Win 32 magania

monstre -  
anthony5151 Messages postés 10927 Statut Contributeur sécurité -
Bonjour,
j'ai une version d'aisser de kaspersky 2009 et n'arrive pas a enlever le virus win32 magania et trojan-game thiel
merci pour votre aide
Configuration: Windows XP
Firefox 3.0.1

10 réponses

  1. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Avec autant de cracks et keygens, pas étonnant que ton ordinateur soit infecté ! En plus d'être illégaux, les cracks sont l'un des principaux vecteurs d'infections aujourd'hui... Plus d'infos ici
    Il faut les bannir complément... Si tu ne les supprimes pas, inutile de continuer la désinfection, les cracks et keygens réinfecteront ton ordinateur sans arrêt !

    C'est d'autant plus idiot qu'il existe des antivirus gratuits efficaces que tu pourrais utiliser au lieu de pirater Kaspersky (AntiVir), qu'il existe des alternatives gratuites à WinZip (exemple : 7zip)...

    Pour les supprimer :

    • Télécharge OTMoveIt3 (de OldTimer) sur ton Bureau
    • Double-clique sur OTMoveIt3.exe afin de le lancer.
    • Clique sur ce lien et copie le script qu'il contient
    • Colle le script dans le cadre « Paste Instructions for Items to be Moved » et clique sur Moveit.
    • Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES.
    • Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles
    Le nom du rapport correspond au moment de sa création : date_heure.log

    (si j'en ai oublié, supprime les autres stp)

    3
    1. monstre
       
      le lien OTMoveIt3 ne fonctionne pas 404 not found
      0
  2. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Bonsoir,

    Peux-tu utiliser ce logiciel de diagnostic stp, ça me permettra de t'aider :

    • Télécharge Random's System Information Tool (RSIT) de random/random, et enregistre le sur ton Bureau.
    • Double clique sur RSIT.exe pour lancer l'outil.
    • Clique sur ' continue ' à l'écran Disclaimer.
    • Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
    • Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés

    Tutoriel illustré pour t'aider : https://www.androidworld.fr/

    0
    1. monstre
       
      j'ai deux fichier teste es que je copier coller dans un message?
      0
    2. monstre
       
      info.txt logfile of random's system information tool 1.06 2009-06-08 00:37:51

      ======Uninstall list======

      -->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
      -->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
      -->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
      -->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
      -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
      -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
      -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
      -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
      -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
      -->C:\WINDOWS\UNRecode.exe /UNINSTALL
      -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
      2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
      32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
      ACE Mega CoDecs Pack V4.25-->C:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_DivX 132 C:\WINDOWS\INF\ACEMCP.inf
      Adobe Acrobat 3D TryOut - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-8797-100000000002}
      Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
      Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
      Adobe Reader 9.1.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
      Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
      Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
      Assist TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\Setup.exe" -l0x40c
      Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
      Atheros Client Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{71D658CF-4E0D-4DA8-AA67-8C0B6F1C01FE}\setup.exe" -l0x40c
      Atheros Wireless LAN MiniPCI card Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{05832D65-6EDB-4D32-BA78-BCD0E2B91C02}\setup.exe" -l0x40c
      ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
      ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
      Barre d'outils Outlook de Windows Live (Windows Live Toolbar)-->MsiExec.exe /X{4002F73D-EBB3-4EA1-A2FF-DBCB4529759E}
      BCL easyPDF Printer Driver 5.0-->MsiExec.exe /I{8D7574B1-49D7-41E6-9C2E-6B49A8619E64}
      BCL easyPDF SDK 5.1 with Form-->MsiExec.exe /I{40AED5E3-5011-48EB-BA55-FEA7FBCDE78C}
      Bloqueur de fenêtres pop-up (Windows Live Toolbar)-->MsiExec.exe /X{51F366F4-C2E4-429A-866A-59C885ED42FD}
      Boost Windows Version 2.1-->"C:\Program Files\Boost Windows\unins000.exe"
      CfgWiz-->MsiExec.exe /I{F9537757-10D8-451E-B0EB-C31C0A38C1B2}
      Color LaserJet 1600-->C:\Program Files\Zenographics\{C970B458-9E46-4CB4-9211-106681528A91}\setup.exe -u "HPCLJKCInstaller.dll=CLJ1600.INF"
      Commandes TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}\Setup.exe" -l0x40c UNINSTALL
      Comptabilité 100-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Maestria\Uninst.isu"
      Comptabilité-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9308A8EB-1C1B-11D4-BFC8-00C04F6180C7}\setup.exe" UNINSTALL
      Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
      Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
      CZ-Doc2Pdf COM Demo V2.0-->"C:\Program Files\CZ-Doc2Pdf COM\unins000.exe"
      Déclaration Employeur-->C:\WINDOWS\st6unst.exe -n "C:\Déclaration_Employeur\ST6UNST.LOG"
      Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{175B7C4A-CAF8-437A-B597-73E0D2D970FE}
      DivX Author 1.5-->C:\Program Files\DivX\DivX Author 1.5\DivXAuthorUninstall.exe /DIVX_AUTHOR
      DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
      DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
      DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
      DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
      DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
      EasyPHP 1.8-->"C:\Program Files\EasyPHP1-8\unins000.exe"
      Express Rip-->C:\Program Files\NCH Swift Sound\ExpressRip\uninst.exe
      Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
      Firebird 2.1.1.17910 (Win32)-->"C:\Program Files\Firebird\Firebird_2_1\unins000.exe"
      Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
      Foxit Toolbar-->"C:\Program Files\AskBarDis\unins000.exe"
      Free PDF to Word Doc Converter v1.1-->"C:\Program Files\Free PDF to Word Doc Converter\unins000.exe"
      Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
      Gestion d'énergie TOSHIBA-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\TOSHIBA\Power Saver\Uninst.isu" -c"C:\WINDOWS\system32\TPSDel.dll"
      Google Toolbar for Firefox-->MsiExec.exe /X{2CCBABCB-6427-4A55-B091-49864623C43F}
      Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
      Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
      High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
      Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
      HP Color LaserJet CP1210 Series Toolbox-->MsiExec.exe /X{1E187923-04E5-4E1F-9BF2-40E32D93A1C4}
      HP Color LaserJet CP1210 Series-->C:\Program Files\Hewlett-Packard\HP Color LaserJet CP1210 Series\UnInstall.exe
      HP Color LaserJet CP1210 Series-->MsiExec.exe /X{54360A73-B080-4A69-BFD4-53C190DD3AB0}
      HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
      HP Deskjet 6900 series (fra)-->C:\Program Files\HP\Digital Imaging\{7ADE9F27-A175-447F-A4B4-B05FA82735E1}\setup\hpzscr01.exe -datfile hpfscr09.dat
      HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
      hp LaserJet 4250/4350/4240-->C:\Program Files\Hewlett-Packard\hp LaserJet 4250 4350 4240\Installer\hpsetup.exe /x
      hp LaserJet 4250/4350/4240-->msiexec /x{E063B3E2-6641-4375-9F09-ADA9E589EB90}
      HP LaserJet Toolbox-->MsiExec.exe /X{FC656543-4E4C-46F8-86F0-F9F907ABE5FD}
      HP OCR Software 8.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
      HP Officejet Pro All-In-One Series-->C:\Program Files\HP\Digital Imaging\{868EA922-5675-4E91-BDA6-BBD0F923C5EF}\setup\hpzscr01.exe -datfile hpwscr05.dat
      HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
      HP Printer Access Tool-->MsiExec.exe /X{D8DBCF67-C44C-4768-8112-9CADBAC390E6}
      HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
      HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
      HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
      HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
      HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
      iFinger-->MsiExec.exe /I{AE0A983B-EF4C-4F93-ABB5-E0BD06F91917}
      Imprimantes Canon CAPT-->C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAP1UNIK.EXE
      InterVideo WinDVD Creator 2-->"C:\Program Files\InstallShield Installation Information\{2FCE4FC5-6930-40E7-A4F1-F862207424EF}\setup.exe" REMOVEALL
      InterVideo WinDVD for TOSHIBA-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
      J2SE Runtime Environment 5.0 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040}
      Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
      Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
      Kyodai Mahjongg 2006 v1.0-->"C:\Program Files\Kyodai Mahjongg 2006\unins000.exe"
      LiceneManager-->MsiExec.exe /I{6EB0AA0F-19B8-4947-B4D8-A92C465E0292}
      Macromedia Dreamweaver MX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B4AB829-DFD3-436D-B808-D9733D76C590}\Setup.exe" -l0x9 mmUninstall
      Macromedia Fireworks MX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{930B2432-43D4-11D5-9871-00C04F8EEB39}\Setup.exe" -l0x9 UNINSTALL
      Macromedia Flash MX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}\Setup.exe" -l0x9 UNINSTALL
      Macromedia Flash Player-->MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c}
      Manuels TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EB6332B-AF02-457C-A31C-835458C5B48B}\setup.exe" -l0x40c -removeonly
      Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
      Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
      Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
      Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
      Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
      Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
      Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
      Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
      Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
      Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
      Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
      Microsoft Office OneNote 2003-->MsiExec.exe /I{91A1040C-6000-11D3-8CFE-0150048383C9}
      Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
      Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
      Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
      Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
      Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
      Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
      Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
      Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
      Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
      Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
      Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
      Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
      Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
      Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
      Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
      Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
      Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
      Mozilla Firefox (3.0.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
      MPM-->MsiExec.exe /X{8F968232-15C6-4872-84C2-9FCDAA1AEAB6}
      MrvlUsgTracking-->MsiExec.exe /I{DDC87CB0-CB02-4454-9B05-EE09CB9D035D}
      MSI to redistribute MS VS2005 CRT libraries-->MsiExec.exe /I{A8D93648-9F7F-407D-915C-62044644C3DA}
      MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
      MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
      MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
      MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
      Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E74559C2-BB47-45AD-83DD-0D66B67E7811}
      Nero 7 Essentials-->MsiExec.exe /I{F17F7703-1E72-40C1-A0DD-E5B365661036}
      neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
      NET Installation Assistance for VB6 App (Runtime Only)-->MsiExec.exe /I{66333C41-085E-4DA1-8273-E2BCA382D766}
      Nokia Connectivity Cable Driver-->MsiExec.exe /X{6882DD11-33B8-4DEA-8305-7E765BF74BD3}
      Nokia PC Connectivity Solution-->MsiExec.exe /I{0D80391C-0A72-43BB-9BC2-143F63CC111D}
      Nokia PC Suite-->MsiExec.exe /I{531317A5-586A-4E36-87C1-CA823447B375}
      OneCare Advisor (Windows Live Toolbar)-->MsiExec.exe /X{6D7F8D4B-D1A4-402A-973E-31E90940E585}
      Outil de diagnostic PC TOSHIBA-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\TOSHIBA\PCDiag\Uninst.isu"
      Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
      Panneau de contrôle ATI-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
      PIF installer-->MsiExec.exe /I{2DC169BB-FD26-4EB1-AED8-5CDA2D08849F}
      Power MP3 WAV Converter 1.11-->"C:\Program Files\Sagasoft\Power MP3 WAV Converter\unins000.exe"
      Power Video to Audio Converter 1.03-->"C:\Program Files\Sagasoft\Power Video to Audio Converter\unins000.exe"
      Prism Video Converter-->C:\Program Files\NCH Software\Prism\uninst.exe
      RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
      REALTEK Gigabit and Fast Ethernet NIC Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\Setup.exe" -l0x40c REMOVE
      Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
      Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\Setup.exe" -l0x40c
      Samsung Master-->C:\Program Files\InstallShield Installation Information\{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}\Setup.exe -runfromtemp -l0x040c -removeonly
      Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
      Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
      Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
      Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
      Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
      Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
      Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
      Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
      Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
      Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
      Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
      Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
      Son virtuel TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B12BA86-ADAC-4BA6-B441-FFC591087252}\Setup.exe" /uninstall
      Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
      Sonic RecordNow!-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
      SoundTap Streaming Audio Recorder-->C:\Program Files\NCH Swift Sound\SoundTap\uninst.exe
      Spyware+ Component-->MsiExec.exe /I{8CF6B25D-AC71-42fb-9E2F-877DF855B605}
      Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
      Switch Sound File Converter-->C:\Program Files\NCH Swift Sound\Switch\uninst.exe
      SymCUW-->MsiExec.exe /I{4E1365FE-A878-4C3A-B055-220B8688FC09}
      Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
      TOSHIBA ConfigFree-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe" -l0x40c UNINSTALL
      TOSHIBA Hotkey Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64DD71BC-3109-4C88-9AD3-D5422644B722}\setup.exe" -l0x40c
      TOSHIBA Software Modem-->Tosmreg -U
      TOSHIBA TouchPad ON/Off Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{69BE47C2-36FE-4397-8199-85D8EAE69982}\setup.exe" -l0x40c
      TOSHIBA Utilities-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{78C68CB9-3DF5-44F3-AB9D-FA305C5EB85C}\setup.exe" -l0x40c
      Touch and Launch-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5D96E2B1-D9AC-46E0-9073-425C5F63E338}\setup.exe"
      Uniblue RegistryBooster 2009-->"C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE
      Uniblue RegistryBooster 2009-->C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}\Uniblue RegistryBooster.exe
      Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
      Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
      Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
      Utilitaire de zoom TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64212898-097F-4F3F-AECA-6D34A7EF82DF}\Setup.exe" -l0x40c
      VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
      VideoLAN VLC media player 0.8.5-->C:\Program Files\VideoLAN\VLC\uninstall.exe
      WavePad Sound Editor-->C:\Program Files\NCH Swift Sound\WavePad\uninst.exe
      Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_62A340731F8930057B44B8864F236850B0D49D65\nokbtmdm.inf
      Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
      Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
      Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
      Windows Live Mail-->MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
      Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
      Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
      Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
      Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
      Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
      Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
      Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
      WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
      Yahoo! Toolbar avec bloqueur de fenêtres pop-up-->C:\PROGRA~1\Yahoo!\Common\unyt.exe

      ======Hosts File======

      66.98.148.65 auto.search.msn.com
      66.98.148.65 auto.search.msn.es

      ======Security center information======

      AV: Kaspersky Internet Security (disabled)
      FW: Kaspersky Internet Security (disabled)

      ======System event log======

      Computer Name: ARFAOUI
      Event Code: 7011
      Message: Délai (30000 millisecondes) d'attente pour une réponse du service Spooler à une transaction.

      Record Number: 4312
      Source Name: Service Control Manager
      Time Written: 20090523221000.000000+060
      Event Type: erreur
      User:

      Computer Name: ARFAOUI
      Event Code: 11
      Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.

      Record Number: 4311
      Source Name: Cdrom
      Time Written: 20090523220910.000000+060
      Event Type: erreur
      User:

      Computer Name: ARFAOUI
      Event Code: 11
      Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.

      Record Number: 4310
      Source Name: Cdrom
      Time Written: 20090523220910.000000+060
      Event Type: erreur
      User:

      Computer Name: ARFAOUI
      Event Code: 11
      Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.

      Record Number: 4309
      Source Name: Cdrom
      Time Written: 20090523220910.000000+060
      Event Type: erreur
      User:

      Computer Name: ARFAOUI
      Event Code: 11
      Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.

      Record Number: 4308
      Source Name: Cdrom
      Time Written: 20090523220910.000000+060
      Event Type: erreur
      User:

      =====Application event log=====

      Computer Name: ARFAOUI
      Event Code: 0
      Message:
      Record Number: 1805
      Source Name: hpqcxs08
      Time Written: 20090316090151.000000+060
      Event Type: Informations
      User:

      Computer Name: ARFAOUI
      Event Code: 251
      Message:
      Record Number: 1804
      Source Name: FirebirdGuardianDefaultInstance
      Time Written: 20090316090150.000000+060
      Event Type: Informations
      User:

      Computer Name: ARFAOUI
      Event Code: 1000
      Message: Application défaillante spoolsv.exe, version 5.1.2600.5512, module défaillant CP1215LM.DLL, version 5.57.18.39, adresse de défaillance 0x00008bc3.

      Record Number: 1803
      Source Name: Application Error
      Time Written: 20090316085750.000000+060
      Event Type: erreur
      User:

      Computer Name: ARFAOUI
      Event Code: 1800
      Message: Le service Centre de sécurité Windows a démarré.

      Record Number: 1802
      Source Name: SecurityCenter
      Time Written: 20090316085735.000000+060
      Event Type: Informations
      User:

      Computer Name: ARFAOUI
      Event Code: 0
      Message:
      Record Number: 1801
      Source Name: hpqddsvc
      Time Written: 20090316085641.000000+060
      Event Type: Informations
      User:

      ======Environment variables======

      "ComSpec"=%SystemRoot%\system32\cmd.exe
      "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\ATI Technologies\ATI Control Panel
      "windir"=%SystemRoot%
      "FP_NO_HOST_CHECK"=NO
      "OS"=Windows_NT
      "PROCESSOR_ARCHITECTURE"=x86
      "PROCESSOR_LEVEL"=6
      "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
      "PROCESSOR_REVISION"=0d08
      "NUMBER_OF_PROCESSORS"=1
      "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
      "TEMP"=%SystemRoot%\TEMP
      "TMP"=%SystemRoot%\TEMP

      -----------------EOF-----------------
      0
    3. monstre
       
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by toshiba at 2009-06-08 00:37:18
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 18 GB (24%) free of 76 GB
      Total RAM: 446 MB (36% free)

      HijackThis download failed

      ======Scheduled tasks folder======

      C:\WINDOWS\tasks\1-Click Maintenance.job
      C:\WINDOWS\tasks\AppleSoftwareUpdate.job
      C:\WINDOWS\tasks\Google Software Updater.job
      C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
      C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

      ======Registry dump======

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
      Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
      Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
      AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
      Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-04-03 1372160]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
      RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-05-04 312928]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
      IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-07-29 62728]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
      DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-08-01 110652]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
      Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
      Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
      Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-19 668656]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
      Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
      {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]
      {3041d03e-fd4b-44e0-b742-2d9b88305f98} - Foxit Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      "Tvs"=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe [2005-11-30 73728]
      "THotkey"=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [2005-12-08 352256]
      "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-10-14 98394]
      "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-10-14 688218]
      "LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-19 188416]
      "DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-08-01 122940]
      "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-05 344064]
      "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2005-10-15 88203]
      ""= []
      "HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2007-11-02 36864]
      "PrnStatusMX"=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [2007-07-13 1077248]
      "TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-05-04 198160]
      "Adobe Reader Speed Launcher"=C:\Program Files\Reader\Reader_sl.exe [2009-02-27 35696]
      "AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
      "TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]
      "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
      "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-19 39408]
      "nvd32_r"=C:\Documents and Settings\toshiba\Application Data\unobi.dll [2009-05-20 35840]
      "DiskChk help"=C:\Documents and Settings\All Users\proto.dll [2009-05-31 26624]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
      []

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
      C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe []

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-11 49152]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
      C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLS"="acaptuser32.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
      C:\WINDOWS\system32\klogon.dll [2008-07-29 218376]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      "DisableTaskMgr"=0

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      "DisableTaskMgr"=0

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDrives"=0
      "NoDriveTypeAutoRun"=145
      "NoFolderOptions"=0
      "NoFind"=0
      "NoRun"=0

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDriveTypeAutoRun"=
      "NoDrives"=
      "NoDriveAutoRun"=
      "NoFolderOptions"=
      "HonorAutoRunSetting"=

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe"="C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe:*:Disabled:Fireworks MX"
      "C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe"="C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe:*:Disabled:mysqld-nt"
      "C:\Program Files\EasyPHP\apache\Apache.exe"="C:\Program Files\EasyPHP\apache\Apache.exe:*:Disabled:Apache"
      "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe"="C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Disabled:Dreamweaver MX"
      "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
      "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
      "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
      "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
      "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
      "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
      "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
      "C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
      "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
      "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
      "C:\WINDOWS\system32\winudp64.exe"="C:\WINDOWS\system32\winudp64.exe:*:Disabled:winudp64"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de9c7c41-2871-11de-afc6-0011f5ef0573}]
      shell\AutoRun\command - RECYCLER\help.exe
      shell\opEN\command - RECYCLER\help.exe


      ======File associations======

      .js - open - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"

      ======List of files/folders created in the last 1 months======

      2009-06-08 00:37:23 ----D---- C:\Program Files\trend micro
      2009-06-08 00:37:18 ----D---- C:\rsit
      2009-05-31 17:58:05 ----A---- C:\WINDOWS\pxinstall_log.txt
      2009-05-31 17:41:42 ----A---- C:\ibvdq.exe
      2009-05-31 17:40:28 ----A---- C:\orves.exe
      2009-05-31 17:40:02 ----A---- C:\karg.exe
      2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\win.txt
      2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\2.txt
      2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\1.txt
      2009-05-31 02:17:17 ----D---- C:\Program Files\Hotspot Shield
      2009-05-30 20:51:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Boost Windows
      2009-05-30 20:51:07 ----D---- C:\Program Files\Boost Windows
      2009-05-30 15:04:09 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Software
      2009-05-29 03:06:39 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
      2009-05-29 03:06:31 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
      2009-05-29 03:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
      2009-05-29 03:05:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
      2009-05-29 03:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
      2009-05-29 03:04:00 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
      2009-05-29 03:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
      2009-05-29 03:02:30 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
      2009-05-29 03:02:15 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
      2009-05-27 23:52:25 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
      2009-05-26 06:30:40 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
      2009-05-24 19:28:55 ----D---- C:\Program Files\Kaspersky Lab
      2009-05-24 11:51:54 ----D---- C:\Program Files\KAZAA
      2009-05-24 11:51:54 ----D---- C:\My Downloads
      2009-05-23 11:00:30 ----D---- C:\Program Files\Esl
      2009-05-23 10:59:45 ----D---- C:\Program Files\Resource
      2009-05-23 10:59:44 ----D---- C:\Program Files\Setup Files
      2009-05-23 10:59:44 ----D---- C:\Program Files\Reader
      2009-05-22 21:29:11 ----A---- C:\Documents and Settings\toshiba\Application Data\unobi.dll
      2009-05-20 23:38:58 ----D---- C:\b0bbdf5af1c95e7967
      2009-05-20 08:59:24 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
      2009-05-19 21:11:15 ----D---- C:\Program Files\Apple Software Update
      2009-05-19 21:11:15 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
      2009-05-19 14:31:09 ----D---- C:\Program Files\WinZip
      2009-05-19 13:24:34 ----D---- C:\98f07633941d0b5a64
      2009-05-19 12:47:04 ----HDC---- C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
      2009-05-19 12:06:56 ----D---- C:\cc5dd750a86c1436d5e77e9d2e
      2009-05-19 12:05:04 ----RHD---- C:\AHCache
      2009-05-19 00:16:54 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
      2009-05-16 22:57:00 ----D---- C:\Program Files\NCH Swift Sound
      2009-05-16 22:45:52 ----D---- C:\Program Files\Sagasoft
      2009-05-16 01:33:36 ----D---- C:\Documents and Settings\toshiba\Application Data\Uniblue
      2009-05-16 01:33:11 ----D---- C:\Program Files\Uniblue
      2009-05-16 01:20:21 ----HDC---- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
      2009-05-14 14:56:41 ----D---- C:\Program Files\AskBarDis
      2009-05-14 14:56:33 ----D---- C:\Program Files\Foxit Software
      2009-05-14 14:56:33 ----D---- C:\Documents and Settings\toshiba\Application Data\Foxit
      2009-05-11 15:09:15 ----D---- C:\Program Files\Fichiers communs\Windows Live
      2009-05-09 00:12:51 ----D---- C:\Program Files\DAMN NFO Viewer

      ======List of files/folders modified in the last 1 months======

      2009-06-08 00:37:23 ----D---- C:\Program Files
      2009-06-08 00:37:12 ----D---- C:\WINDOWS\Prefetch
      2009-06-08 00:29:29 ----D---- C:\WINDOWS\system32
      2009-06-07 23:39:55 ----D---- C:\WINDOWS\temp
      2009-06-07 23:27:21 ----D---- C:\Program Files\Mozilla Firefox
      2009-06-07 23:03:30 ----D---- C:\WINDOWS\system32\drivers
      2009-06-07 22:48:27 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
      2009-06-07 22:47:48 ----D---- C:\WINDOWS\system32\ias
      2009-06-07 22:46:18 ----SD---- C:\WINDOWS\Tasks
      2009-06-07 11:42:06 ----D---- C:\WINDOWS
      2009-06-07 11:39:15 ----HD---- C:\Config.Msi
      2009-06-07 11:38:34 ----A---- C:\WINDOWS\SchedLgU.Txt
      2009-06-07 11:12:04 ----SHD---- C:\WINDOWS\Installer
      2009-06-07 11:11:18 ----D---- C:\WINDOWS\system32\CatRoot
      2009-06-07 11:09:49 ----HD---- C:\WINDOWS\inf
      2009-06-07 00:56:38 ----A---- C:\WINDOWS\NeroDigital.ini
      2009-06-07 00:55:50 ----D---- C:\WINDOWS\system32\CatRoot2
      2009-06-07 00:15:53 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
      2009-06-04 20:21:14 ----D---- C:\Documents and Settings\toshiba\Application Data\uTorrent
      2009-06-01 02:33:38 ----A---- C:\WINDOWS\system.ini
      2009-05-31 02:12:30 ----D---- C:\Documents and Settings
      2009-05-31 00:31:23 ----A---- C:\WINDOWS\wininit.ini
      2009-05-30 20:59:56 ----D---- C:\Program Files\Maestria
      2009-05-30 20:59:56 ----D---- C:\Program Files\ActDrv100
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\NtmsData
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\config
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\repair
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\Help
      2009-05-30 00:48:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
      2009-05-30 00:45:42 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Swift Sound
      2009-05-29 03:35:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
      2009-05-29 03:29:42 ----D---- C:\WINDOWS\system32\wbem
      2009-05-29 03:29:41 ----D---- C:\WINDOWS\AppPatch
      2009-05-29 03:06:42 ----RSHDC---- C:\WINDOWS\system32\dllcache
      2009-05-29 03:06:23 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
      2009-05-29 03:05:26 ----HD---- C:\WINDOWS\$hf_mig$
      2009-05-29 03:05:01 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
      2009-05-29 03:04:38 ----RSD---- C:\WINDOWS\assembly
      2009-05-29 03:02:25 ----D---- C:\Program Files\Windows Media Player
      2009-05-23 11:00:25 ----D---- C:\Program Files\Fichiers communs\Adobe
      2009-05-22 23:19:56 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
      2009-05-22 21:29:25 ----SHD---- C:\RECYCLER
      2009-05-20 23:25:37 ----D---- C:\Program Files\Google
      2009-05-20 23:09:35 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
      2009-05-20 22:42:53 ----D---- C:\WINDOWS\Registration
      2009-05-20 20:02:57 ----D---- C:\WINDOWS\SoftwareDistribution
      2009-05-20 11:52:31 ----A---- C:\WINDOWS\powervideotoaudio.ini
      2009-05-20 11:50:09 ----A---- C:\WINDOWS\m3jpeg.ini
      2009-05-20 09:09:58 ----D---- C:\WINDOWS\Microsoft.NET
      2009-05-19 22:52:40 ----HD---- C:\Program Files\InstallShield Installation Information
      2009-05-19 22:52:36 ----D---- C:\Documents and Settings\toshiba\Application Data\COWON
      2009-05-19 22:52:27 ----D---- C:\Program Files\Fichiers communs
      2009-05-19 21:09:42 ----D---- C:\Documents and Settings\toshiba\Application Data\Nokia Multimedia Player
      2009-05-19 14:32:35 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
      2009-05-19 13:21:36 ----D---- C:\WINDOWS\WinSxS
      2009-05-19 00:33:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Google
      2009-05-17 22:18:26 ----D---- C:\Program Files\Adobe
      2009-05-16 23:56:47 ----D---- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
      2009-05-16 23:09:17 ----D---- C:\Program Files\NCH Software
      2009-05-16 22:47:42 ----A---- C:\WINDOWS\powermp3wavconverter.ini
      2009-05-12 23:55:52 ----D---- C:\WINDOWS\network diagnostic
      2009-05-12 14:04:52 ----D---- C:\Program Files\Free Download Manager
      2009-05-12 13:56:40 ----A---- C:\WINDOWS\CD_SearchHistory.INI
      2009-05-12 00:45:38 ----D---- C:\WINDOWS\system32\Lang
      2009-05-11 15:09:13 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
      2009-05-10 02:30:42 ----D---- C:\Downloads
      2009-05-09 19:32:57 ----D---- C:\Program Files\eMule

      ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-07-07 5628]
      R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-07-07 22684]
      R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
      R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-05-24 213520]
      R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
      R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-05-30 17801]
      R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-08-01 25628]
      R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-08-01 2496]
      R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-08-01 86524]
      R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-08-01 14684]
      R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-08-01 6364]
      R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-08-01 87004]
      R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-08-01 92700]
      R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-07-07 40544]
      R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
      R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2005-11-15 1122656]
      R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-09-12 468736]
      R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
      R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
      R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
      R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
      R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-11-11 4064256]
      R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
      R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
      R3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS\system32\drivers\nchssvad.sys [2009-05-16 27136]
      R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
      R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
      R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
      R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-10-14 185728]
      R3 TVALD;Toshiba Mobile PC Service; C:\WINDOWS\system32\DRIVERS\NBSMI.sys [2005-10-20 6144]
      R3 Tvs;TOSHIBA Virtual Sound with SRS technologies; C:\WINDOWS\system32\DRIVERS\Tvs.sys [2005-11-30 43392]
      R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
      R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
      R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
      S1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys []
      S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
      S2 RapidPort;RapidPort; \??\C:\WINDOWS\system32\Drivers\CAPLPTN.SYS []
      S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\tdi.sys []
      S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
      S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
      S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-07-05 49920]
      S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-07-05 16496]
      S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-07-05 21568]
      S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
      S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
      S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
      S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
      S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
      S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
      S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
      S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
      S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
      S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
      S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
      S3 zmNTZip;zmNTZip; \??\C:\Program Files\ZipMagic\zmNTZip.sys []
      S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

      ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R2 ACS;Service de configuration Atheros; C:\WINDOWS\system32\acs.exe [2005-07-07 36864]
      R2 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-12-03 69632]
      R2 astcc;AST Service; C:\WINDOWS\system32\AstSrv.exe [2007-06-20 53248]
      R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-18 40960]
      R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [2008-06-13 81920]
      R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
      R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
      R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
      R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
      R2 TAPPSRV;TOSHIBA Application Service; C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2005-08-10 35328]
      R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2008-06-13 2723840]
      R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
      S2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]
      S2 gupdate1c9d80fecd7376a;Service Google Update (gupdate1c9d80fecd7376a); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-19 133104]
      S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-19 183280]
      S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
      S3 bepldr;BCL easyPDF SDK 5 Loader; C:\Program Files\Fichiers communs\BCL Technologies\easyPDF 5\bepldr.exe [2008-02-07 151552]
      S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
      S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
      S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
      S3 ServiceLayer;ServiceLayer; C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
      S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
      S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
      S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe []
      S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

      -----------------EOF-----------------
      0
  3. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Re,

    Il y a une barre d'outil néfaste sur ton ordinateur (AskBar)... Pour éviter ce genre d'infection, il faut tout lire attentivement lorsque tu installes un programme gratuit, et décocher tous les programmes additionnels qui sont proposés, en particulier les barres d'outils !

    • Télécharge Toolbar-S&D (de la team IDN) sur ton Bureau.
    • Lance l'installation du programme en exécutant le fichier téléchargé.
    • Double-clique maintenant sur le raccourci de Toolbar-S&D.
    • Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
    • Choisis directement l'option 2 (Suppression). Patiente jusqu'à la fin de la recherche.
    • Poste le rapport généré. (C:\TB.txt)

    Il semble aussi y avoir une infection qui se transmet par disque amovible (clé USB, disque dur externe, lecteur mp3, appareils photos numériques, téléphones portables...) : lorsque tu dois en brancher un sur ton ordinateur, il faut le vacciner avec USBFix avant de l'ouvrir.

    • Télécharge UsbFix (de Chiquitine29 et C_XX) sur ton Bureau
    • Lance l'installation avec les paramètres par défaut
    • Branche tes sources de données externes à ton PC (clé USB, disque dur externe, lecteur mp3 etc...) sans les ouvrir
    • Double clique sur le raccourci UsbFix sur ton Bureau
    • Au menu principal, choisis l'option 1 (recherche)
    • Un rapport USBFix.txt apparaitra à la fin, poste le dans ta prochaine réponse stp

    0
    1. monstre
       
      voila le rapport tb.txt


      -----------\\ ToolBar S&D 1.2.8 XP/Vista

      Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
      X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor 1.50GHz )
      BIOS : BIOS Version 1.50
      USER : toshiba ( Administrator )
      BOOT : Normal boot
      Antivirus : Kaspersky Internet Security 8.0.0.454 (Not Activated)
      Firewall : Kaspersky Internet Security 8.0.0.454 (Not Activated)
      C:\ (Local Disk) - NTFS - Total:74 Go (Free:17 Go)
      D:\ (CD or DVD)

      "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
      Option : [2] ( 09/06/2009| 2:04 )

      -----------\\ SUPPRESSION

      Supprime! - C:\Program Files\AskBarDis\bar
      Supprime! - C:\Program Files\AskBarDis\PopSwatter
      Supprime! - C:\Program Files\AskBarDis\unins000.dat
      Supprime! - C:\Program Files\AskBarDis\unins000.exe
      Supprime! - C:\Program Files\AskTBar\bar
      Supprime! - C:\Program Files\AskTBar\PopSwatr
      Supprime! - C:\Program Files\AskBarDis
      Supprime! - C:\Program Files\AskTBar
      Supprime! - C:\Program Files\KaZaA

      -----------\\ Recherche de Fichiers / Dossiers ...


      -----------\\ Extensions

      (toshiba) - {563e4790-7e70-11da-a72b-0800200c9a66} => clearcache
      (toshiba) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
      (toshiba) - {84b24861-62f6-364b-eba5-2e5e2061d7e6} => mediaplayerconnectivity
      (toshiba) - {991A772A-BA13-4c1d-A9EF-F897F31DEC7D} => megaupload
      (toshiba) - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} => adblockplus
      (toshiba) - {DDC359D1-844A-42a7-9AA1-88A850A938A8} => chrome


      -----------\\ [..\Internet Explorer\Main]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Start Page"="https://www.google.com/?gws_rd=ssl"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
      "Default_Search_URL"="http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q="
      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Start Page"="https://www.msn.com/fr-fr/"


      --------------------\\ Recherche d'autres infections

      --------------------\\ ROGUES ..

      C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2006
      C:\DOCUME~1\MONDHE~1\APPLIC~1\WinAntiVirus Pro 2006
      C:\DOCUME~1\toshiba\APPLIC~1\WinAntiVirus Pro 2006

      --------------------\\ Cracks & Keygens ..

      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.1.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen (Clean) (19 may) by THX.rar.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen Free.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 KeyGen.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky Internet Security 7.0 Newest Updated For Life Crack Serial 100%.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\NCH WavePad Sound Editor v3.12 + keygen.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Total Video Converter 3.22 (Serial+Crack) & Total Video Converter 3.21 Portable.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 Keygen {Tested n Working}.rar.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 pro + keygen.zip.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 Keygen.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen (Xp&Vista Compatible).torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen WANTED FINAL.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 12 + keygen.torrent
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip.11.inc.keygen-SshuggzZ.torrent
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Anti_Virus_Keygen-Fenopy.com.torrent
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com(2).torrent
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com.torrent
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Clean_19_may_by_THX-Fenopy.com.torrent
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Free_-Fenopy.com.torrent
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\WavePad_3_12_keygen-Fenopy.com.torrent
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\winzip111_setup.exe
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\Winzip11_Keygen.exe
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\Installation Instructions.nfo
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\keygen.exe
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\winzip120.exe
      C:\DOCUME~1\toshiba\Local Settings\Temp\wzaa58\keygen.exe
      C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen
      C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen\AT4RE.nfo
      C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen\Keygen.exe
      C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen\wpsetup.exe
      C:\DOCUME~1\toshiba\Recent\NCH WavePad Sound Editor v3.12 + keygen.lnk
      C:\DOCUME~1\toshiba\Recent\WavePad_3_12_keygen-Fenopy.com.torrent.lnk



      1 - "C:\ToolBar SD\TB_1.txt" - 09/06/2009| 2:08 - Option : [2]

      -----------\\ Fin du rapport a 2:08:22.46
      0
      1. monstre > monstre
         
        voila le rapport USBfix

        ############################## [ UsbFix V3.029 | Scan ]

        # User : toshiba () # ARFAOUI
        # Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
        # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
        # Start at: 02:23:29 | 09/06/2009

        # Intel(R) Celeron(R) M processor 1.50GHz
        # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
        # Internet Explorer 6.0.2900.5512
        # Windows Firewall Status : Disabled
        # AV : Kaspersky Internet Security 8.0.0.454 [ (!) Disabled | Updated ]
        # FW : Kaspersky Internet Security[ (!) Disabled ]8.0.0.454

        # C:\ # Disque fixe local # 74.53 Go (17.89 Go free) # NTFS
        # D:\ # Disque CD-ROM
        # E:\ # Disque amovible # 994.86 Mo (580.08 Mo free) # FAT

        ############################## [ Processus actifs ]

        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\acs.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
        C:\WINDOWS\system32\AstSrv.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
        C:\Program Files\Google\Update\GoogleUpdate.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
        C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
        C:\WINDOWS\System32\alg.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\WINDOWS\explorer.exe
        C:\WINDOWS\system32\drivers\svchost.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\WINDOWS\system32\wscntfy.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\system32\wbem\wmiprvse.exe

        ################## [ Registre Startup ]

        HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
        HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
        HKCU_Main: "Start Page"="https://www.google.com/?gws_rd=ssl"
        HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
        HKLM_logon: "DefaultUserName"="toshiba"
        HKLM_logon: "AltDefaultUserName"="toshiba"
        HKLM_logon: "LegalNoticeCaption"=""
        HKLM_logon: "LegalNoticeText"=""
        HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        HKLM_Run: THotkey=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        HKLM_Run: SynTPLpr=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        HKLM_Run: SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        HKLM_Run: LtMoh=C:\Program Files\ltmoh\Ltmoh.exe
        HKLM_Run: DLA=C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
        HKLM_Run: AGRSMMSG=AGRSMMSG.exe
        HKLM_Run: HPUsageTracking="C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT"
        HKLM_Run: PrnStatusMX=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
        HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Reader\Reader_sl.exe"
        HKLM_Run: AVP="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
        HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
        HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
        HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
        HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        HKCU_Run: nvd32_r=rundll32.exe "C:\Documents and Settings\toshiba\Application Data\unobi.dll" s
        HKCU_Run: DiskChk help=rundll32.exe "C:\Documents and Settings\All Users\proto.dll" run

        ################## [ Fichiers # Dossiers infectieux ]

        Found ! C:\DOCUME~1\toshiba\LOCALS~1\Temp\wzaa58\keygen.exe
        E:\autorun.inf # -> fichier appelé : "E:\RECYCLER\help.exe" ( absent ! )
        Found ! E:\lad.bat
        Found ! E:\Setup.exe
        Found ! E:\autorun.inf
        Found ! "E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213"

        ################## [ Registre # Clés Run infectieuses ]

        Found ! HKLM\software\microsoft\windows nt\currentversion\winlogon "Taskman"

        ################## [ Registre # Mountpoints2 ]


        ################## [ ! Fin du rapport # UsbFix V3.029 ! ]
        0
  4. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    0
    1. monstre
       
      voila le rapport .log
      ========== PROCESSES ==========
      Process explorer.exe killed successfully.
      ========== FILES ==========
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.1.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen (Clean) (19 may) by THX.rar.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen Free.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 KeyGen.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky Internet Security 7.0 Newest Updated For Life Crack Serial 100%.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\NCH WavePad Sound Editor v3.12 + keygen.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Total Video Converter 3.22 (Serial+Crack) & Total Video Converter 3.21 Portable.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 Keygen {Tested n Working}.rar.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 pro + keygen.zip.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 Keygen.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen (Xp&Vista Compatible).torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen WANTED FINAL.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 12 + keygen.torrent moved successfully.
      C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip.11.inc.keygen-SshuggzZ.torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Anti_Virus_Keygen-Fenopy.com.torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com(2).torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com.torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Clean_19_may_by_THX-Fenopy.com.torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Free_-Fenopy.com.torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\WavePad_3_12_keygen-Fenopy.com.torrent moved successfully.
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible) moved successfully.
      C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen moved successfully.
      File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\winzip111_setup.exe not found.
      File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\Winzip11_Keygen.exe not found.
      File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\Installation Instructions.nfo not found.
      File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\keygen.exe not found.
      File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\winzip120.exe not found.
      C:\DOCUME~1\toshiba\Local Settings\Temp\wzaa58\keygen.exe moved successfully.
      C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen moved successfully.
      C:\DOCUME~1\toshiba\Recent\NCH WavePad Sound Editor v3.12 + keygen.lnk moved successfully.
      C:\DOCUME~1\toshiba\Recent\WavePad_3_12_keygen-Fenopy.com.torrent.lnk moved successfully.
      ========== COMMANDS ==========
      File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SLSXEF8X\38761747[1].htm scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Cookies\index.dat scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\etilqs_MJwjJRNKLvgScQfzyx0F scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\~DF27DD.tmp scheduled to be deleted on reboot.
      User's Temp folder emptied.
      User's Internet Explorer cache folder emptied.
      User's Temporary Internet Files folder emptied.
      File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
      Local Service Temp folder emptied.
      Local Service Temporary Internet Files folder emptied.
      Network Service Temp folder emptied.
      File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
      Network Service Temporary Internet Files folder emptied.
      Windows Temp folder emptied.
      Java cache emptied.
      File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
      FireFox cache emptied.
      Temp folders emptied.
      Explorer started successfully

      OTM by OldTimer - Version 2.1.0.0 log created on 06092009_030915

      Files moved on Reboot...
      C:\DOCUME~1\toshiba\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SLSXEF8X\38761747[1].htm moved successfully.
      File C:\DOCUME~1\toshiba\LOCALS~1\Temp\etilqs_MJwjJRNKLvgScQfzyx0F not found!
      C:\DOCUME~1\toshiba\LOCALS~1\Temp\~DF27DD.tmp moved successfully.
      C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_001_ moved successfully.
      C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_002_ moved successfully.
      C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_003_ moved successfully.
      C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_MAP_ moved successfully.
      C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\urlclassifier3.sqlite moved successfully.

      Registry entries deleted on Reboot...
      0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Ok, on continue :

    • Branche tous tes disques amovibles (clés USB, lecteurs mp3, disques durs externes, iPod...) et clique sur OK.
    • Relance USBFix
    • Choisis cette fois l'option 2 (Suppression)
    • Ton Bureau va disparaitre, puis l'ordinateur va redémarrer --> c'est normal
    • Laisse travailler l'outil jusqu'au bout
    • A la fin, le rapport USBFix.txt va s'afficher --> poste le dans ta prochaine réponse stp

    Ensuite, fais ce scan généraliste :

    • Télécharge et installe Malwarebytes' Anti-Malware
    • A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
    • Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
    • Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
    • Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
    • A la fin du scan, clique sur Afficher les résultats
    • Coche tous les éléments détectés puis clique sur Supprimer la sélection
    • Enregistre le rapport
    • S'il t'est demandé de redémarrer, clique sur Yes

    • Poste dans ta prochaine réponse le rapport apparaissant après la suppression stp

    0
    1. monstre
       
      voila le rapport USBFix.txt

      ############################## [ UsbFix V3.029 | Cleaning ]

      # User : toshiba () # ARFAOUI
      # Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
      # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
      # Start at: 13:12:06 | 09/06/2009

      # Intel(R) Celeron(R) M processor 1.50GHz
      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
      # Internet Explorer 6.0.2900.5512
      # Windows Firewall Status : Enabled
      # AV : Kaspersky Internet Security 8.0.0.454 [ (!) Disabled | Updated ]
      # FW : Kaspersky Internet Security[ (!) Disabled ]8.0.0.454

      # C:\ # Disque fixe local # 74.53 Go (17.89 Go free) # NTFS
      # D:\ # Disque CD-ROM
      # E:\ # Disque amovible # 994.86 Mo (580.06 Mo free) # FAT

      ############################## [ Processus actifs ]

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\logonui.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\acs.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      C:\WINDOWS\system32\AstSrv.exe
      C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
      C:\Program Files\Google\Update\GoogleUpdate.exe
      C:\Program Files\Google\Update\GoogleUpdate.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Google\Update\GoogleUpdate.exe
      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      C:\Program Files\Google\Update\GoogleUpdate.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      ################## [ Fichiers # Dossiers infectieux ]

      E:\autorun.inf # -> fichier appelé : "E:\RECYCLER\help.exe" ( absent ! )
      Deleted ! E:\Setup.exe
      Deleted ! E:\autorun.inf

      ################## [ Registre # Clés Run infectieuses ]

      Deleted ! HKLM\software\microsoft\windows nt\currentversion\winlogon "Taskman"

      ################## [ Registre # Mountpoints2 ]


      ################## [ Listing des fichiers présent ]

      [06/01/2009 00:58|--a------|40] - C:\Auth.prof
      [24/09/2006 00:47|--ahs----|7] - C:\AUTOEXEC.BAT
      [19/09/2008 05:57|--ahs----|217] - C:\boot.ini
      [05/08/2004 12:00|-rahs----|4952] - C:\Bootfont.bin
      [02/10/2008 11:01|--a------|23732] - C:\ComboFix.txt
      [09/12/2005 07:03|--a------|0] - C:\CONFIG.SYS
      [17/09/2007 09:03|---hs----|72] - C:\desktop.ini
      [07/02/2009 13:20|--a------|12103] - C:\EyeCandyLog.txt
      [?|?|?] - C:\hiberfil.sys
      [31/05/2009 17:44|--a------|1420] - C:\ibvdq.exe
      [09/12/2005 07:03|-rahs----|0] - C:\IO.SYS
      [31/05/2009 17:40|--a------|0] - C:\karg.exe
      [08/07/2008 09:58|--a------|8] - C:\msconfig.bat
      [09/12/2005 07:03|-rahs----|0] - C:\MSDOS.SYS
      [05/08/2004 12:00|-rahs----|47564] - C:\NTDETECT.COM
      [17/09/2008 23:29|-rahs----|252240] - C:\ntldr
      [31/05/2009 17:40|--a------|1240] - C:\orves.exe
      [?|?|?] - C:\pagefile.sys
      [09/06/2009 02:08|--a------|6236] - C:\TB.txt
      [23/12/2008 16:57|--a------|594] - C:\updatedatfix.log
      [09/06/2009 13:15|--a------|3442] - C:\UsbFix.txt
      [22/07/2008 12:35|--a------|615936] - C:\WHT Certificate.XLS
      [09/06/2009 03:12|--a------|1774] - E:\BOOTEX.LOG
      [01/01/2003 22:18|--a------|11311] - E:\Password Administrateur.txt
      [28/09/2005 05:10|--a------|4349551] - E:\??????? ??????? ?? ?????? ????????? ???????.pdf

      ################## [ Vaccination ]

      # C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
      # E:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

      ################## [ ! Fin du rapport # UsbFix V3.029 ! ]
      0
  7. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Parfait, j'attends le rapport de MalwareBytes maintenant :)

    0
    1. monstre
       
      voila le rapport anti-malware
      Malwarebytes' Anti-Malware 1.37
      Version de la base de données: 2252
      Windows 5.1.2600 Service Pack 3

      09/06/2009 15:15:47
      mbam-log-2009-06-09 (15-15-46).txt

      Type de recherche: Examen complet (C:\|)
      Eléments examinés: 246283
      Temps écoulé: 1 hour(s), 37 minute(s), 52 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 4
      Valeur(s) du Registre infectée(s): 4
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 5
      Fichier(s) infecté(s): 38

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CLASSES_ROOT\CLSID\{035c1836-0d78-dabc-f4a7-d5d0517ee1f9} (Rogue.MalwareWiped) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\AppID\MalwareWipe.EXE (Rogue.MalwareWiped) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvd32_r (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diskchk help (Trojan.Downloader) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\FirstInstallFlag (Malware.Trace) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\tuneup html client embedded web browser from: http://bsalsa.com/ (Trojan.Banker) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      c:\documents and settings\all users\application data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\mondher arfaoui\application data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\application data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      c:\QooBox\quarantine\C\WINDOWS\emde.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074571.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074586.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074671.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074693.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074706.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0075706.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP191\A0075715.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP191\A0076717.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077749.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077775.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077833.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077846.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0077879.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0077867.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0077907.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0078002.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP195\A0080263.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\WINDOWS\system32\drivers\oc-cd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\documents and settings\all users\application data\winantivirus pro 2006\AVScheduler.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs\Activate.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs\wa6Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\application data\winantivirus pro 2006\DownloadWA6P.url (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs\Activate.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs\wa6Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
      C:\Documents and Settings\toshiba\Application Data\unobi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\Favoris\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.
      c:\documents and settings\all users\menu démarrer\Online Security Guide.url (Rogue.Link) -> Quarantined and deleted successfully.
      c:\documents and settings\all users\menu démarrer\Security Troubleshooting.url (Rogue.Link) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
      c:\documents and settings\toshiba\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
      C:\WINDOWS\SHELLNEW\RakyatKelaparan.exe (Worm.Brontok) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\cmd-brontok.exe (Worm.Brontok) -> Quarantined and deleted successfully.
      C:\Documents and Settings\All Users\proto.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
      0
  8. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Télécharge et installe hijackthis.
    Il va se lancer automatiquement : referme le.

    Puis poste un nouveau rapport RSIT stp

    0
    1. monstre
       
      voila le rapport RSIT
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by toshiba at 2009-06-09 22:31:48
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 18 GB (24%) free of 76 GB
      Total RAM: 446 MB (5% free)


      ======Scheduled tasks folder======

      C:\WINDOWS\tasks\1-Click Maintenance.job
      C:\WINDOWS\tasks\AppleSoftwareUpdate.job
      C:\WINDOWS\tasks\Google Software Updater.job
      C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
      C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

      ======Registry dump======

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
      Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
      Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
      Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-04-03 1372160]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
      RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-05-04 312928]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
      IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-07-29 62728]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
      DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-08-01 110652]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
      Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
      Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
      Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-19 668656]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
      Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
      {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      "Tvs"=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe [2005-11-30 73728]
      "THotkey"=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [2005-12-08 352256]
      "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-10-14 98394]
      "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-10-14 688218]
      "LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-19 188416]
      "DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-08-01 122940]
      "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-05 344064]
      "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2005-10-15 88203]
      ""= []
      "HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2007-11-02 36864]
      "PrnStatusMX"=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [2007-07-13 1077248]
      "TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-05-04 198160]
      "Adobe Reader Speed Launcher"=C:\Program Files\Reader\Reader_sl.exe [2009-02-27 35696]
      "AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
      "TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]
      "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
      "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-19 39408]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
      []

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
      C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe []

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-11 49152]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
      C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLS"="acaptuser32.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
      C:\WINDOWS\system32\klogon.dll [2008-07-29 218376]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDrives"=0
      "NoDriveTypeAutoRun"=145
      "NoFolderOptions"=0
      "NoFind"=0
      "NoRun"=0
      "NoDriveAutoRun"=FFFFFFFF
      "HonorAutoRunSetting"=1

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDriveTypeAutoRun"=
      "NoDrives"=
      "NoDriveAutoRun"=
      "NoFolderOptions"=
      "HonorAutoRunSetting"=

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe"="C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe:*:Disabled:Fireworks MX"
      "C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe"="C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe:*:Disabled:mysqld-nt"
      "C:\Program Files\EasyPHP\apache\Apache.exe"="C:\Program Files\EasyPHP\apache\Apache.exe:*:Disabled:Apache"
      "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe"="C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Disabled:Dreamweaver MX"
      "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
      "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
      "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
      "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
      "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
      "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
      "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
      "C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
      "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
      "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
      "C:\WINDOWS\system32\winudp64.exe"="C:\WINDOWS\system32\winudp64.exe:*:Disabled:winudp64"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

      ======File associations======

      .js - open - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"

      ======List of files/folders created in the last 1 months======

      2009-06-09 13:30:13 ----D---- C:\Documents and Settings\toshiba\Application Data\Malwarebytes
      2009-06-09 13:29:56 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
      2009-06-09 13:29:55 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
      2009-06-09 13:15:37 ----RASHD---- C:\autorun.inf
      2009-06-09 13:11:52 ----A---- C:\UsbFix.txt
      2009-06-09 03:09:15 ----D---- C:\_OTM
      2009-06-09 02:19:40 ----D---- C:\UsbFix
      2009-06-09 02:04:08 ----A---- C:\TB.txt
      2009-06-09 02:02:37 ----D---- C:\ToolBar SD
      2009-06-08 00:37:23 ----D---- C:\Program Files\trend micro
      2009-06-08 00:37:18 ----D---- C:\rsit
      2009-05-31 17:58:05 ----A---- C:\WINDOWS\pxinstall_log.txt
      2009-05-31 17:41:42 ----A---- C:\ibvdq.exe
      2009-05-31 17:40:28 ----A---- C:\orves.exe
      2009-05-31 17:40:02 ----A---- C:\karg.exe
      2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\win.txt
      2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\2.txt
      2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\1.txt
      2009-05-31 02:17:17 ----D---- C:\Program Files\Hotspot Shield
      2009-05-30 20:51:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Boost Windows
      2009-05-30 20:51:07 ----D---- C:\Program Files\Boost Windows
      2009-05-30 15:04:09 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Software
      2009-05-29 03:06:39 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
      2009-05-29 03:06:31 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
      2009-05-29 03:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
      2009-05-29 03:05:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
      2009-05-29 03:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
      2009-05-29 03:04:00 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
      2009-05-29 03:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
      2009-05-29 03:02:30 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
      2009-05-29 03:02:15 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
      2009-05-27 23:52:25 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
      2009-05-26 06:30:40 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
      2009-05-24 19:28:55 ----D---- C:\Program Files\Kaspersky Lab
      2009-05-24 11:51:54 ----D---- C:\My Downloads
      2009-05-23 11:00:30 ----D---- C:\Program Files\Esl
      2009-05-23 10:59:45 ----D---- C:\Program Files\Resource
      2009-05-23 10:59:44 ----D---- C:\Program Files\Setup Files
      2009-05-23 10:59:44 ----D---- C:\Program Files\Reader
      2009-05-20 23:38:58 ----D---- C:\b0bbdf5af1c95e7967
      2009-05-20 08:59:24 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
      2009-05-19 21:11:15 ----D---- C:\Program Files\Apple Software Update
      2009-05-19 21:11:15 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
      2009-05-19 14:31:09 ----D---- C:\Program Files\WinZip
      2009-05-19 13:24:34 ----D---- C:\98f07633941d0b5a64
      2009-05-19 12:47:04 ----HDC---- C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
      2009-05-19 12:06:56 ----D---- C:\cc5dd750a86c1436d5e77e9d2e
      2009-05-19 12:05:04 ----RHD---- C:\AHCache
      2009-05-19 00:16:54 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
      2009-05-16 22:57:00 ----D---- C:\Program Files\NCH Swift Sound
      2009-05-16 22:45:52 ----D---- C:\Program Files\Sagasoft
      2009-05-16 01:33:36 ----D---- C:\Documents and Settings\toshiba\Application Data\Uniblue
      2009-05-16 01:33:11 ----D---- C:\Program Files\Uniblue
      2009-05-16 01:20:21 ----HDC---- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
      2009-05-14 14:56:33 ----D---- C:\Program Files\Foxit Software
      2009-05-14 14:56:33 ----D---- C:\Documents and Settings\toshiba\Application Data\Foxit
      2009-05-11 15:09:15 ----D---- C:\Program Files\Fichiers communs\Windows Live

      ======List of files/folders modified in the last 1 months======

      2009-06-09 22:31:56 ----D---- C:\WINDOWS\Prefetch
      2009-06-09 20:27:28 ----D---- C:\WINDOWS\temp
      2009-06-09 20:09:36 ----D---- C:\Program Files\Mozilla Firefox
      2009-06-09 20:08:21 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
      2009-06-09 20:06:56 ----D---- C:\WINDOWS\system32\ias
      2009-06-09 20:05:42 ----SD---- C:\WINDOWS\Tasks
      2009-06-09 20:04:21 ----A---- C:\WINDOWS\SchedLgU.Txt
      2009-06-09 15:18:19 ----D---- C:\WINDOWS\system32\drivers
      2009-06-09 15:18:19 ----D---- C:\WINDOWS
      2009-06-09 15:15:43 ----D---- C:\WINDOWS\system32
      2009-06-09 13:29:55 ----D---- C:\Program Files
      2009-06-09 13:21:30 ----SHD---- C:\System Volume Information
      2009-06-09 13:21:20 ----SHD---- C:\RECYCLER
      2009-06-09 03:09:16 ----D---- C:\Documents and Settings\toshiba\Application Data\uTorrent
      2009-06-08 02:54:48 ----A---- C:\WINDOWS\NeroDigital.ini
      2009-06-07 11:39:15 ----HD---- C:\Config.Msi
      2009-06-07 11:12:04 ----SHD---- C:\WINDOWS\Installer
      2009-06-07 11:11:18 ----D---- C:\WINDOWS\system32\CatRoot
      2009-06-07 11:09:49 ----HD---- C:\WINDOWS\inf
      2009-06-07 00:55:50 ----D---- C:\WINDOWS\system32\CatRoot2
      2009-06-07 00:15:53 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
      2009-06-01 02:33:38 ----A---- C:\WINDOWS\system.ini
      2009-05-31 02:12:30 ----D---- C:\Documents and Settings
      2009-05-31 00:31:23 ----A---- C:\WINDOWS\wininit.ini
      2009-05-30 20:59:56 ----D---- C:\Program Files\Maestria
      2009-05-30 20:59:56 ----D---- C:\Program Files\ActDrv100
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\NtmsData
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\config
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\repair
      2009-05-30 20:59:55 ----D---- C:\WINDOWS\Help
      2009-05-30 00:48:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
      2009-05-30 00:45:42 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Swift Sound
      2009-05-29 03:35:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
      2009-05-29 03:29:42 ----D---- C:\WINDOWS\system32\wbem
      2009-05-29 03:29:41 ----D---- C:\WINDOWS\AppPatch
      2009-05-29 03:06:42 ----RSHDC---- C:\WINDOWS\system32\dllcache
      2009-05-29 03:06:23 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
      2009-05-29 03:05:26 ----HD---- C:\WINDOWS\$hf_mig$
      2009-05-29 03:05:01 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
      2009-05-29 03:04:38 ----RSD---- C:\WINDOWS\assembly
      2009-05-29 03:02:25 ----D---- C:\Program Files\Windows Media Player
      2009-05-23 11:00:25 ----D---- C:\Program Files\Fichiers communs\Adobe
      2009-05-22 23:19:56 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
      2009-05-20 23:25:37 ----D---- C:\Program Files\Google
      2009-05-20 23:09:35 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
      2009-05-20 22:42:53 ----D---- C:\WINDOWS\Registration
      2009-05-20 20:02:57 ----D---- C:\WINDOWS\SoftwareDistribution
      2009-05-20 11:52:31 ----A---- C:\WINDOWS\powervideotoaudio.ini
      2009-05-20 11:50:09 ----A---- C:\WINDOWS\m3jpeg.ini
      2009-05-20 09:09:58 ----D---- C:\WINDOWS\Microsoft.NET
      2009-05-19 22:52:40 ----HD---- C:\Program Files\InstallShield Installation Information
      2009-05-19 22:52:36 ----D---- C:\Documents and Settings\toshiba\Application Data\COWON
      2009-05-19 22:52:27 ----D---- C:\Program Files\Fichiers communs
      2009-05-19 21:09:42 ----D---- C:\Documents and Settings\toshiba\Application Data\Nokia Multimedia Player
      2009-05-19 14:32:35 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
      2009-05-19 13:21:36 ----D---- C:\WINDOWS\WinSxS
      2009-05-19 00:33:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Google
      2009-05-17 22:18:26 ----D---- C:\Program Files\Adobe
      2009-05-16 23:56:47 ----D---- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
      2009-05-16 23:09:17 ----D---- C:\Program Files\NCH Software
      2009-05-16 22:47:42 ----A---- C:\WINDOWS\powermp3wavconverter.ini
      2009-05-12 23:55:52 ----D---- C:\WINDOWS\network diagnostic
      2009-05-12 14:04:52 ----D---- C:\Program Files\Free Download Manager
      2009-05-12 13:56:40 ----A---- C:\WINDOWS\CD_SearchHistory.INI
      2009-05-12 00:45:38 ----D---- C:\WINDOWS\system32\Lang
      2009-05-11 15:09:13 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
      2009-05-10 02:30:42 ----D---- C:\Downloads

      ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-07-07 5628]
      R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-07-07 22684]
      R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
      R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-05-24 213520]
      R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
      R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-05-30 17801]
      R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-08-01 25628]
      R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-08-01 2496]
      R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-08-01 86524]
      R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-08-01 14684]
      R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-08-01 6364]
      R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-08-01 87004]
      R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-08-01 92700]
      R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-07-07 40544]
      R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
      R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2005-11-15 1122656]
      R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-09-12 468736]
      R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
      R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
      R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
      R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
      R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-11-11 4064256]
      R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
      R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
      R3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS\system32\drivers\nchssvad.sys [2009-05-16 27136]
      R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
      R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
      R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
      R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-10-14 185728]
      R3 TVALD;Toshiba Mobile PC Service; C:\WINDOWS\system32\DRIVERS\NBSMI.sys [2005-10-20 6144]
      R3 Tvs;TOSHIBA Virtual Sound with SRS technologies; C:\WINDOWS\system32\DRIVERS\Tvs.sys [2005-11-30 43392]
      R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
      R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
      R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
      S1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys []
      S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
      S2 RapidPort;RapidPort; \??\C:\WINDOWS\system32\Drivers\CAPLPTN.SYS []
      S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\tdi.sys []
      S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
      S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
      S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-07-05 49920]
      S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-07-05 16496]
      S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-07-05 21568]
      S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
      S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
      S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
      S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
      S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
      S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
      S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
      S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
      S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
      S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
      S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
      S3 zmNTZip;zmNTZip; \??\C:\Program Files\ZipMagic\zmNTZip.sys []
      S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

      ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R2 ACS;Service de configuration Atheros; C:\WINDOWS\system32\acs.exe [2005-07-07 36864]
      R2 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-12-03 69632]
      R2 astcc;AST Service; C:\WINDOWS\system32\AstSrv.exe [2007-06-20 53248]
      R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-18 40960]
      R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [2008-06-13 81920]
      R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
      R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
      R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
      R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
      R2 TAPPSRV;TOSHIBA Application Service; C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2005-08-10 35328]
      R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2008-06-13 2723840]
      R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
      S2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]
      S2 gupdate1c9d80fecd7376a;Service Google Update (gupdate1c9d80fecd7376a); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-19 133104]
      S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-19 183280]
      S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
      S3 bepldr;BCL easyPDF SDK 5 Loader; C:\Program Files\Fichiers communs\BCL Technologies\easyPDF 5\bepldr.exe [2008-02-07 151552]
      S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
      S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
      S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
      S3 ServiceLayer;ServiceLayer; C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
      S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
      S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
      S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe []
      S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

      -----------------EOF-----------------
      0
  9. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Il manque encore la partie hijackthis du rapport :(

    Est-ce que tu peux essayer de lancer hijackthis seul, choisir "do a system scan and save a logfile" et poster le rapport stp ?

    0
    1. monstre
       
      voila le rapport hijack
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 02:54, on 10/06/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\acs.exe
      C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      C:\WINDOWS\system32\AstSrv.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
      C:\Program Files\Google\Update\GoogleUpdate.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
      C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\WINDOWS\System32\DLA\DLACTRLW.EXE
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\JLC's Software\Internet TV\Internet TV.exe
      C:\Program Files\Real\RealPlayer\RecordingManager.exe
      C:\Documents and Settings\toshiba\Bureau\HiJackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=%s
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
      R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
      O1 - Hosts: 66.98.148.65 auto.search.msn.com
      O1 - Hosts: 66.98.148.65 auto.search.msn.es
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
      O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT"
      O4 - HKLM\..\Run: [PrnStatusMX] C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
      O4 - HKLM\..\Run: [jdbtray] C:\WINDOWS\jdbcconf.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
      O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?8d90ad08d8d74b998c8c8ffacb1213a6
      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?8d90ad08d8d74b998c8c8ffacb1213a6
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
      O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
      O20 - AppInit_DLLs: acaptuser32.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
      O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: AST Service (astcc) - Advanced Software Technologies - C:\WINDOWS\system32\AstSrv.exe
      O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
      O23 - Service: BCL easyPDF SDK 5 Loader (bepldr) - Unknown owner - C:\Program Files\Fichiers communs\BCL Technologies\easyPDF 5\bepldr.exe
      O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
      O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
      O23 - Service: Service Google Update (gupdate1c9d80fecd7376a) (gupdate1c9d80fecd7376a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
      O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
      O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
      0
  10. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    • Télécharge RHosts (de S!Ri)
    • Double clique dessus pour l'exécuter
    • Clique sur "Restore original Hosts" (il ne se passe rien de visible, c'est normal)
    • Pour finir, fais redémarrer l'ordinateur.

    Ensuite :

    /!\ A l'attention de ceux qui passent sur ce sujet /!\
    Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.

    /!\ Désactive tous tes logiciels de protection /!\

    • Télécharge ComboFix (de sUBs) sur ton Bureau.
    • Double-clique sur ComboFix.exe afin de le lancer.
    • Il va te demander d'installer la console de récupération : accepte.
    • Ne touche à rien pendant le scan.
    • Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

    Tutoriel officiel de Combofix : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    0
    1. monstre
       
      salut
      j'ai un logiciel qui j'étulise pour ouvrir youtube car youtube est bloquer dans notre serveur le logiciel est u89resv1 est t'il qui cause ce probleb de redirection du serveur, es que je le désinstalle
      MERCI
      0
      1. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790 > monstre
         
        Je ne connais pas ce programme. Où l'as-tu eu ?

        0
      2. monstre > anthony5151 Messages postés 10927 Statut Contributeur sécurité
         
        j'ai ce programme a travers un amis qui ma donnez le nom du programme et je le télécharger a travers google, le lien de téléchargement j'ai loublier, stp es qu'il est malveillant ou non?
        0
      3. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790 > monstre
         
        Je ne sais pas...

        S'il n'est pas trop gros, tu peux l'analyser sur ce site

        0
      4. monstre > anthony5151 Messages postés 10927 Statut Contributeur sécurité
         
        salut j'ai l'analysé il ma donnez le résultat suivante :
        Fichier u89.exe reçu le 2009.06.14 14:56:42 (UTC)
        Antivirus Version Dernière mise à jour Résultat
        a-squared 4.5.0.18 2009.06.14 Virus.Win32.VB!IK
        AhnLab-V3 5.0.0.2 2009.06.14 -
        AntiVir 7.9.0.187 2009.06.14 TR/Crypt.FKM.Gen
        Antiy-AVL 2.0.3.1 2009.06.12 -
        Authentium 5.1.2.4 2009.06.13 W32/VB-Backdoor-TWNF-based!Maximus
        Avast 4.8.1335.0 2009.06.13 Win32:Trojan-gen {Other}
        AVG 8.5.0.339 2009.06.14 -
        BitDefender 7.2 2009.06.14 -
        CAT-QuickHeal 10.00 2009.06.13 -
        ClamAV 0.94.1 2009.06.14 -
        Comodo 1327 2009.06.14 -
        DrWeb 5.0.0.12182 2009.06.14 -
        eSafe 7.0.17.0 2009.06.11 Suspicious File
        eTrust-Vet 31.6.6556 2009.06.12 -
        F-Prot 4.4.4.56 2009.06.13 W32/VB-Backdoor-TWNF-based!Maximus
        F-Secure 8.0.14470.0 2009.06.13 -
        Fortinet 3.117.0.0 2009.06.14 -
        GData 19 2009.06.14 Win32:Trojan-gen {Other}
        Ikarus T3.1.1.59.0 2009.06.14 Virus.Win32.VB
        K7AntiVirus 7.10.762 2009.06.12 -
        Kaspersky 7.0.0.125 2009.06.14 -
        McAfee 5645 2009.06.13 Generic.dx
        McAfee+Artemis 5645 2009.06.13 Generic.dx
        Microsoft 1.4701 2009.06.14 -
        NOD32 4153 2009.06.14 probably a variant of Win32/Agent
        Norman 6.01.09 2009.06.12 -
        nProtect 2009.1.8.0 2009.06.14 -
        Panda 10.0.0.14 2009.06.14 -
        PCTools 4.4.2.0 2009.06.12 -
        Prevx 3.0 2009.06.14 -
        Rising 21.33.62.00 2009.06.14 -
        Sophos 4.42.0 2009.06.14 Mal/VB-G
        Sunbelt 3.2.1858.2 2009.06.13 -
        Symantec 1.4.4.12 2009.06.14 -
        TheHacker 6.3.4.3.345 2009.06.13 -
        TrendMicro 8.950.0.1092 2009.06.12 PAK_Generic.001
        VBA32 3.12.10.7 2009.06.14 -
        ViRobot 2009.6.13.1785 2009.06.13 -
        VirusBuster 4.6.5.0 2009.06.14 -
        Information additionnelle
        File size: 503808 bytes
        MD5...: bc23cb2d1b1ea9fbc6616dcbb32c1457
        SHA1..: dfce3397a2d8493605daac96e8e4c357b6c1bb27
        SHA256: 21d3e9f1a2ede447ad2e38097133e174760f0111e6be31ff99c58a3483c8663e
        ssdeep: -<br>
        PEiD..: -
        TrID..: File type identification<br>DirectShow filter (36.0%)<br>Win32 Executable Microsoft Visual Basic 6 (22.5%)<br>Windows OCX File (22.1%)<br>Win32 Executable MS Visual C++ (generic) (6.7%)<br>UPX compressed Win32 Executable (5.4%)
        PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x1590<br>timedatestamp.....: 0x49725b59 (Sat Jan 17 22:27:37 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0xaa24 0xb000 5.20 1e6775c623e78ab6dc9ac6d514e3cd3f<br>.data 0xc000 0xa54 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110<br>.rsrc 0xd000 0x6d3b4 0x6e000 6.96 ac8b7e8034b6687043d381e8d07c7f8b<br><br>( 1 imports ) <br>> MSVBVM60.DLL: _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaFreeVar, __vbaAryMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, __vbaNameFile, _adj_fdiv_m32, __vbaAryDestruct, __vbaVarForInit, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, -, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, -, __vbaPutOwner3, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, -, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaVarCat, __vbaI2Var, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaVar2Vec, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, -, __vbaStrToAnsi, __vbaVarDup, -, _CIatan, __vbaStrMove, __vbaStrVarCopy, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr, -<br><br>( 0 exports ) <br>
        PDFiD.: -
        RDS...: NSRL Reference Data Set<br>-
        0
  11. anthony5151 Messages postés 10927 Statut Contributeur sécurité 790
     
    Vu le nombre important d'antivirus qui le détectent, il semble effectivement que ce programme soit néfaste...

    0