PC infecté par Win32.bagle.of

Salut Lyonnais92,

Merci de m'avoir pris en charge.

Voici le rapport:

############################## [ FindyKill V4.728 ]

# User : Administrateur (Administrateurs) # L-C38591E7A9A34
# Update on 03/05/09 by Chiquitine29
# Start at: 15:47:04 | 10/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled
# AV : Kaspersky Anti-Virus 8.0.0.454 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces # 1,39 Mo (1,21 Mo free) # FAT
# C:\ # Disque fixe local # 19,53 Go (5,69 Go free) # NTFS
# D:\ # Disque fixe local # 94,95 Go (75,55 Go free) # NTFS
# E:\ # Disque CD-ROM # 197,29 Mo (0 Mo free) [KasperskyAV2009] # CDFS
# F:\ # Disque CD-ROM # 3,5 Go (0 Mo free) [DISK1] # UDF
# G:\ # Disque amovible # 3,76 Go (3,71 Go free) # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe
C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe" (1740)
"C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe" (1772)
"C:\WINDOWS\system32\wintems.exe" (2024)

################## [ Fichiers / Dossiers infectieux ]

Found ! C:\WINDOWS\Prefetch\127390.EXE-1E1E8268.pf
Found ! C:\WINDOWS\Prefetch\132968.EXE-0D2C3A80.pf
Found ! C:\WINDOWS\Prefetch\14963796.EXE-13A91E2A.pf
Found ! C:\WINDOWS\Prefetch\15006000.EXE-38869202.pf
Found ! C:\WINDOWS\Prefetch\15038609.EXE-3990DA3E.pf
Found ! C:\WINDOWS\Prefetch\15104796.EXE-346FE405.pf
Found ! C:\WINDOWS\Prefetch\15120234.EXE-02510EF5.pf
Found ! C:\WINDOWS\Prefetch\15138843.EXE-242C37CD.pf
Found ! C:\WINDOWS\Prefetch\15183218.EXE-0985125A.pf
Found ! C:\WINDOWS\Prefetch\15198093.EXE-1DB3380F.pf
Found ! C:\WINDOWS\Prefetch\15453765.EXE-080FCD5B.pf
Found ! C:\WINDOWS\Prefetch\206578.EXE-098B9597.pf
Found ! C:\WINDOWS\Prefetch\232281.EXE-0E107FD4.pf
Found ! C:\WINDOWS\Prefetch\255656.EXE-0676EA61.pf
Found ! C:\WINDOWS\Prefetch\263031.EXE-0FF8714A.pf
Found ! C:\WINDOWS\Prefetch\273421.EXE-1A9FE536.pf
Found ! C:\WINDOWS\Prefetch\311468.EXE-36078050.pf
Found ! C:\WINDOWS\Prefetch\328125.EXE-05DF02DA.pf
Found ! C:\WINDOWS\Prefetch\378531.EXE-00048F2D.pf
Found ! C:\WINDOWS\Prefetch\469031.EXE-3041CEC0.pf
Found ! C:\WINDOWS\Prefetch\490296.EXE-049BE290.pf
Found ! C:\WINDOWS\Prefetch\512828.EXE-241489A5.pf
Found ! C:\WINDOWS\Prefetch\559593.EXE-001D7FFC.pf
Found ! C:\WINDOWS\Prefetch\804375.EXE-2BB40934.pf
Found ! C:\WINDOWS\Prefetch\FLEC006.EXE-0695BA6E.pf
Found ! C:\WINDOWS\Prefetch\KEY_GEN.EXE-0A0FE3B5.pf
Found ! C:\WINDOWS\Prefetch\MDELK.EXE-1D176F91.pf
Found ! C:\WINDOWS\Prefetch\WINTEMS.EXE-2A563F9B.pf
Found ! C:\WINDOWS\system32\ban_list.txt
Found ! C:\WINDOWS\system32\mdelk.exe
Found ! C:\WINDOWS\system32\wintems.exe
Found ! "C:\Documents and Settings\Administrateur\Application Data\drivers"
Found ! "C:\Documents and Settings\Administrateur\Application Data\drivers\downld"
Found ! "C:\Documents and Settings\Administrateur\Application Data\drivers\srosa2.sys"
Found ! "C:\Documents and Settings\Administrateur\Application Data\drivers\wfsintwq.sys"
Found ! "C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe"
Found ! "C:\Documents and Settings\Administrateur\Application Data\m"
Found ! "C:\Documents and Settings\Administrateur\Application Data\m\data.oct"
Found ! "C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe"
Found ! "C:\Documents and Settings\Administrateur\Application Data\m\list.oct"
Found ! "C:\Documents and Settings\Administrateur\Application Data\m\shared"
Found ! "C:\Documents and Settings\Administrateur\Application Data\m\srvlist.oct"

################## [ Infected Temp Files ]

Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_1[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_1[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_3[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_3[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_3[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0H4P0EPY\file[1].txt
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\5NQMF1F3\b64[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\5NQMF1F3\b64_3[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\5NQMF1F3\file[1].txt
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_1[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_1[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_1[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_3[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_3[4].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_3[5].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\HKEEU3LY\b64[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\HKEEU3LY\b64_3[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_1[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_1[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_1[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_3[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_3[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_1[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_1[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[2].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[3].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[4].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[5].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[6].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\YQSJ63X1\b64_1[1].jpg
Found ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\YQSJ63X1\b64_3[1].jpg

################## [ Registre / Clés infectieuses ]

Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\Local AppWizard-Generated Applications\key_gen
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\Local AppWizard-Generated Applications\winupgro
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\bisoft
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\DateTime4
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\FFC
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\MuleAppData
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_CURRENT_USER\Software\bisoft
Found ! HKEY_CURRENT_USER\Software\DateTime4
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# (!) HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# (!) HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]

Found ! E:\autorun.inf
Found ! F:\autorun.inf

################## [ Registre / Mountpoints2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.728 ! ]

Voici le nouveau rapport:

############################## [ FindyKill V4.728 ]

# User : Administrateur (Administrateurs) # L-C38591E7A9A34
# Update on 03/05/09 by Chiquitine29
# Start at: 16:11:47 | 10/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled
# AV : Kaspersky Anti-Virus 8.0.0.454 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces # 1,39 Mo (1,21 Mo free) # FAT
# C:\ # Disque fixe local # 19,53 Go (5,69 Go free) # NTFS
# D:\ # Disque fixe local # 94,95 Go (75,55 Go free) # NTFS
# E:\ # Disque CD-ROM # 197,29 Mo (0 Mo free) [KasperskyAV2009] # CDFS
# F:\ # Disque CD-ROM # 3,5 Go (0 Mo free) [DISK1] # UDF
# G:\ # Disque amovible # 3,76 Go (3,71 Go free) # FAT32

############################## [ Active Processes ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\KB905474\wgasetup.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\KB905474\wgasetup.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected Files \ Folders ]

Deleted ! C:\WINDOWS\Prefetch\127390.EXE-1E1E8268.pf
Deleted ! C:\WINDOWS\Prefetch\132968.EXE-0D2C3A80.pf
Deleted ! C:\WINDOWS\Prefetch\14963796.EXE-13A91E2A.pf
Deleted ! C:\WINDOWS\Prefetch\15006000.EXE-38869202.pf
Deleted ! C:\WINDOWS\Prefetch\15038609.EXE-3990DA3E.pf
Deleted ! C:\WINDOWS\Prefetch\15104796.EXE-346FE405.pf
Deleted ! C:\WINDOWS\Prefetch\15120234.EXE-02510EF5.pf
Deleted ! C:\WINDOWS\Prefetch\15138843.EXE-242C37CD.pf
Deleted ! C:\WINDOWS\Prefetch\15183218.EXE-0985125A.pf
Deleted ! C:\WINDOWS\Prefetch\15198093.EXE-1DB3380F.pf
Deleted ! C:\WINDOWS\Prefetch\15453765.EXE-080FCD5B.pf
Deleted ! C:\WINDOWS\Prefetch\206578.EXE-098B9597.pf
Deleted ! C:\WINDOWS\Prefetch\232281.EXE-0E107FD4.pf
Deleted ! C:\WINDOWS\Prefetch\255656.EXE-0676EA61.pf
Deleted ! C:\WINDOWS\Prefetch\263031.EXE-0FF8714A.pf
Deleted ! C:\WINDOWS\Prefetch\273421.EXE-1A9FE536.pf
Deleted ! C:\WINDOWS\Prefetch\311468.EXE-36078050.pf
Deleted ! C:\WINDOWS\Prefetch\328125.EXE-05DF02DA.pf
Deleted ! C:\WINDOWS\Prefetch\378531.EXE-00048F2D.pf
Deleted ! C:\WINDOWS\Prefetch\469031.EXE-3041CEC0.pf
Deleted ! C:\WINDOWS\Prefetch\490296.EXE-049BE290.pf
Deleted ! C:\WINDOWS\Prefetch\512828.EXE-241489A5.pf
Deleted ! C:\WINDOWS\Prefetch\559593.EXE-001D7FFC.pf
Deleted ! C:\WINDOWS\Prefetch\804375.EXE-2BB40934.pf
Deleted ! C:\WINDOWS\Prefetch\FLEC006.EXE-0695BA6E.pf
Deleted ! C:\WINDOWS\Prefetch\KEY_GEN.EXE-0A0FE3B5.pf
Deleted ! C:\WINDOWS\Prefetch\MDELK.EXE-1D176F91.pf
Deleted ! C:\WINDOWS\Prefetch\WINTEMS.EXE-2A563F9B.pf
Deleted ! C:\WINDOWS\system32\ban_list.txt
Deleted ! C:\WINDOWS\system32\mdelk.exe
Deleted ! C:\WINDOWS\system32\wintems.exe
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\drivers\srosa2.sys"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\drivers\wfsintwq.sys"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\m\data.oct"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\m\list.oct"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\m\srvlist.oct"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\drivers\downld"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\drivers"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\m\shared"
Deleted ! "C:\Documents and Settings\Administrateur\Application Data\m"

################## [ Infected Temp Files ]

Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_1[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_3[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\033TLBBS\b64_3[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\0H4P0EPY\file[1].txt
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\5NQMF1F3\b64[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\5NQMF1F3\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\5NQMF1F3\file[1].txt
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_1[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_1[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_3[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_3[4].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9O3SOFZX\b64_3[5].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\HKEEU3LY\b64[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\HKEEU3LY\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_1[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_1[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_3[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LGTTFKJS\b64_3[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_1[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[2].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[3].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[4].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[5].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OV3AOLVV\b64_3[6].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\YQSJ63X1\b64_1[1].jpg
Deleted ! C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\YQSJ63X1\b64_3[1].jpg

################## [ Registry / Infected keys ]

Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! HKEY_CURRENT_USER\Software\bisoft
Deleted ! HKEY_CURRENT_USER\Software\DateTime4
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\FFC
Deleted ! HKEY_USERS\S-1-5-21-299502267-1972579041-1417001333-500\Software\MuleAppData
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

################## [ Cleaning Removable drives ]

(!) Not deleted ! E:\autorun.inf
(!) Not deleted ! F:\autorun.inf

################## [ Registry / Mountpoint2 ]

# -> Not found !

################## [ States / Restarting of services ]

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3
# Ip6Fw -> # Type of startup =2
# SharedAccess -> # Type of startup =2
# wuauserv -> # Type of startup =2
# wscsvc -> # Type of startup =2
# Safe boot mode restored !

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe
CRC32 .. : b9b74a84
MD5 .... : dc56a64624a1169cdd25d62dae2aaf35

# -> Nothing found.

################## [ Corrupted files # Re-Installation required ]

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
C:\WINDOWS\$hf_mig$\KB900485\update\update.exe
C:\WINDOWS\$hf_mig$\KB910437\update\update.exe
C:\WINDOWS\$hf_mig$\KB911562\update\update.exe
C:\WINDOWS\$hf_mig$\KB916595\update\update.exe
C:\WINDOWS\$hf_mig$\KB920872\update\update.exe
C:\WINDOWS\$hf_mig$\KB922582\update\update.exe
C:\WINDOWS\$hf_mig$\KB923561\update\update.exe
C:\WINDOWS\$hf_mig$\KB924191\update\update.exe
C:\WINDOWS\$hf_mig$\KB925720\update\update.exe
C:\WINDOWS\$hf_mig$\KB927891\update\update.exe
C:\WINDOWS\$hf_mig$\KB930916\update\update.exe
C:\WINDOWS\$hf_mig$\KB931836\update\update.exe
C:\WINDOWS\$hf_mig$\KB932168\update\update.exe
C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe
C:\WINDOWS\$hf_mig$\KB933729\update\update.exe
C:\WINDOWS\$hf_mig$\KB935840\update\update.exe
C:\WINDOWS\$hf_mig$\KB937894\update\update.exe
C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB938464\update\update.exe
C:\WINDOWS\$hf_mig$\KB938828\update\update.exe
C:\WINDOWS\$hf_mig$\KB943055\update\update.exe
C:\WINDOWS\$hf_mig$\KB944653\update\update.exe
C:\WINDOWS\$hf_mig$\KB945553\update\update.exe
C:\WINDOWS\$hf_mig$\KB946026\update\update.exe
C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
C:\WINDOWS\$hf_mig$\KB950762\update\update.exe
C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
C:\WINDOWS\$hf_mig$\KB951066\update\update.exe
C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe
C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
C:\WINDOWS\$hf_mig$\KB952004\update\update.exe
C:\WINDOWS\$hf_mig$\KB952287\update\update.exe
C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
C:\WINDOWS\$hf_mig$\KB953838-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB953839\update\update.exe
C:\WINDOWS\$hf_mig$\KB954211\update\update.exe
C:\WINDOWS\$hf_mig$\KB954600\update\update.exe
C:\WINDOWS\$hf_mig$\KB955069\update\update.exe
C:\WINDOWS\$hf_mig$\KB955839\update\update.exe
C:\WINDOWS\$hf_mig$\KB956390-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB956391\update\update.exe
C:\WINDOWS\$hf_mig$\KB956572\update\update.exe
C:\WINDOWS\$hf_mig$\KB956802\update\update.exe
C:\WINDOWS\$hf_mig$\KB956803\update\update.exe
C:\WINDOWS\$hf_mig$\KB956841\update\update.exe
C:\WINDOWS\$hf_mig$\KB957095\update\update.exe
C:\WINDOWS\$hf_mig$\KB957097\update\update.exe
C:\WINDOWS\$hf_mig$\KB958215-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB958644\update\update.exe
C:\WINDOWS\$hf_mig$\KB958687\update\update.exe
C:\WINDOWS\$hf_mig$\KB958690\update\update.exe
C:\WINDOWS\$hf_mig$\KB959426\update\update.exe
C:\WINDOWS\$hf_mig$\KB960225\update\update.exe
C:\WINDOWS\$hf_mig$\KB960714-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB960715\update\update.exe
C:\WINDOWS\$hf_mig$\KB960803\update\update.exe
C:\WINDOWS\$hf_mig$\KB961260-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB961373\update\update.exe
C:\WINDOWS\$hf_mig$\KB963027-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB967715\update\update.exe
C:\WINDOWS\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\sysinfo.exe
C:\WINDOWS\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\update\update.exe
C:\WINDOWS\system32\dllcache\register.exe
C:\WINDOWS\system32\dllcache\sysinfo.exe

################################### [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! End of Report # FindyKill V4.728 ! ]

Voici le rapport:

OTListIt Extras logfile created on: 10/05/2009 17:20:49 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.6 Folder = C:\Documents and Settings\Administrateur\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

510,73 Mb Total Physical Memory | 177,39 Mb Available Physical Memory | 34,73% Memory free
1,21 Gb Paging File | 0,94 Gb Available in Paging File | 77,69% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 6,89 Gb Free Space | 35,25% Space Free | Partition Type: NTFS
Drive D: | 94,95 Gb Total Space | 75,55 Gb Free Space | 79,56% Space Free | Partition Type: NTFS
Drive E: | 197,29 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,50 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 3,76 Gb Total Space | 3,71 Gb Free Space | 98,82% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: L-C38591E7A9A34
Current User Name: Administrateur
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== File Associations ==========/color

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.txt [@ = txtfile] -- C:\WINDOWS\notepad.exe (Microsoft Corporation)

[color=orange]========== Security Center Settings ==========/color

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"26190:TCP" = 26190:TCP:*:Enabled:BitComet 26190 TCP
"26190:UDP" = 26190:UDP:*:Enabled:BitComet 26190 UDP

[color=orange]========== Authorized Applications List ==========/color

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2008/05/21 04:37:24 | 12,844,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
[2007/04/27 11:25:54 | 14,672,448 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
[2008/05/04 10:36:25 | 00,075,072 | R--- | M] (Kaspersky Lab) -- E:\setup.exe:*:Disabled:Programme d'installation de Kaspersky Anti-Virus 2009
[2008/08/02 15:52:12 | 05,484,544 | ---- | M] (http://www.emule-project.net) -- C:\Program Files\eMule\emule.exe:*:Enabled:eMule
[2009/01/15 22:09:06 | 00,136,512 | ---- | M] (Tencent) -- C:\Program Files\Tencent\QQ2009\Bin\QQ.exe:*:Enabled:QQ2009
[2008/08/04 17:22:18 | 00,140,320 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe
[2008/08/04 17:22:18 | 00,230,432 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\LifeEnC2.exe:*:Enabled:LifeEnC2.exe
[2008/08/04 17:22:18 | 00,160,800 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe
[2008/08/04 17:22:18 | 00,107,552 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\LifeTray.exe:*:Enabled:LifeTray.exe
[2006/09/17 05:15:16 | 03,110,488 | ---- | M] (THQ Canada Inc.) -- D:\Jeux\Dawn of War - Dark Crusade\DarkCrusade.exe:*:Enabled:DarkCrusade
[2009/02/04 13:27:34 | 23,975,720 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========/color

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}" = 腾讯QQ2009
"{08094E03-AFE4-4853-9D31-6D0743DF5328}" = QuickTime
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{12018183-866A-11D3-97DF-0000F8D8F2E9}" = Symantec pcAnywhere
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3592F5CB-B524-43AA-92F2-2377268199CC}" = iTunes
"{3D654496-9C3D-4565-858C-3E551ECDA4E2}" = Virtual Cable Tester
"{3F7924B9-D148-3141-87B1-68F36043A940}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA
"{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}" = Acronis True Image Home
"{4669544E-20E4-4E56-8B44-2E6E1200051F}" = Canon MP Toolbox 4.1.1.0.mp10
"{511DF669-2930-30C0-8EB6-552887E29EC8}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA
"{53480370-6CA2-47EC-BC05-02B4B9271C31}" = O&O Defrag Professional Edition
"{58F8C6D9-5B55-486A-A322-4E8D87670031}" = Pilotes Canon MP
"{6580C5A3-2336-4EC5-85F1-3448C5F6208A}" = Kaspersky Anti-Virus 2009
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6BCB7EAA-598C-4836-B7EA-3642E41AA222}" = Microsoft LifeCam
"{7B08D306-7266-4647-A926-2F78817ED1E0}" = Microsoft Corporation
"{90120000-0010-040C-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (French) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{898E1CBF-5FFD-4CE8-88F1-132D826A5A52}" =
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0015-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_PROPLUS_{5A2F65A4-808F-4A1E-973E-92E17824982D}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_PROPLUS_{B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007
"{90120000-0044-040C-0000-0000000FF1CE}_PROPLUS_{A0353900-21A2-42CF-B973-883500A027F7}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_PROPLUS_{EC50B538-CBE1-42E6-B7FE-87AA540AADFB}" = Microsoft Office Language Pack 2007 Service Pack 1 (SP1)
"{AC76BA86-7AD7-1036-7B44-A81300000003}" = Adobe Reader 8.1.4 - Français
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" =
"{EE467474-04A8-48D5-8DDF-0F8D3A3CCBE5}" = VirginMega.Fr Premium
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{FF39FC01-819B-42E4-AE49-1968AF12DDD4}" = Dawn of War - Dark Crusade
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AnyDVD" = AnyDVD
"eMule" = eMule
"FindyKill" = FindyKill
"HijackThis" = HijackThis 2.0.2
"InstallWIX_{6580C5A3-2336-4EC5-85F1-3448C5F6208A}" = Kaspersky Anti-Virus 2009
"Kaspersky Online Scanner" = Kaspersky Online Scanner
"Kaspersky On-line Scanner" = Kaspersky On-line Scanner
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 3.0 (Symantec Corporation)
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero 7 Lite_is1" = Nero Lite 7.8.5.0
"PokerStars" = PokerStars
"Privacy components" = Privacy components
"PROPLUS" = Microsoft Office Professional Plus 2007
"RealPlayer 6.0" = RealPlayer
"Satsuki Decoder Pack" = Satsuki Decoder Pack
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Lecteur Windows Media 11
"WinRAR archiver" = Archiveur WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xfire" = Xfire (remove only)
"XnView_is1" = XnView 1.91
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

[color=orange]========== Last 10 Event Log Errors ==========/color

[ Application Events ]
Error - 08/02/2009 06:22:38 | Computer Name = L-C38591E7A9A34 | Source = Microsoft Office 12 | ID = 5000
Description = EventType offdiag12, P1 1b8344ab-52d8-479a-8d6c-6a0b5c75fe7f6dfee62e-69df-4f51-b8cb-b6da9dfd3031,
P2 NIL, P3 NIL, P4 NIL, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 04/03/2009 13:10:05 | Computer Name = L-C38591E7A9A34 | Source = Microsoft Office 12 | ID = 2000
Description = Accepted Safe Mode action : Microsoft Office Outlook.

Error - 18/03/2009 13:28:12 | Computer Name = L-C38591E7A9A34 | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 outlook.exe, P2 12.0.6316.5000, P3
ntdll.dll, P4 5.1.2600.2180, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

[ OSession Events ]
Error - 18/10/2008 11:27:35 | Computer Name = L-C38591E7A9A34 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6308.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1608
seconds with 960 seconds of active time. This session ended with a crash.

Error - 20/04/2009 16:18:53 | Computer Name = L-C38591E7A9A34 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 3427 seconds with 3000 seconds of active time. This session ended with a
crash.

Error - 03/05/2009 16:00:10 | Computer Name = L-C38591E7A9A34 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 9
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 10/05/2009 07:54:13 | Computer Name = L-C38591E7A9A34 | Source = DCOM | ID = 10001
Description = Le démarrage d'un serveur DCOM : {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
en tant que n'est pas possible. L'erreur : "%2" s'est produite lors du démarrage
de la commande : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
-Embedding

Error - 10/05/2009 07:54:14 | Computer Name = L-C38591E7A9A34 | Source = DCOM | ID = 10001
Description = Le démarrage d'un serveur DCOM : {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
en tant que n'est pas possible. L'erreur : "%2" s'est produite lors du démarrage
de la commande : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
-Embedding

Error - 10/05/2009 07:57:39 | Computer Name = L-C38591E7A9A34 | Source = Service Control Manager | ID = 7023
Description = Le service Explorateur d'ordinateur s'est arrêté avec l'erreur : %%1460

Error - 10/05/2009 10:12:53 | Computer Name = L-C38591E7A9A34 | Source = Service Control Manager | ID = 7001
Description = Le service Configuration automatique sans fil dépend du service NDIS
mode utilisateur E/S Protocole qui n'a pas pu démarrer en raison de l'erreur :
%%1058

Error - 10/05/2009 10:12:53 | Computer Name = L-C38591E7A9A34 | Source = Service Control Manager | ID = 7000
Description = Le service Kaspersky Anti-Virus n'a pas pu démarrer en raison de l'erreur :
%%193

Error - 10/05/2009 10:12:53 | Computer Name = L-C38591E7A9A34 | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
charger : kl1 klbg KLIF

Error - 10/05/2009 10:16:30 | Computer Name = L-C38591E7A9A34 | Source = DCOM | ID = 10001
Description = Le démarrage d'un serveur DCOM : {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
en tant que n'est pas possible. L'erreur : "%2" s'est produite lors du démarrage
de la commande : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
-Embedding

Error - 10/05/2009 10:16:33 | Computer Name = L-C38591E7A9A34 | Source = DCOM | ID = 10001
Description = Le démarrage d'un serveur DCOM : {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
en tant que n'est pas possible. L'erreur : "%2" s'est produite lors du démarrage
de la commande : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
-Embedding

Error - 10/05/2009 11:17:57 | Computer Name = L-C38591E7A9A34 | Source = DCOM | ID = 10001
Description = Le démarrage d'un serveur DCOM : {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
en tant que n'est pas possible. L'erreur : "%2" s'est produite lors du démarrage
de la commande : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
-Embedding

Error - 10/05/2009 11:18:04 | Computer Name = L-C38591E7A9A34 | Source = DCOM | ID = 10001
Description = Le démarrage d'un serveur DCOM : {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
en tant que n'est pas possible. L'erreur : "%2" s'est produite lors du démarrage
de la commande : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
-Embedding

< End of report >

Ok, voici le rapport:

OTListIt logfile created on: 10/05/2009 17:20:49 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.6 Folder = C:\Documents and Settings\Administrateur\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

510,73 Mb Total Physical Memory | 177,39 Mb Available Physical Memory | 34,73% Memory free
1,21 Gb Paging File | 0,94 Gb Available in Paging File | 77,69% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 6,89 Gb Free Space | 35,25% Space Free | Partition Type: NTFS
Drive D: | 94,95 Gb Total Space | 75,55 Gb Free Space | 79,56% Space Free | Partition Type: NTFS
Drive E: | 197,29 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,50 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 3,76 Gb Total Space | 3,71 Gb Free Space | 98,82% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: L-C38591E7A9A34
Current User Name: Administrateur
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2007/02/16 18:49:50 | 00,411,168 | ---- | M] (Acronis) -- C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
PRC - [2008/08/04 17:22:18 | 00,164,896 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2007/02/15 13:45:36 | 00,707,344 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe
PRC - [2002/09/20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2007/06/13 15:22:28 | 01,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2007/03/14 03:43:44 | 00,083,608 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
PRC - [2006/12/06 18:37:40 | 00,069,216 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
PRC - [2007/02/17 17:30:24 | 01,190,064 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2007/02/17 17:34:54 | 01,965,736 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
PRC - [2007/02/16 18:49:58 | 00,149,024 | ---- | M] (Acronis) -- C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
PRC - [2007/04/27 11:25:58 | 00,257,088 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2007/04/27 09:41:54 | 00,282,624 | ---- | M] (Apple Inc.) -- C:\Program Files\QuickTime\qttask.exe
PRC - [2005/11/22 21:05:00 | 00,344,064 | ---- | M] (ATI Technologies, Inc.) -- C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
PRC - [2003/05/29 16:28:32 | 00,790,528 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2003/05/30 09:42:22 | 00,585,728 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
PRC - [2008/09/20 10:04:53 | 00,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
PRC - [2007/04/27 11:25:52 | 00,500,800 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2007/03/14 03:43:42 | 00,272,024 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
PRC - [2009/02/28 06:54:41 | 00,636,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/05/10 17:19:11 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrateur\Bureau\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2007/02/16 18:49:50 | 00,411,168 | ---- | M] (Acronis) -- C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc [Auto | Running])
SRV - [2007/10/24 02:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009/05/10 17:15:18 | 00,206,088 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe -- (AVP [Auto | Running])
SRV - [2006/04/25 12:01:00 | 00,106,496 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\pcAnywhere\awhost32.exe -- (awhost32 [Disabled | Stopped])
SRV - [2007/10/24 02:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2007/10/09 13:58:12 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2009/04/28 21:28:16 | 00,182,768 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped])
SRV - [2004/08/04 04:54:36 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2007/10/11 10:55:10 | 00,864,256 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2007/04/27 11:25:52 | 00,500,800 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2006/02/20 14:07:11 | 02,041,536 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate [On_Demand | Stopped])
SRV - [2008/08/04 17:22:18 | 00,164,896 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc [Auto | Running])
SRV - [2007/10/11 10:55:14 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2007/02/15 13:45:36 | 00,707,344 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe -- (O&O Defrag [Auto | Running])
SRV - [2007/08/24 03:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2002/09/20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) [Auto | Running])
SRV - [2006/11/03 09:59:14 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2004/04/30 09:37:02 | 00,160,640 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\a347bus.sys -- (a347bus [Boot | Running])
DRV - [2004/04/30 09:33:00 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi [Boot | Running])
DRV - [2003/03/13 12:34:48 | 00,100,224 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio [On_Demand | Running])
DRV - [2006/10/20 19:42:41 | 00,020,096 | ---- | M] (SlySoft, Inc.) -- C:\WINDOWS\System32\Drivers\AnyDVD.sys -- (AnyDVD [On_Demand | Running])
DRV - [1999/09/10 13:06:00 | 00,025,244 | ---- | M] (Adaptec) -- C:\WINDOWS\System32\drivers\aspi32.sys -- (Aspi32 [Auto | Running])
DRV - [2004/08/04 00:59:44 | 00,095,360 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\atapi.sys -- (atapi [Boot | Running])
DRV - [2004/08/04 02:38:44 | 00,701,440 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2005/10/10 14:09:38 | 00,007,552 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\system32\drivers\awechomd.sys -- (awecho [System | Running])
DRV - [2003/11/17 19:06:48 | 00,011,165 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\Drivers\awlegacy.sys -- (awlegacy [System | Running])
DRV - [2005/11/21 14:42:08 | 00,011,008 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\system32\drivers\aw_host5.sys -- (AW_HOST [System | Running])
DRV - [2006/04/22 03:44:39 | 00,008,064 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\System32\Drivers\ElbyCDIO.sys -- (ElbyCDIO [Auto | Running])
DRV - [2006/09/19 14:44:04 | 00,015,664 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
DRV - [2003/04/21 13:00:32 | 00,013,898 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\GERNUWA.sys -- (Gernuwa [Boot | Running])
DRV - [2008/07/21 17:34:36 | 00,121,872 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1 [Boot | Running])
DRV - [2009/05/10 17:15:18 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg [Boot | Running])
DRV - [2009/05/10 17:15:18 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\DRIVERS\klif.sys -- (KLIF [System | Running])
DRV - [2008/04/30 17:06:48 | 00,024,592 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\DRIVERS\klim5.sys -- (klim5 [On_Demand | Running])
DRV - [2002/09/20 04:53:34 | 00,235,100 | ---- | M] (Analog Devices Inc) -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn [On_Demand | Stopped])
DRV - [2008/08/04 17:22:18 | 00,033,808 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\nx6000.sys -- (MSHUSBVideo [On_Demand | Running])
DRV - [2001/08/28 18:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2007/11/13 12:25:54 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2003/06/02 13:42:14 | 00,578,304 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2008/08/24 21:03:46 | 00,114,048 | ---- | M] (Acronis) -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman [Boot | Running])
DRV - [2008/08/24 21:04:04 | 00,032,768 | ---- | M] (Acronis) -- C:\WINDOWS\system32\DRIVERS\tifsfilt.sys -- (tifsfilter [Auto | Running])
DRV - [2008/08/24 21:04:04 | 00,392,320 | ---- | M] (Acronis) -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter [Boot | Running])
DRV - [2004/08/04 00:07:56 | 00,059,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio [On_Demand | Running])
DRV - [2003/10/23 06:28:00 | 00,174,336 | ---- | M] (Marvell Semiconductor Inc.) -- C:\WINDOWS\system32\DRIVERS\yukonwxp.sys -- (yukonwxp [On_Demand | Running])
DRV - [2006/11/02 16:51:58 | 00,013,560 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4c74-92FE-5B863F82066B} [Auto | Running])

[color=orange]========== Standard Registry (SafeList) ==========[/color]

[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
IE - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
IE - HKU\S-1-5-21-299502267-1972579041-1417001333-500\S-1-5-21-299502267-1972579041-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [2008/09/20 10:05:33 | 00,000,000 | ---D | M]

O1 HOSTS File: (862 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 rad.msn.com
O1 - Hosts: 127.0.0.1 rad.live.com
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: () - {D032570A-5F63-4812-A094-87D007C23012} - C:\PROGRA~1\PRIVAC~1\tools\sp\spbho.dll File not found
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\..\Toolbar\WebBrowser: (no name) - {89FDCC4B-8D91-49B0-81A6-18BCFF582735} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" (ATI Technologies, Inc.)
O4 - HKLM..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" (Kaspersky Lab)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" ()
O4 - HKLM..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" (Cyberlink Corp.)
O4 - HKLM..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKU\S-1-5-21-299502267-1972579041-1417001333-500..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe File not found
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation)
O4 - HKLM..\RunOnceEx: [TITLE] Installations d'application File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 219
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceClassicControlPanel = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun: NoDriveTypeAutoRun = 219
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 219
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 1
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowCpl = 1
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-299502267-1972579041-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowCpl: 1 = Polices
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (CKAVWebScan Object)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {91D4B4D5-E368-40AB-8F53-A37FA634B471} http://www3.tellmemorecampus.com/bin/tol9inst.cab (Installer9Ctrl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd3.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-299502267-1972579041-1417001333-500 Winlogon: Shell - (C:\Program) - File not found
O20 - HKU\S-1-5-21-299502267-1972579041-1417001333-500 Winlogon: Shell - (Files\Privacy) - File not found
O20 - HKU\S-1-5-21-299502267-1972579041-1417001333-500 Winlogon: Shell - (components\pc.exe) - File not found
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O20 - Winlogon\Notify\PCANotify: DllName - PCANotify.dll - C:\WINDOWS\system32\PCANotify.dll (Symantec Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/24 19:43:31 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/12/22 13:19:20 | 00,000,038 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006/09/15 20:31:42 | 00,983,040 | R--- | M] () - F:\autoplay.exe -- [ UDF ]
O32 - AutoRun File - [2006/09/13 09:06:40 | 00,001,989 | R--- | M] () - F:\Autoplay.ini -- [ UDF ]
O32 - AutoRun File - [2006/09/15 05:50:54 | 00,000,870 | R--- | M] () - F:\Autoplay.ucs -- [ UDF ]
O32 - AutoRun File - [2006/09/01 00:39:37 | 00,576,056 | R--- | M] () - F:\autorun.bmp -- [ UDF ]
O32 - AutoRun File - [2006/08/30 14:00:03 | 00,000,049 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[2009/05/10 17:19:16 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrateur\Bureau\OTListIt2.exe
[2009/05/10 17:05:31 | 00,101,287 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2009/05/10 17:05:31 | 00,089,601 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2009/05/10 17:04:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
[2009/05/10 17:04:35 | 00,226,832 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2009/05/10 15:46:20 | 00,001,376 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\FindyKill V4.728.lnk
[2009/05/10 15:46:16 | 00,000,000 | ---D | C] -- C:\FindyKill
[2009/05/10 15:44:47 | 01,380,803 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\FindyKill.exe
[2009/05/10 13:51:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
[2009/05/10 13:51:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrateur\Bureau\kavkisremover
[2009/05/10 12:51:46 | 00,022,876 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\Rapport analyse scanner Kaspersky du 10-05-09.html
[2009/05/04 18:10:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrateur\Bureau\3q7ht-xpshu-cdecz-x7jg4
[2009/05/04 18:04:09 | 00,339,851 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\kavkisremover.zip
[2009/05/04 18:03:55 | 38,712,600 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\Administrateur\Bureau\kav8.0.0.506fr.exe
[2009/05/03 21:55:01 | 00,000,967 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\3q7ht-xpshu-cdecz-x7jg4.zip
[2009/05/03 20:13:34 | 00,024,662 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\rapport analyse scanner Kaspersky du 03-05-09.html
[2009/05/03 18:18:28 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Kaspersky Lab
[2009/05/03 17:49:48 | 00,715,618 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\av-i386-daily.zip
[2009/04/29 18:13:23 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Administrateur\Bureau\Nouveau Porte-documents
[2009/04/16 16:36:17 | 03,175,196 | ---- | C] () -- C:\Documents and Settings\Administrateur\Bureau\IMG_2165.jpg
[2009/04/15 11:31:51 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/04/15 11:31:51 | 00,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\colbact.dll
[2009/04/11 10:21:15 | 00,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\Windows Live
[2009/04/11 10:18:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
[2009/04/11 10:18:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrateur\Application Data\MSN6
[2009/03/09 00:30:49 | 00,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2009/03/04 23:00:53 | 00,002,469 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/09/22 23:11:34 | 00,006,656 | ---- | C] () -- C:\WINDOWS\System32\CNMVSyd.DLL
[2008/09/22 23:11:22 | 00,000,599 | ---- | C] () -- C:\WINDOWS\System32\CNCMP51.INI
[2008/09/01 23:20:19 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/08/24 23:39:02 | 00,003,455 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008/08/24 23:38:56 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/08/24 22:17:45 | 00,147,456 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2008/08/24 21:04:16 | 00,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys
[2008/08/24 21:04:16 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys
[2008/08/24 20:57:33 | 00,000,026 | ---- | C] () -- C:\WINDOWS\System32\satsukidecodersettings.ini
[2007/05/08 20:23:10 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2006/12/10 23:32:16 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2004/08/04 02:59:44 | 00,095,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atapi.sys
[2001/08/28 18:00:00 | 00,000,582 | ---- | C] () -- C:\WINDOWS\win.ini
[2001/08/28 18:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[16 C:\WINDOWS\*.tmp files]
[2009/05/10 17:19:11 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrateur\Bureau\OTListIt2.exe
[2009/05/10 17:15:18 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2009/05/10 17:15:18 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klbg.sys
[2009/05/10 17:15:17 | 00,101,287 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2009/05/10 17:15:17 | 00,089,601 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2009/05/10 17:12:21 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2009/05/10 17:11:37 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Administrateur\Local Settings\desktop.ini
[2009/05/10 17:11:37 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/05/10 17:11:33 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/05/10 17:11:32 | 53,561,3440 | -HS- | M] () -- C:\hiberfil.sys
[2009/05/10 17:11:25 | 00,126,294 | ---- | M] () -- C:\WINDOWS\System32\OODBS.lor
[2009/05/10 17:10:42 | 00,426,016 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2009/05/10 17:10:42 | 00,003,584 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
[2009/05/10 17:10:41 | 01,802,784 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2009/05/10 17:10:41 | 00,016,212 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2009/05/10 17:04:15 | 40,373,248 | ---- | M] () -- C:\kav.fr.msi
[2009/05/10 16:17:20 | 01,130,922 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/05/10 16:17:20 | 00,513,492 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2009/05/10 16:17:20 | 00,444,528 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/05/10 16:17:20 | 00,085,696 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2009/05/10 16:17:20 | 00,072,152 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/05/10 15:46:20 | 00,001,376 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\FindyKill V4.728.lnk
[2009/05/10 15:44:47 | 01,380,803 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\FindyKill.exe
[2009/05/10 13:59:54 | 00,002,623 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\Microsoft Office Outlook 2007.lnk
[2009/05/10 13:51:33 | 00,070,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sysinfo.exe
[2009/05/10 13:51:33 | 00,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\register.exe
[2009/05/10 12:51:46 | 00,022,876 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\Rapport analyse scanner Kaspersky du 10-05-09.html
[2009/05/10 11:08:33 | 00,002,529 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\Microsoft Office Excel 2007.lnk
[2009/05/09 19:55:49 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/05/09 11:45:37 | 00,002,575 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\Microsoft Office Word 2007.lnk
[2009/05/07 20:02:38 | 00,002,265 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Bureau\Skype.lnk
[2009/05/07 20:01:41 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/05/04 18:04:09 | 00,339,851 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\kavkisremover.zip
[2009/05/04 18:03:55 | 38,712,600 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\Administrateur\Bureau\kav8.0.0.506fr.exe
[2009/05/03 21:54:47 | 00,000,967 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\3q7ht-xpshu-cdecz-x7jg4.zip
[2009/05/03 20:13:34 | 00,024,662 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\rapport analyse scanner Kaspersky du 03-05-09.html
[2009/05/03 16:53:04 | 00,715,618 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\av-i386-daily.zip
[2009/05/01 18:54:36 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Bureau\Adobe Reader 8.lnk
[2009/04/22 22:46:44 | 00,002,505 | ---- | M] () -- C:\Documents and Settings\Administrateur\Bureau\Microsoft Office PowerPoint 2007.lnk
[2009/04/17 22:10:09 | 00,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI
[2009/04/15 13:21:02 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/04/11 23:42:40 | 00,000,582 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/04/11 23:42:40 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/11 23:42:40 | 00,000,212 | -HS- | M] () -- C:\boot.ini

[color=orange]========== LOP Check ==========[/color]

[2009/05/10 16:12:04 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Administrateur\Application Data
[2008/09/08 23:20:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Adobe
[2009/03/04 23:07:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Ahead
[2008/10/18 17:02:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Canon
[2008/10/09 00:06:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Google
[2009/01/21 00:18:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Help
[2008/08/24 21:09:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Identities
[2009/03/24 00:47:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\InstallShield
[2008/09/03 23:46:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Macromedia
[2008/09/22 22:12:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
[2009/05/02 20:36:53 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Administrateur\Application Data\Microsoft
[2009/04/11 10:18:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\MSN6
[2009/03/14 18:06:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Privacy components
[2008/09/17 23:38:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Real
[2009/05/07 21:02:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Skype
[2009/05/07 20:02:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\skypePM
[2008/08/24 21:12:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\SlySoft
[2008/08/24 20:47:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Sun
[2008/08/24 21:07:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Symantec
[2009/01/15 22:10:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Tencent
[2009/03/23 23:44:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\U3
[2009/03/24 00:55:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Xfire
[2009/04/11 11:25:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\XnView
[2008/08/24 20:35:05 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2008/08/24 19:43:29 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/05/10 17:04:50 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data
[2009/02/20 19:14:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Acronis
[2009/01/24 17:59:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe
[2008/08/24 21:05:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
[2008/08/24 23:34:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Downloaded Installations
[2008/12/21 17:12:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Google
[2009/05/10 17:12:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
[2009/05/10 13:51:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
[2009/04/11 10:20:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
[2009/04/28 23:22:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
[2009/04/11 10:18:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
[2009/03/01 20:32:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Skype
[2008/08/24 21:07:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
[2009/02/04 22:50:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Thunder Network
[2008/08/24 20:35:05 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Application Data
[2008/08/24 19:43:11 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft
[2008/08/24 22:23:25 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User.WINDOWS\Application Data
[2008/08/24 20:35:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Default User.WINDOWS\Application Data\Microsoft
[2008/08/24 19:47:43 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\F\Application Data
[2008/08/24 19:47:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\F\Application Data\Identities
[2008/08/24 19:47:35 | 00,000,000 | --SD | M] -- C:\Documents and Settings\F\Application Data\Microsoft
[2008/08/24 19:46:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data
[2008/08/24 19:43:11 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2008/08/24 20:56:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService.AUTORITE NT\Application Data
[2008/08/24 20:56:02 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService.AUTORITE NT\Application Data\Microsoft
[2008/08/24 19:46:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data
[2008/08/24 19:43:11 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/08/24 20:40:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService.AUTORITE NT\Application Data
[2008/08/25 21:06:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService.AUTORITE NT\Application Data\Microsoft
[2001/08/28 18:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/05/10 17:11:37 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT
[2009/05/10 17:12:21 | 00,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

[color=orange]========== Purity Check ==========[/color]

< End of report >

Le rapport de Smitfraudfix:

SmitFraudFix v2.416

Rapport fait à 19:31:34,42, 10/05/2009
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1 mpa.one.microsoft.com

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\sav\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\KASPER~1\\KASPER~1\\mzvkbd.dll,C:\\PROGRA~1\\KASPER~1\\KASPER~1\\mzvkbd3.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{95FD9C71-0F2C-498E-AB67-8C3A5F1673C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{95FD9C71-0F2C-498E-AB67-8C3A5F1673C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{95FD9C71-0F2C-498E-AB67-8C3A5F1673C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Et voici le rapport de Toolbar:

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : BIOS Date: 01/27/04 14:54:47 Ver: 08.00.09
USER : Administrateur ( Administrator )
BOOT : Normal boot
Antivirus : Kaspersky Anti-Virus 8.0.0.506 (Activated)
A:\ (USB) - FAT - Total:1 Mo (Free:0 Go)
C:\ (Local Disk) - NTFS - Total:19 Go (Free:6 Go)
D:\ (Local Disk) - NTFS - Total:94 Go (Free:75 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)
G:\ (USB) - FAT32 - Total:3848 Mo (Free:3 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 10/05/2009|19:35 )

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="https://www.google.fr/?gws_rd=ssl"
"Search Bar"="http://www.google.fr/toolbar/ie8/sidebar.html"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"

--------------------\\ Recherche d'autres infections

--------------------\\ ROGUES ..

C:\DOCUME~1\ADMINI~1\APPLIC~1\Privacy components

1 - "C:\ToolBar SD\TB_1.txt" - 10/05/2009|19:37 - Option : [1]

-----------\\ Fin du rapport a 19:37:20,17

Désolé pour le retard...

Le rapport de Smitfraudfix:

SmitFraudFix v2.416

Rapport fait à 21:01:24,65, 10/05/2009
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
127.0.0.1 rad.msn.com
127.0.0.1 rad.live.com

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{95FD9C71-0F2C-498E-AB67-8C3A5F1673C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{95FD9C71-0F2C-498E-AB67-8C3A5F1673C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{95FD9C71-0F2C-498E-AB67-8C3A5F1673C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Le rapport de de Malwarebytes:

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2105
Windows 5.1.2600 Service Pack 2

10/05/2009 22:10:11
mbam-log-2009-05-10 (22-10-11).txt

Type de recherche: Examen rapide
Eléments examinés: 97253
Temps écoulé: 4 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\spbho.tiebho (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{77fef28e-eb96-44ff-b511-3185dea48697} (Adware.Cinmus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b580cf65-e151-49c3-b73f-70b13fca8e86} (Adware.Cinmus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d032570a-5f63-4812-a094-87d007c23012} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4e524163-8d00-46f3-b239-1f42d48c8ed0} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a7f05ee4-0426-454f-8013-c41e3596e9e9} (Adware.Cinmus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Baidu (Adware.Cinmus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Privacy components (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\Administrateur\Application Data\Privacy components (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\keys (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\temp (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases\cg.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases\mw.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases\rd.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases\sc.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases\sm.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\dbases\sp.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\keys\cg.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\keys\rd.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\keys\sc.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\keys\sp.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\temp\settings.ini (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Privacy components\temp\spfilter (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

Bonjour,

Voici le rapport Kaspersky:

http://www.cijoint.fr/cjlink.php?file=cj200905/cijV6fxbQj.txt

Le rapport usbfix:

############################## [ UsbFix V3.018 # Scan ]

# User : Administrateur (Administrateurs) # L-C38591E7A9A34
# Update on 11/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 22:45:33 | 11/05/2009

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : Kaspersky Anti-Virus 8.0.0.506 [ Enabled | Updated ]
# FW : Pare-feu Online Armor[ Enabled ]3.5.0.14

# A:\ # Lecteur de disquettes 3 ½ pouces # 1,39 Mo (1,21 Mo free) # FAT
# C:\ # Disque fixe local # 19,53 Go (6,86 Go free) # NTFS
# D:\ # Disque fixe local # 94,95 Go (75,55 Go free) # NTFS
# E:\ # Disque CD-ROM # 197,29 Mo (0 Mo free) [KasperskyAV2009] # CDFS
# F:\ # Disque CD-ROM # 3,5 Go (0 Mo free) [DISK1] # UDF
# G:\ # Disque amovible # 3,76 Go (3,71 Go free) # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre # Startup ]

HKCU_Main: "Local Page"="C:\\windows\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Administrateur"
HKLM_logon: "AltDefaultUserName"="Administrateur"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
HKLM_Run: RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
HKLM_Run: LanguageShortcut="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
HKLM_Run: TrueImageMonitor.exe=C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
HKLM_Run: AcronisTimounterMonitor=C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
HKLM_Run: Acronis Scheduler2 Service="C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
HKLM_Run: iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
HKLM_Run: SoundMAXPnP=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
HKLM_Run: SoundMAX="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
HKLM_Run: LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe"
HKLM_Run: AVP="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
HKLM_Run: @OnlineArmor GUI="C:\Program Files\Tall Emu\Online Armor\oaui.exe"
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

################## [ Informations ]

################## [ Fichiers # Dossiers infectieux ]

Found ! C:\WINDOWS\system32\tmp.reg
Found ! C:\WINDOWS\system32\tmp.txt
Found ! E:\Setup.exe
Found ! E:\autorun.inf
Found ! F:\Setup.exe
Found ! F:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

################## [ Registre # Mountpoints2 ]

# -> Not Found !

################## [ ! Fin du rapport # UsbFix V3.018 ! ]

Le rapport usbfix:

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.
# G:\autorun.inf -> Folder created by UsbFix.

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.018 ! ]

et le lien pour l'analyse Kaspersky:

http://www.cijoint.fr/cjlink.php?file=cj200905/cijfBxxQmI.zip

Salut Lyonnais92,

Je suis tres tard ce soir...malheureusement on ne fait pas tout le temps ce que l'on veut dans cette baraque...
J'ai relancé Usbfix option 2.
Il me resort le meme raport.
A noter qu'au demarage, j'ai un message qui m'indique qu'il n'a trouvé aucune cession. Je suis obligé de cliquer sur ma cession administrateur (en fait, je suis le seul à utiliser ce PC et il n'y a qu'une cession...). Ce probleme est apparu depuis que j'ai redemaré en mode sans echec.

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.
# G:\autorun.inf -> Folder created by UsbFix.

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.018 ! ]