unins000.exe"
Unreal Tournament 2004-->C:\UT2004\System\Setup.exe uninstall "UT2004"
VideoLAN VLC media player 0.8.6a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VMware Infrastructure Update-->MsiExec.exe /X{D93B70D2-4DA4-4F6F-9DC8-72D08F74A386}
VNC Free Edition 4.1.2-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
Web Screen Saver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8ECD0514-CA61-4DD5-BE9B-6EE66C142885}\setup.exe" -l0x9 -uninst -removeonly
Windows Installer Wrapper Wizard 0.2.0-->MsiExec.exe /X{D91A8849-B8DF-4934-901D-4C0E498482CC}
Windows Media Encoder Studio Edition-->"C:\WINDOWS\$NtUninstallWMESE$\spuninst\spuninst.exe"
Windows Server 2003 Service Pack 1 Administration Tools Pack-->MsiExec.exe /I{27B3563C-561C-4924-8C0E-EA102264873F}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinImage-->"C:\Program Files\WinImage\winimage.exe" /uninstall
WinRAR Archiveur-->C:\Program Files\WinRAR\uninstall.exe
WinSCP 4.0.4-->"C:\Program Files\WinSCP\unins000.exe"
WordPerfect Office X4 - Common-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529010}
WordPerfect Office X4 - Content-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529014}
WordPerfect Office X4 - Filters-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529017}
WordPerfect Office X4 - FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529300}
WordPerfect Office X4 - Graphics FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529018}
WordPerfect Office X4 - ICA-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529005}
WordPerfect Office X4 - IPM FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529040}
WordPerfect Office X4 - IPM T FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529047}
WordPerfect Office X4 - Migration Manager-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529032}
WordPerfect Office X4 - PerfectExperts-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529054}
WordPerfect Office X4 - PR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529013}
WordPerfect Office X4 - QP-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529012}
WordPerfect Office X4 - Skins FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529016}
WordPerfect Office X4 - System-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529023}
WordPerfect Office X4 - WP-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529011}
WordPerfect Office X4-->c:\Program Files\Corel\WordPerfect Office X4\Setup\SetupARP.exe /arp
WordPerfect Office X4-->MsiExec.exe /I{000AB2ED-5741-4C30-A1A4-0FCB8A529000}

======Security center information======

AV: Kaspersky Anti-Virus
FW: Kaspersky Anti-Virus (disabled)

======System event log======

Computer Name: YOUR-5072A47D58
Event Code: 5788
Message: La tentative de mise à jour des noms principaux de service (SPN) HOST de l'objet
ordinateur dans Active Directory a échoué. Les valeurs mises à jour étaient 'HOST/YOUR-5072A47D58' et 'HOST/YOUR-5072A47D58'.
L'erreur suivante s'est produite :
Accès refusé.


Record Number: 5
Source Name: NETLOGON
Time Written: 20090108172934.000000+060
Event Type: erreur
User:

Computer Name: YOUR-5072A47D58
Event Code: 5789
Message: La tentative de mise à jour du nom d'hôte DNS de l'ordinateur
dans Active Directory a échoué. La valeur mise à jour était 'YOUR-5072A47D58'.
L'erreur suivante s'est produite :
Accès refusé.


Record Number: 4
Source Name: NETLOGON
Time Written: 20090108172934.000000+060
Event Type: erreur
User:

Computer Name: YOUR-5072A47D58
Event Code: 40961
Message: Le système de sécurité n'a pas pu établir une connexion sécurisée avec le serveur LDAP/srv2_kp.galaxie.tp. Aucun protocole n'était disponible.

Record Number: 3
Source Name: LSASRV
Time Written: 20090108172934.000000+060
Event Type: Avertissement
User:

Computer Name: YOUR-5072A47D58
Event Code: 3260
Message: Cet ordinateur a correctement été joint au domain 'galaxie.tp'.

Record Number: 2
Source Name: Workstation
Time Written: 20090108172931.000000+060
Event Type: Informations
User:

Computer Name: YOUR-5072A47D58
Event Code: 115
Message: Le suivi de la Restauration système a été activé sur tous les lecteurs.

Record Number: 1
Source Name: SRService
Time Written: 20090108172244.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: RIHAB_KP
Event Code: 4660
Message: La mise à jour a réussi

Record Number: 538
Source Name: Kaspersky Anti-Virus
Time Written: 20090131021420.000000+060
Event Type: Informations
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: La mise à jour a réussi

Record Number: 537
Source Name: Kaspersky Anti-Virus
Time Written: 20090130203329.000000+060
Event Type: Informations
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: Le fichier F:\.Autorun\835694854683549385398626893468946\Autorun.exe a été supprimé.

Record Number: 536
Source Name: Kaspersky Anti-Virus
Time Written: 20090130155405.000000+060
Event Type: Informations
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: Des objets dangereux ont été découverts. Il est conseillé de les neutraliser immédiatement.

Record Number: 535
Source Name: Kaspersky Anti-Virus
Time Written: 20090130155405.000000+060
Event Type: Avertissement
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: Le fichier F:\.Autorun\835694854683549385398626893468946\Autorun.exe, découvert : cheval de Troie 'Trojan.Win32.Agent.avtj'.

Record Number: 534
Source Name: Kaspersky Anti-Virus
Time Written: 20090130155405.000000+060
Event Type: Avertissement
User:

=====Security event log=====

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 4348

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229194
Source Name: Security
Time Written: 20090807030843.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 4348

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229193
Source Name: Security
Time Written: 20090807030842.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 5252

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229192
Source Name: Security
Time Written: 20090807030841.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 5252

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229191
Source Name: Security
Time Written: 20090807030840.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 5252

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229190
Source Name: Security
Time Written: 20090807030839.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

======Environment variables======

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"GS_LIB"=C:\Program Files\gs\gs8.14\lib
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\Autodesk\DWG TrueView\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=0f0d
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"windir"=%SystemRoot%

-----------------EOF-----------------