Trojan

Résolu
bleurk -  
Bonjour,
je suis infecté par des trojan, je n'arrive pas a les suprimer
quelqu'un peu m'aider svp?
Configuration: Windows Vista
Firefox 3.0.11

51 réponses

Résumé de la discussion

Plusieurs éléments indiquent une problématique de suppression de trojans sur Windows Vista avec Firefox 3.0.11, et une demande d'aide pour évaluer les solutions possibles et prioriser l'action. Des solutions évoquées incluent l'exécution d'outils de sécurité en ligne comme Nod32/ESET, la génération et la mise à disposition de rapports de scans, ainsi que des procédures basées sur HijackThis. Des éléments techniques supplémentaires dans les messages suggèrent d'examiner les paramètres Internet, les pages de démarrage, les modules complémentaires et les programmes de démarrage pour repérer les modifications malveillantes. En cas de résultats longs et complexes, une étape possible est de partager les rapports détaillés pour interprétation et évaluer les prochaines mesures de nettoyage, éventuellement avec une assistance spécialisée.

Bobot (l’IA à votre service)
  1. Utilisateur anonyme
    bonsoir,
    poste le rapport de ton antivirus ou l'outil qui a détecté le virus ici s'il te plait
    1. bleurk Auteur
      voici le rapport de spybot

      --- Search result list ---
      Win32.TDSS.reg: [SBI $2867D4A5] Réglages (Modification du registre, nothing done)
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules\msqpdxserv

      Win32.TDSS.reg: [SBI $EDA68CC2] Réglages (Modification du registre, nothing done)
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules\msqpdxserv

      Win32.TDSS.reg: [SBI $667311C3] Réglages (Modification du registre, nothing done)
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules\msqpdxl

      Win32.TDSS.reg: [SBI $99E026E5] Réglages (Modification du registre, nothing done)
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules\msqpdxl

      DoubleClick: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      Zedo: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      Statcounter: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      Tradedoubler: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      Tradedoubler: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      Tradedoubler: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      BlueStreak: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      Tradedoubler: Cookie traceur (Firefox: johnny (default)) (Cookie, nothing done)

      --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

      2009-01-26 blindman.exe (1.0.0.8)
      2008-01-28 SDDelFile.exe (1.0.2.4)
      2009-01-26 SDFiles.exe (1.6.1.7)
      2009-01-26 SDMain.exe (1.0.0.6)
      2009-01-26 SDShred.exe (1.0.2.5)
      2009-01-26 SDUpdate.exe (1.6.0.12)
      2009-01-26 SDWinSec.exe (1.0.0.12)
      2009-01-26 SpybotSD.exe (1.6.2.46)
      2009-03-05 TeaTimer.exe (1.6.6.32)
      2009-03-30 unins000.exe (51.49.0.0)
      2009-01-26 Update.exe (1.6.0.7)
      2009-01-26 advcheck.dll (1.6.2.15)
      2007-04-02 aports.dll (2.1.0.0)
      2008-06-14 DelZip179.dll (1.79.11.1)
      2009-01-26 SDHelper.dll (1.6.2.14)
      2008-06-19 sqlite3.dll
      2008-10-22 Tools.dll (2.1.6.8)
      2009-01-16 UninsSrv.dll (1.0.0.0)
      2009-05-19 Includes\Adware.sbi (*)
      2009-06-02 Includes\AdwareC.sbi (*)
      2009-01-22 Includes\Cookies.sbi (*)
      2009-05-19 Includes\Dialer.sbi (*)
      2009-06-02 Includes\DialerC.sbi (*)
      2009-01-22 Includes\HeavyDuty.sbi (*)
      2009-05-26 Includes\Hijackers.sbi (*)
      2009-06-23 Includes\HijackersC.sbi (*)
      2009-06-23 Includes\Keyloggers.sbi (*)
      2009-06-30 Includes\KeyloggersC.sbi (*)
      2004-11-29 Includes\LSP.sbi (*)
      2009-06-30 Includes\Malware.sbi (*)
      2009-06-30 Includes\MalwareC.sbi (*)
      2009-03-25 Includes\PUPS.sbi (*)
      2009-06-30 Includes\PUPSC.sbi (*)
      2009-01-22 Includes\Revision.sbi (*)
      2009-01-13 Includes\Security.sbi (*)
      2009-06-02 Includes\SecurityC.sbi (*)
      2008-06-03 Includes\Spybots.sbi (*)
      2008-06-03 Includes\SpybotsC.sbi (*)
      2009-04-07 Includes\Spyware.sbi (*)
      2009-06-02 Includes\SpywareC.sbi (*)
      2009-06-08 Includes\Tracks.uti
      2009-06-17 Includes\Trojans.sbi (*)
      2009-06-30 Includes\TrojansC.sbi (*)
      2008-03-04 Plugins\Chai.dll
      2008-03-05 Plugins\Fennel.dll
      2008-02-26 Plugins\Mate.dll
      2008-12-24 Plugins\TCPIPAddress.dll

      --- System information ---
      Windows Vista (Build: 6001) Service Pack 1 (6.0.6001)

      --- Startup entries list ---
      Located: HK_LM:Run, Adobe Reader Speed Launcher
      command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
      size: 39792
      MD5: 392845E8D49B5F0E81AAC4D795000A8C

      Located: HK_LM:Run, avgnt
      command: "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      file: C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      size: 209153
      MD5: 29680A793F690EEF4AAA68479D2A6DF8

      Located: HK_LM:Run, F-Secure ExploitShield
      command: "C:\Program Files\F-Secure\ExploitShield\fsesgui.exe"
      file: C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
      size: 629376
      MD5: C3195D1010CE4EE40219566DC2135268

      Located: HK_LM:Run, GrooveMonitor
      command: "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
      file: C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
      size: 31072
      MD5: 644795F6985C740F5E36E9336B837D0B

      Located: HK_LM:Run, iTunesHelper
      command: "C:\Program Files\iTunes\iTunesHelper.exe"
      file: C:\Program Files\iTunes\iTunesHelper.exe
      size: 292136
      MD5: 9D4F3923F8D3A13F2FEADB66C62FE5D0

      Located: HK_LM:Run, QuickTime Task
      command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
      file: C:\Program Files\QuickTime\QTTask.exe
      size: 413696
      MD5: FABAD2BFD44661D8CC627E5485BFAFAF

      Located: HK_LM:RunOnce, Launcher
      command: %WINDIR%\SMINST\launcher.exe
      file: C:\Windows\SMINST\launcher.exe
      size: 44168
      MD5: 31539595F006DAE39F719735F30C3570

      Located: HK_CU:Run, ehTray.exe
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: C:\Windows\ehome\ehTray.exe
      file: C:\Windows\ehome\ehTray.exe
      size: 125952
      MD5: BF08674925F151BD4537B89A493E3E0C

      Located: HK_CU:Run, ISUSPM Startup
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
      file: C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
      size: 249856
      MD5: 1C46FC1AB600766B8554580204806E84

      Located: HK_CU:Run, LDM
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      file: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      size: 36864
      MD5: 75A8679F5D996D286FC8649E74394B79

      Located: HK_CU:Run, msnlivesearch
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
      file: C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
      size: 49152
      MD5: BEB9FB770075D484ACFB2645EB788527

      Located: HK_CU:Run, Sidebar
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      file: C:\Program Files\Windows Sidebar\sidebar.exe
      size: 1233920
      MD5: FD278E51A7D6F52D22FCE6C67E037AD6

      Located: HK_CU:Run, SpybotSD TeaTimer
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      size: 2260480
      MD5: 390679F7A217A5E73D756276C40AE887

      Located: HK_CU:Run, swg
      where: S-1-5-21-3603102019-2234686749-2930555637-1000...
      command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      size: 39408
      MD5: 5D61BE7DB55B026A5D61A3EED09D0EAD

      Located: Démarrage (tous utilisateurs), Logitech Desktop Messenger.lnk
      where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
      command: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
      file: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
      size: 196608
      MD5: 6F2E5108667BF1149D884E3CBEB9CDD1

      Located: Démarrage (tous utilisateurs), PDFCreator.lnk
      where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
      command: C:\Program Files\PDFCreator\PDFCreator.exe
      file: C:\Program Files\PDFCreator\PDFCreator.exe
      size: 2641920
      MD5: 4DB47E14FF62720ADA91BE1E40226ACF

      Located: Démarrage (utilisateur), Adobe Gamma.lnk
      where: C:\Users\johnny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup...
      command: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      file: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      size: 113664
      MD5: C2FF17734176CD15221C10044EF0BA1A

      --- Browser helper object list ---
      {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name: Download Manager Browser Helper Object
      Path: C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\
      Long name: XEBDLHelper.dll
      Short name: XEBDLH~1.DLL
      Date (created): 21/05/2007 11:34:48
      Date (last access): 15/10/2007 13:54:34
      Date (last write): 21/05/2007 11:34:48
      Filesize: 525792
      Attributes: archive
      MD5: FD850334FE0EAC8B286235996E533B10
      CRC32: E6717AAB
      Version: 1.0.0.14

      {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name: SWEETIE
      CLSID name:

      {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (WormRadar.com IESiteBlocker.NavFilter)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name: WormRadar.com IESiteBlocker.NavFilter
      CLSID name:

      {5C255C8A-E604-49b4-9D64-90988571CECB} ()
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name:

      {64F56FC1-1272-44CD-BA6E-39723696E350} (EoRezoBHO)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name: EoRezoBHO
      CLSID name:

      {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (Groove GFS Browser Helper)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name: Groove GFS Browser Helper
      Path: C:\Program Files\Microsoft Office\Office12\
      Long name: GrooveShellExtensions.dll
      Short name: GRA8E1~1.DLL
      Date (created): 12/02/2009 15:19:32
      Date (last access): 01/05/2009 10:21:28
      Date (last write): 12/02/2009 15:19:32
      Filesize: 2217848
      Attributes: archive
      MD5: A6B5A41C0ED007AB6C43CAD899E533D8
      CRC32: BA078F79
      Version: 12.0.6421.1000

      {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name: Programme d'aide de l'Assistant de connexion Windows Live
      Path: C:\Program Files\Common Files\Microsoft Shared\Windows Live\
      Long name: WindowsLiveLogin.dll
      Short name: WINDOW~1.DLL
      Date (created): 22/01/2009 16:41:30
      Date (last access): 18/02/2009 16:20:22
      Date (last write): 22/01/2009 16:41:30
      Filesize: 408448
      Attributes: archive
      MD5: B7899C3E21B299D7A3C0DA96CAE340BD
      CRC32: 288935F8
      Version: 5.0.818.5

      {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name: Google Toolbar Helper
      description: Google toolbar
      classification: Open for discussion
      known filename: googletoolbar.dll<br>googletoolbar*.dll<br>(* = number)<br>googletoolbar_en_*.**-big.dll<br>Googletoolbar_en_*.*.**-deleon.dll
      info link: http://www.google.com/intl/fr/toolbar/ie/index.html
      info source: TonyKlein
      Path: C:\Program Files\Google\Google Toolbar\
      Long name: GoogleToolbar.dll
      Short name: GOOGLE~1.DLL
      Date (created): 14/01/2009 14:31:22
      Date (last access): 14/01/2009 14:31:22
      Date (last write): 14/01/2009 14:30:30
      Filesize: 251504
      Attributes: archive
      MD5: 105EBC389FEB20A5A6DE47316001B7F1
      CRC32: 3760EC78

      {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name: Google Toolbar Notifier BHO
      Path: C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\
      Long name: swg.dll
      Short name:
      Date (created): 07/04/2009 19:22:08
      Date (last access): 07/04/2009 19:22:08
      Date (last write): 07/04/2009 19:22:08
      Filesize: 668656
      Attributes: archive
      MD5: D1585B06DED161E13B905DC4FFBF7F12
      CRC32: 88D5BAA5
      Version: 5.1.1309.3572

      {C7B76B90-3455-4AE6-A752-EAC4D19689E5} (EoBHO)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name: EoBHO
      CLSID name:

      {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (Google Dictionary Compression sdch)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name: Google Dictionary Compression sdch
      CLSID name: Google Dictionary Compression sdch
      Path: C:\Program Files\Google\Google Toolbar\Component\
      Long name: fastsearch_219B3E1547538286.dll
      Short name: FASTSE~1.DLL
      Date (created): 14/01/2009 14:30:26
      Date (last access): 14/01/2009 14:30:26
      Date (last write): 14/01/2009 14:30:26
      Filesize: 522224
      Attributes: archive
      MD5: E27153F524C86807079F62550094B073
      CRC32: E181FF40
      Version: 1.0.610.10250

      {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java(tm) Plug-In 2 SSV Helper)
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name: Java(tm) Plug-In 2 SSV Helper
      Path: C:\Program Files\Java\jre6\bin\
      Long name: jp2ssv.dll
      Short name:
      Date (created): 26/11/2008 14:02:44
      Date (last access): 10/11/2008 04:39:26
      Date (last write): 10/11/2008 06:43:16
      Filesize: 34816
      Attributes: archive
      MD5: 5D57FD3DF32DC69CEC3D1D54B4C43162
      CRC32: D7C13FB2
      Version: 6.0.110.3

      {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} ()
      location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
      BHO name:
      CLSID name:

      --- ActiveX list ---
      {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool)
      DPF name:
      CLSID name: MSN Photo Upload Tool
      Installer: C:\Windows\Downloaded Program Files\MSNPUpld.inf
      Codebase: http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
      description:
      classification: Legitimate
      known filename: MsnPUpld.dll
      info link:
      info source: Safer Networking Ltd.
      Path: C:\Windows\Downloaded Program Files\
      Long name: MsnPUpld.dll
      Short name:
      Date (created): 20/11/2006 11:04:16
      Date (last access): 20/11/2006 11:04:16
      Date (last write): 20/11/2006 11:04:16
      Filesize: 543544
      Attributes: archive
      MD5: A0F541D9D2CACEEC7A4A378CD0C31626
      CRC32: 035C591F
      Version: 10.0.914.0

      {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()
      DPF name:
      CLSID name:
      Installer: C:\Windows\Downloaded Program Files\erma.inf
      Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
      description:
      classification: Open for discussion
      known filename:
      info link:
      info source: Safer Networking Ltd.

      {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
      DPF name: Java Runtime Environment 1.6.0
      CLSID name: Java Plug-in 1.6.0_11
      Installer:
      Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
      description:
      classification: Legitimate
      known filename: npjpi150_06.dll
      info link:
      info source: Safer Networking Ltd.
      Path: C:\Program Files\Java\jre6\bin\
      Long name: npjpi160_11.dll
      Short name: NPJPI1~1.DLL
      Date (created): 10/11/2008 04:39:26
      Date (last access): 10/11/2072 04:39:26
      Date (last write): 10/11/2008 06:43:32
      Filesize: 132504
      Attributes: archive
      MD5: D400116F6776ACB6EDB6B1F5EEB9F92D
      CRC32: CECB5751
      Version: 6.0.110.3

      --- Process list ---
      PID: 1840 (1156) C:\Windows\system32\Dwm.exe
      size: 81920
      MD5: 59903071D7ACE6A02093C47E9E38AF97
      PID: 1868 (1820) C:\Windows\Explorer.EXE
      size: 2927104
      MD5: 4F554999D7D5F05DAAEBBA7B5BA1089D
      PID: 1932 (1216) C:\Windows\system32\taskeng.exe
      size: 169472
      MD5: 5F109032CE46B7184ED9E50F9FE8489E
      PID: 2144 (2064) C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
      size: 186904
      MD5: 38440FE1A65B1FE3D246C5C4CAD22F53
      PID: 3480 (1868) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      size: 209153
      MD5: 29680A793F690EEF4AAA68479D2A6DF8
      PID: 3508 (1868) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
      size: 31072
      MD5: 644795F6985C740F5E36E9336B837D0B
      PID: 3564 (1868) C:\Program Files\iTunes\iTunesHelper.exe
      size: 292136
      MD5: 9D4F3923F8D3A13F2FEADB66C62FE5D0
      PID: 3596 (1868) C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
      size: 629376
      MD5: C3195D1010CE4EE40219566DC2135268
      PID: 3624 (1868) C:\Program Files\Windows Sidebar\sidebar.exe
      size: 1233920
      MD5: FD278E51A7D6F52D22FCE6C67E037AD6
      PID: 3652 (1868) C:\Windows\ehome\ehtray.exe
      size: 125952
      MD5: BF08674925F151BD4537B89A493E3E0C
      PID: 3708 (1868) C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
      size: 49152
      MD5: BEB9FB770075D484ACFB2645EB788527
      PID: 3780 (1868) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      size: 39408
      MD5: 5D61BE7DB55B026A5D61A3EED09D0EAD
      PID: 3860 (1868) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      size: 2260480
      MD5: 390679F7A217A5E73D756276C40AE887
      PID: 3944 (1868) C:\Program Files\PDFCreator\PDFCreator.exe
      size: 2641920
      MD5: 4DB47E14FF62720ADA91BE1E40226ACF
      PID: 4068 ( 856) C:\Windows\ehome\ehmsas.exe
      size: 37376
      MD5: 0F4195B9B348DE5CF9B822F81704B20E
      PID: 3940 (3624) C:\Program Files\Windows Sidebar\sidebar.exe
      size: 1233920
      MD5: FD278E51A7D6F52D22FCE6C67E037AD6
      PID: 4120 ( 856) C:\Windows\system32\wbem\unsecapp.exe
      size: 37888
      MD5: 25873356E52849C3F5B3F1B02317E8C8
      PID: 5192 (2516) C:\Program Files\uTorrent\utorrent.exe
      size: 288048
      MD5: 273E8C52E12B0E67913BBBF5CEF5B07E
      PID: 4296 (1868) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      size: 3885408
      MD5: 35B9FA77B73358D9063CD61AA3D83EE8
      PID: 1800 ( 856) C:\Program Files\Windows Live\Contacts\wlcomm.exe
      size: 27512
      MD5: 654480EA67078C7B4C6C8BA871B07D5D
      PID: 1708 (1868) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
      size: 5365592
      MD5: 0477C2F9171599CA5BC3307FDFBA8D89
      PID: 3524 ( 856) C:\Windows\System32\mobsync.exe
      size: 95744
      MD5: 9B89B3BB79EA1ACF041F40A7B6FC5827
      PID: 0 ( 0) [System Process]
      PID: 4 ( 0) System
      PID: 468 ( 4) smss.exe
      size: 64000
      PID: 588 ( 576) csrss.exe
      size: 6144
      PID: 648 ( 576) wininit.exe
      size: 96768
      PID: 660 ( 640) csrss.exe
      size: 6144
      PID: 696 ( 648) services.exe
      size: 279040
      PID: 712 ( 648) lsass.exe
      size: 9728
      PID: 720 ( 648) lsm.exe
      size: 229888
      PID: 856 ( 696) svchost.exe
      size: 21504
      PID: 920 ( 640) winlogon.exe
      size: 314880
      PID: 980 ( 696) svchost.exe
      size: 21504
      PID: 1020 ( 696) svchost.exe
      size: 21504
      PID: 1120 ( 696) svchost.exe
      size: 21504
      PID: 1156 ( 696) svchost.exe
      size: 21504
      PID: 1216 ( 696) svchost.exe
      size: 21504
      PID: 1292 (1120) audiodg.exe
      size: 88064
      PID: 1316 ( 696) svchost.exe
      size: 21504
      PID: 1340 ( 696) SLsvc.exe
      size: 2623488
      PID: 1392 ( 696) svchost.exe
      size: 21504
      PID: 1596 ( 696) svchost.exe
      size: 21504
      PID: 1984 ( 696) spoolsv.exe
      size: 125952
      PID: 2008 ( 696) sched.exe
      PID: 2040 ( 696) svchost.exe
      size: 21504
      PID: 640 (1216) taskeng.exe
      size: 169472
      PID: 2028 ( 696) avguard.exe
      PID: 1908 ( 696) AppleMobileDeviceService.exe
      PID: 1592 ( 696) mDNSResponder.exe
      PID: 1624 ( 696) fsessrv.exe
      PID: 764 ( 696) LSSrvc.exe
      PID: 1312 ( 696) PIFSvc.exe
      PID: 2064 ( 696) LVComSer.exe
      PID: 2104 ( 696) LVPrcSrv.exe
      PID: 2156 ( 696) NBService.exe
      PID: 2216 ( 696) AluSchedulerSvc.exe
      PID: 2244 ( 696) PnkBstrA.exe
      size: 66872
      PID: 2268 ( 696) PnkBstrB.exe
      size: 107832
      PID: 2324 ( 696) svchost.exe
      size: 21504
      PID: 2340 ( 696) svchost.exe
      size: 21504
      PID: 2372 ( 696) svchost.exe
      size: 21504
      PID: 2420 ( 696) SearchIndexer.exe
      size: 439808
      PID: 2528 ( 696) SDWinSec.exe
      MD5: 794D4B48DFB6E999537C7C3947863463
      PID: 2640 (1156) WUDFHost.exe
      size: 142336
      PID: 3736 ( 696) iPodService.exe
      PID: 2356 ( 696) svchost.exe
      size: 21504
      PID: 4168 ( 856) WmiPrvSE.exe
      PID: 3280 (4228) conime.exe
      size: 69120
      PID: 2596 ( 696) a2service.exe
      PID: 4400 (2420) SearchProtocolHost.exe
      size: 184832
      PID: 5704 (2420) SearchFilterHost.exe
      size: 87552

      --- Browser start & search pages list ---
      Spybot - Search & Destroy browser pages report, 08/07/2009 19:29:09

      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
      C:\Windows\system32\blank.htm
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
      https://www.google.fr/?gws_rd=ssl
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
      https://www.msn.com/fr-fr/?ocid=iehp
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
      http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
      C:\Windows\System32\blank.htm
      HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
      https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
      https://www.msn.com/fr-fr/
      HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
      https://www.msn.com/fr-fr/?ocid=iehp
      HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
      https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

      --- Winsock Layered Service Provider list ---
      Namespace Provider 1: Fournisseur Shim d'affectation de noms de messagerie
      GUID: {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE}
      Filename:

      Namespace Provider 2: Fournisseur d'espace de noms du nuage PNRP
      GUID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D}
      Filename:

      Namespace Provider 3: Fournisseur d'espace de noms du nom PNRP
      GUID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D}
      Filename:

      --- Uninstall list ---

      --- System Services ---
      Service (registry key): .NET CLR Data
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): .NET CLR Networking
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): .NET Data Provider for Oracle
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): .NET Data Provider for SqlServer
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): .NETFramework
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): 61883
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Pilote d'unité 61883
      Image path: system32\DRIVERS\61883.sys
      Image size: 45696
      Image MD5: 585E64BB6DFBC0A2F1F0B554DED012DF
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): a2free
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: a-squared Free Service
      Description: Scans the PC for unwanted software and provides protection from malicious code
      Object name: LocalSystem
      Image path: "C:\Program Files\a-squared Free\a2service.exe"
      Image size: 718880
      Image MD5: A86B9739EFB314FC13D81A21CC4E5102
      Control Set: CurrentControlSet
      Start: 2
      Type: 16
      Error Control: 1

      Service (registry key): ACPI
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Pilote ACPI Microsoft
      Image path: system32\drivers\acpi.sys
      Image size: 266808
      Image MD5: FCB8C7210F0135E24C6580F7F649C73C
      Control Set: CurrentControlSet
      Start: 0
      Type: 1
      Error Control: 3

      Service (registry key): Adobe LM Service
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Adobe LM Service
      Description: AdobeLM Service
      Object name: LocalSystem
      Image path: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
      Image size: 72704
      Image MD5: 8B46D5A1D3EF08232C04D0EAFB871FB2
      Control Set: CurrentControlSet
      Start: 3
      Type: 16
      Error Control: 1

      Service (registry key): adp94xx
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\adp94xx.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): adpahci
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\adpahci.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): adpu160m
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\adpu160m.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): adpu320
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\adpu320.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): adsi
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): AeLookupSvc
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\aelupsvc.dll,-1
      Description: @%SystemRoot%\system32\aelupsvc.dll,-2
      Object name: localSystem
      Image path: %systemroot%\system32\svchost.exe -k netsvcs
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1

      Service (registry key): AFD
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Ancilliary Function Driver for Winsock
      Description: Ancilliary Function Driver for Winsock
      Image path: \SystemRoot\system32\drivers\afd.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 1
      Type: 1
      Error Control: 1

      Service (registry key): agp440
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Intel AGP Bus Filter
      Image path: \SystemRoot\system32\drivers\agp440.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): aic78xx
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\djsvs.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): ALG
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\Alg.exe,-112
      Description: @%SystemRoot%\system32\Alg.exe,-113
      Object name: NT AUTHORITY\LocalService
      Image path: %SystemRoot%\System32\alg.exe
      Image size: 59392
      Image MD5: A1545B731579895D8CC44FC0481C1192
      Control Set: CurrentControlSet
      Start: 3
      Type: 16
      Error Control: 1

      Service (registry key): aliide
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\aliide.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 3

      Service (registry key): amdagp
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: AMD AGP Bus Filter Driver
      Image path: \SystemRoot\system32\drivers\amdagp.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): amdide
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\amdide.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 3

      Service (registry key): AmdK7
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: AMD K7 Processor Driver
      Image path: \SystemRoot\system32\drivers\amdk7.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): AmdK8
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Pilote de processeur AMD K8
      Image path: system32\DRIVERS\amdk8.sys
      Image size: 44032
      Image MD5: 93AE7F7DD54AB986A6F1A1B37BE7442D
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): AntiVirSchedulerService
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Avira AntiVir Planificateur
      Description: Service de commande des tâches de contrôle et mises à jour Avira AntiVir Personal - Free Antivirus.
      Object name: LocalSystem
      Image path: "C:\Program Files\Avira\AntiVir Desktop\sched.exe"
      Image size: 108289
      Image MD5: 7C98F7A5BDE8A775B7DB9A1E808266D9
      Control Set: CurrentControlSet
      Start: 2
      Type: 16
      Error Control: 1

      Service (registry key): AntiVirService
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Avira AntiVir Guard
      Description: Offre une protection permanente contre les virus et les logiciels malveillants grâce au moteur de recherche AntiVir.
      Object name: LocalSystem
      Image path: "C:\Program Files\Avira\AntiVir Desktop\avguard.exe"
      Image size: 185089
      Image MD5: 81E58F368D62EC818F49D1C5CF3854C3
      Control Set: CurrentControlSet
      Start: 2
      Type: 16
      Error Control: 1

      Service (registry key): Appinfo
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%systemroot%\system32\appinfo.dll,-100
      Description: @%systemroot%\system32\appinfo.dll,-101
      Object name: LocalSystem
      Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 3
      Type: 32
      Error Control: 1
      Depends On services: RpcSs,ProfSvc

      Service (registry key): Apple Mobile Device
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Apple Mobile Device
      Description: Fournit l’interface pour les appareils mobiles Apple.
      Object name: LocalSystem
      Image path: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
      Image size: 144712
      Image MD5: 7E94E567C1AA5ABE6174032B3DAB6C23
      Control Set: CurrentControlSet
      Start: 2
      Type: 16
      Error Control: 1
      Depends On services: Tcpip

      Service (registry key): arc
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\arc.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): arcsas
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\arcsas.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): ASP.NET_1.1.4322
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): AsyncMac
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Pilote de média asynchrone RAS
      Description: Pilote de média asynchrone RAS
      Image path: system32\DRIVERS\asyncmac.sys
      Image size: 17408
      Image MD5: 53B202ABEE6455406254444303E87BE1
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): atapi
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Canal IDE
      Image path: system32\drivers\atapi.sys
      Image size: 21560
      Image MD5: 2D9C903DC76A66813D350A562DE40ED9
      Control Set: CurrentControlSet
      Start: 0
      Type: 1
      Error Control: 3

      Service (registry key): athr
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Atheros Extensible Wireless LAN device driver
      Image path: system32\DRIVERS\athr.sys
      Image size: 952832
      Image MD5: ACDB46B1A467752A2F280C68C8461556
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): AudioEndpointBuilder
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\audiosrv.dll,-204
      Description: @%SystemRoot%\System32\audiosrv.dll,-205
      Object name: LocalSystem
      Image path: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: PlugPlay

      Service (registry key): Audiosrv
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\audiosrv.dll,-200
      Description: @%SystemRoot%\System32\audiosrv.dll,-201
      Object name: NT AUTHORITY\LocalService
      Image path: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: AudioEndpointBuilder,RpcSs,MMCSS

      Service (registry key): Avc
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Périphérique AVC
      Image path: system32\DRIVERS\avc.sys
      Image size: 40448
      Image MD5: F4B56425A00BEB32F5FA6603FF7B0EA2
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): avgio
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: avgio
      Image path: \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 1
      Type: 1
      Error Control: 1
      Depends On services: FltMgr

      Service (registry key): avgntflt
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: avgntflt
      Description: Avira files mini-filter driver
      Image path: system32\DRIVERS\avgntflt.sys
      Image size: 55640
      Image MD5: 76C10D80E46CB79570479CB7CF205D39
      Control Set: CurrentControlSet
      Start: 2
      Type: 2
      Error Control: 1
      Depends On services: FltMgr

      Service (registry key): avipbb
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: avipbb
      Description: Avira's Driver for RootKit Detection
      Image path: system32\DRIVERS\avipbb.sys
      Image size: 96104
      Image MD5: AD9BD66A862116E79CB45BB6BE46055F
      Control Set: CurrentControlSet
      Start: 1
      Type: 1
      Error Control: 1

      Service (registry key): BattC
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): BDFsDrv
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: BDFsDrv
      Image path: \??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): Beep
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Beep
      Control Set: CurrentControlSet
      Start: 1
      Type: 1
      Error Control: 1

      Service (registry key): BFE
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\bfe.dll,-1001
      Description: @%SystemRoot%\system32\bfe.dll,-1002
      Object name: NT AUTHORITY\LocalService
      Image path: %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: RpcSs

      Service (registry key): BITS
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\qmgr.dll,-1000
      Description: @%SystemRoot%\system32\qmgr.dll,-1001
      Object name: LocalSystem
      Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: RpcSs,EventSystem

      Service (registry key): blbdrive
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\blbdrive.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): Bonjour Service
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Service Bonjour
      Description: Bonjour permet à des applications comme iTunes et Safari d’annoncer et de découvrir des services sur le réseau local. En gardant Bonjour en exécution, vous pouvez vous connecter à des périphériques comme l’Apple TV et à des services logiciels comme le partage iTunes et AirTunes. Si vous désactivez Bonjour, tous les services réseau qui en dépendent de manière explicite ne démarreront pas.
      Object name: LocalSystem
      Image path: "C:\Program Files\Bonjour\mDNSResponder.exe"
      Image size: 238888
      Image MD5: 3F56903E124E820AEECE6D471583C6C1
      Control Set: CurrentControlSet
      Start: 2
      Type: 16
      Error Control: 1
      Depends On services: Tcpip

      Service (registry key): Boonty Games
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Boonty Games
      Description: Boonty Games
      Object name: LocalSystem
      Image path: "C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 16
      Error Control: 1

      Service (registry key): bowser
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Bowser
      Description: Implements the datagram receiver for the computer browser browser service.
      Image path: system32\DRIVERS\bowser.sys
      Image size: 69632
      Image MD5: 74B442B2BE1260B7588C136177CEAC66
      Control Set: CurrentControlSet
      Start: 3
      Type: 2
      Error Control: 1

      Service (registry key): BrFiltLo
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Brother USB Mass-Storage Lower Filter Driver
      Image path: \SystemRoot\system32\drivers\brfiltlo.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): BrFiltUp
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Brother USB Mass-Storage Upper Filter Driver
      Image path: \SystemRoot\system32\drivers\brfiltup.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): Browser
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%systemroot%\system32\browser.dll,-100
      Description: @%systemroot%\system32\browser.dll,-101
      Object name: LocalSystem
      Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: LanmanWorkstation,LanmanServer

      Service (registry key): Brserid
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Brother MFC Serial Port Interface Driver (WDM)
      Image path: \SystemRoot\system32\drivers\brserid.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): BrSerWdm
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Brother WDM Serial driver
      Image path: \SystemRoot\system32\drivers\brserwdm.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): BrUsbMdm
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Brother MFC USB Fax Only Modem
      Image path: \SystemRoot\system32\drivers\brusbmdm.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): BrUsbSer
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Brother MFC USB Serial WDM Driver
      Image path: \SystemRoot\system32\drivers\brusbser.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): BTHMODEM
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Bluetooth Serial Communications Driver
      Image path: \SystemRoot\system32\drivers\bthmodem.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): cdfs
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: CD/DVD File System Reader
      Description: ISO9660/Joliet File System Reader for CD/DVDs. (Core) (All pieces)
      Image path: system32\DRIVERS\cdfs.sys
      Image size: 70144
      Image MD5: 7ADD03E75BEB9E6DD102C3081D29840A
      Control Set: CurrentControlSet
      Start: 4
      Type: 2
      Error Control: 1
      Depends On group: "SCSI CDROM Class"

      Service (registry key): cdrom
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Pilote de CD-ROM
      Image path: system32\DRIVERS\cdrom.sys
      Image size: 67072
      Image MD5: 1EC25CEA0DE6AC4718BF89F9E1778B57
      Control Set: CurrentControlSet
      Start: 1
      Type: 1
      Error Control: 1

      Service (registry key): CertPropSvc
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\System32\certprop.dll,-11
      Description: @%SystemRoot%\System32\certprop.dll,-12
      Object name: LocalSystem
      Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 3
      Type: 32
      Error Control: 1
      Depends On services: RpcSs

      Service (registry key): circlass
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Consumer IR Devices
      Image path: \SystemRoot\system32\drivers\circlass.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): CLFS
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Common Log (CLFS)
      Description: Common Log (CLFS)
      Image path: System32\CLFS.sys
      Image size: 247352
      Image MD5: 465745561C832B29F7C48B488AAB3842
      Control Set: CurrentControlSet
      Start: 0
      Type: 1
      Error Control: 3

      Service (registry key): clr_optimization_v2.0.50727_32
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Microsoft .NET Framework NGEN v2.0.50727_X86
      Description: Microsoft .NET Framework NGEN
      Object name: LocalSystem
      Image path: %systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
      Image size: 69632
      Image MD5: D87ACAED61E417BBA546CED5E7E36D9C
      Control Set: CurrentControlSet
      Start: 3
      Type: 16
      Error Control: 0

      Service (registry key): cmdide
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Image path: \SystemRoot\system32\drivers\cmdide.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 3

      Service (registry key): Compbatt
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Microsoft Composite Battery Driver
      Image path: \SystemRoot\system32\drivers\compbatt.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 3

      Service (registry key): COMSysApp
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @comres.dll,-947
      Description: @comres.dll,-948
      Object name: LocalSystem
      Image path: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
      Image size: 7168
      Image MD5: BE01E566D1F569AAB32D0335613E1EEA
      Control Set: CurrentControlSet
      Start: 3
      Type: 16
      Error Control: 1
      Depends On services: RpcSs,EventSystem,SENS

      Service (registry key): crcdisk
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Crcdisk Filter Driver
      Image path: system32\drivers\crcdisk.sys
      Image size: 22632
      Image MD5: 2A213AE086BBEC5E937553C7D9A2B22C
      Control Set: CurrentControlSet
      Start: 0
      Type: 1
      Error Control: 1

      Service (registry key): Crusoe
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Transmeta Crusoe Processor Driver
      Image path: \SystemRoot\system32\drivers\crusoe.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 4
      Type: 1
      Error Control: 1

      Service (registry key): crypt32
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): CryptSvc
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\cryptsvc.dll,-1001
      Description: @%SystemRoot%\system32\cryptsvc.dll,-1002
      Object name: NT Authority\NetworkService
      Image path: %SystemRoot%\system32\svchost.exe -k NetworkService
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: RpcSs

      Service (registry key): DCLocator
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Control Set: CurrentControlSet
      Start: 0
      Type: 0
      Error Control: 0

      Service (registry key): DcomLaunch
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @oleres.dll,-5012
      Description: @oleres.dll,-5013
      Object name: LocalSystem
      Image path: %SystemRoot%\system32\svchost.exe -k DcomLaunch
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1

      Service (registry key): DfsC
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%systemroot%\system32\drivers\dfsc.sys,-101
      Description: @%systemroot%\system32\drivers\dfsc.sys,-102
      Image path: System32\Drivers\dfsc.sys
      Image size: 75264
      Image MD5: 9E635AE5E8AD93E2B5989E2E23679F97
      Control Set: CurrentControlSet
      Start: 1
      Type: 2
      Error Control: 1
      Depends On services: Mup

      Service (registry key): DFSR
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @dfsrres.dll,-101
      Description: @dfsrres.dll,-102
      Object name: LocalSystem
      Image path: %SystemRoot%\system32\DFSR.exe
      Image size: 2091520
      Image MD5: FA3463F25F9CC9C3BCF1E7912FEFF099
      Control Set: CurrentControlSet
      Start: 3
      Type: 16
      Error Control: 1
      Depends On services: RpcSs,EventSystem

      Service (registry key): Dhcp
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\system32\dhcpcsvc.dll,-100
      Description: @%SystemRoot%\system32\dhcpcsvc.dll,-101
      Object name: NT Authority\LocalService
      Image path: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: NSI,Tdx,Afd

      Service (registry key): disk
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Pilote de disque
      Image path: system32\drivers\disk.sys
      Image size: 55352
      Image MD5: 64109E623ABD6955C8FB110B592E68B7
      Control Set: CurrentControlSet
      Start: 0
      Type: 1
      Error Control: 1

      Service (registry key): Dnscache
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%SystemRoot%\System32\dnsapi.dll,-101
      Description: @%SystemRoot%\System32\dnsapi.dll,-102
      Object name: NT AUTHORITY\NetworkService
      Image path: %SystemRoot%\system32\svchost.exe -k NetworkService
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1
      Depends On services: Tdx

      Service (registry key): dot3svc
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%systemroot%\system32\dot3svc.dll,-1102
      Description: @%systemroot%\system32\dot3svc.dll,-1103
      Object name: localSystem
      Image path: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 3
      Type: 32
      Error Control: 1
      Depends On services: RpcSs,Ndisuio,Eaphost

      Service (registry key): DPS
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%systemroot%\system32\dps.dll,-500
      Description: @%systemroot%\system32\dps.dll,-501
      Object name: NT AUTHORITY\LocalService
      Image path: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 2
      Type: 32
      Error Control: 1

      Service (registry key): drmkaud
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Filtre de décodeur DRM (Noyau Microsoft)
      Image path: system32\drivers\drmkaud.sys
      Image size: 5632
      Image MD5: 97FEF831AB90BEE128C9AF390E243F80
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): DXGKrnl
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: LDDM Graphics Subsystem
      Description: Controls the underlying video driver stacks to provide fully-featured display capabilities.
      Image path: \SystemRoot\System32\drivers\dxgkrnl.sys
      Image size: 0
      Image MD5: D41D8CD98F00B204E9800998ECF8427E
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 0

      Service (registry key): E1G60
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: Intel(R) PRO/1000 NDIS 6 Adapter Driver
      Image path: system32\DRIVERS\E1G60I32.sys
      Image size: 117760
      Image MD5: F88FB26547FD2CE6D0A5AF2985892C48
      Control Set: CurrentControlSet
      Start: 3
      Type: 1
      Error Control: 1

      Service (registry key): EapHost
      Registry path: \SYSTEM\CurrentControlSet\Services\
      Display name: @%systemroot%\system32\eapsvc.dll,-1
      Description: @%systemroot%\system32\eapsvc.dll,-2
      Object name: localSystem
      Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
      Image size: 21504
      Image MD5: 3794B461C45882E06856F282EEF025AF
      Control Set: CurrentControlSet
      Start: 3
      Type: 32
      Error Control: 1
      Depends On services: RPCSS,KeyIso

      Service (registry key): Ecache
      Registry
      1. Utilisateur anonyme
        j'ai l'impression que antivir n'est pas à jour
        fais une mise à jour et fait lui faire un scan complet mais avant tou configure le de manière suivante :

        Configuration de Antivir :

        clic droit sur son icône dans la barre des taches et sélectionner Configurer Antivir.

        cocher la case : Mode Expert.

        => Cliquer sur Scanner dans le volet de gauche :

        > Dans "Fichiers" sélectionner Tous les fichiers.

        > Dans procédure de recherche, cocher Autoriser l'arrêt, et dans "priorité scanner" sélectionner Elevé.

        > Dans "Autres réglages" cocher toutes les cases.

        NE SURTOUT PAS OUBLIER LA RECHERCHE DES ROOTKIT QUI EST TRES IMPORTANTE !

        => Cliquer sur "Recherche" dans le volet de gauche et appliquer les mêmes paramètres que précédemment.

        => Dérouler "Recherche" en cliquant sur le +. Cliquer sur "Heuristique" :

        > Cocher "Heuristique de MacroVirus" et "Heuristique fichier Win32" avec degré d'indentification ELEVE !

        => Dans le volet de gauche, dérouler "Guard" puis dérouler "Recherche" :

        > Cocher "Heuristique de MacroVirus" et "Heuristique fichier Win32" avec degré d'identification ELEVE !

        n'oublie pas de poster son rapport
        3. bleurk Auteur
          Avira AntiVir Personal
          Date de création du fichier de rapport : mercredi 8 juillet 2009 20:16

          La recherche porte sur 1475195 souches de virus.

          Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus
          Numéro de série : 0000149996-ADJIE-0000001
          Plateforme : Windows Vista
          Version de Windows : (Service Pack 1) [6.0.6001]
          Mode Boot : Démarré normalement
          Identifiant : SYSTEM
          Nom de l'ordinateur : PC-DE-JOHNNY

          Informations de version :
          BUILD.DAT : 9.0.0.65 17959 Bytes 22/04/2009 12:06:00
          AVSCAN.EXE : 9.0.3.6 466689 Bytes 21/04/2009 12:20:54
          AVSCAN.DLL : 9.0.3.0 49409 Bytes 03/03/2009 09:21:02
          LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:11
          LUKERES.DLL : 9.0.2.0 13569 Bytes 03/03/2009 09:21:31
          ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
          ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 24/06/2009 09:04:39
          ANTIVIR2.VDF : 7.1.4.173 306688 Bytes 02/07/2009 18:28:44
          ANTIVIR3.VDF : 7.1.4.197 430592 Bytes 07/07/2009 18:28:32
          Version du moteur : 8.2.0.204
          AEVDF.DLL : 8.1.1.1 106868 Bytes 01/05/2009 06:40:48
          AESCRIPT.DLL : 8.1.2.13 426362 Bytes 02/07/2009 18:29:24
          AESCN.DLL : 8.1.2.3 127347 Bytes 15/05/2009 17:50:23
          AERDL.DLL : 8.1.2.2 438642 Bytes 02/07/2009 18:29:17
          AEPACK.DLL : 8.1.3.18 401783 Bytes 27/05/2009 18:38:12
          AEOFFICE.DLL : 8.1.0.38 196987 Bytes 17/06/2009 18:35:46
          AEHEUR.DLL : 8.1.0.137 1823095 Bytes 27/06/2009 09:01:50
          AEHELP.DLL : 8.1.3.6 205174 Bytes 11/06/2009 17:34:17
          AEGEN.DLL : 8.1.1.48 348532 Bytes 02/07/2009 18:29:06
          AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 13:32:40
          AECORE.DLL : 8.1.6.12 180599 Bytes 27/05/2009 18:38:11
          AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 13:32:40
          AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:30
          AVPREF.DLL : 9.0.0.1 43777 Bytes 03/12/2008 10:39:26
          AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 13:34:28
          AVREG.DLL : 9.0.0.0 36609 Bytes 07/11/2008 14:24:42
          AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:22
          AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:36:37
          SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
          SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 07:20:57
          NETNT.DLL : 9.0.0.0 11521 Bytes 07/11/2008 14:40:59
          RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 17/02/2009 12:49:32
          RCTEXT.DLL : 9.0.37.0 88321 Bytes 15/04/2009 09:07:05

          Configuration pour la recherche actuelle :
          Nom de la tâche...............................: Contrôle intégral du système
          Fichier de configuration......................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
          Documentation.................................: bas
          Action principale.............................: interactif
          Action secondaire.............................: ignorer
          Recherche sur les secteurs d'amorçage maître..: marche
          Recherche sur les secteurs d'amorçage.........: marche
          Secteurs d'amorçage...........................: C:, D:,
          Recherche dans les programmes actifs..........: marche
          Recherche en cours sur l'enregistrement.......: marche
          Recherche de Rootkits.........................: marche
          Contrôle d'intégrité de fichiers système......: marche
          Recherche optimisée...........................: marche
          Fichier mode de recherche.....................: Tous les fichiers
          Recherche sur les archives....................: marche
          Limiter la profondeur de récursivité..........: 20
          Archive Smart Extensions......................: marche
          Heuristique de macrovirus.....................: marche
          Heuristique fichier...........................: moyen
          Catégories de dangers divergentes.............: +APPL,+GAME,+JOKE,+PCK,+SPR,

          Début de la recherche : mercredi 8 juillet 2009 20:16

          Début du contrôle des fichiers système :
          Signé -> 'C:\Windows\system32\svchost.exe'
          Signé -> 'C:\Windows\system32\winlogon.exe'
          Signé -> 'C:\Windows\explorer.exe'
          Signé -> 'C:\Windows\system32\smss.exe'
          Signé -> 'C:\Windows\system32\wininet.DLL'
          Signé -> 'C:\Windows\system32\wsock32.DLL'
          Signé -> 'C:\Windows\system32\ws2_32.DLL'
          Signé -> 'C:\Windows\system32\services.exe'
          Signé -> 'C:\Windows\system32\lsass.exe'
          Signé -> 'C:\Windows\system32\csrss.exe'
          Signé -> 'C:\Windows\system32\drivers\kbdclass.sys'
          Signé -> 'C:\Windows\system32\spoolsv.exe'
          Signé -> 'C:\Windows\system32\alg.exe'
          Signé -> 'C:\Windows\system32\wuauclt.exe'
          Signé -> 'C:\Windows\system32\advapi32.DLL'
          Signé -> 'C:\Windows\system32\user32.DLL'
          Signé -> 'C:\Windows\system32\gdi32.DLL'
          Signé -> 'C:\Windows\system32\kernel32.DLL'
          Signé -> 'C:\Windows\system32\ntdll.DLL'
          Signé -> 'C:\Windows\system32\ntoskrnl.exe'
          Signé -> 'C:\Windows\system32\ctfmon.exe'
          Les fichiers système ont été contrôlés ('21' fichiers)

          La recherche d'objets cachés commence.
          HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msqpdxserv.sys\modules
          [INFO] L'entrée d'enregistrement n'est pas visible.
          HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msqpdxserv.sys\start
          [INFO] L'entrée d'enregistrement n'est pas visible.
          HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msqpdxserv.sys\type
          [INFO] L'entrée d'enregistrement n'est pas visible.
          HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msqpdxserv.sys\imagepath
          [INFO] L'entrée d'enregistrement n'est pas visible.
          HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msqpdxserv.sys\group
          [INFO] L'entrée d'enregistrement n'est pas visible.
          '101092' objets ont été contrôlés, '5' objets cachés ont été trouvés.

          La recherche sur les processus démarrés commence :
          Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'firefox.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'notepad.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'mobsync.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'wlcomm.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'msnmsgr.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'a2service.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'conime.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'uTorrent.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'WmiPrvSE.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'sidebar.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'iPodService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ehmsas.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'PDFCreator.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'TeaTimer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'GoogleToolbarNotifier.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'msgrsrch.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ehtray.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'sidebar.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'fsesgui.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'iTunesHelper.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'GrooveMonitor.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'WUDFHost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'SDWinSec.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'SearchIndexer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'PnkBstrB.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'PnkBstrA.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'AluSchedulerSvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'NBService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'LVComSer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'LVPrcSrv.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'LVComSer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'PIFSvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'LSSrvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'fsessrv.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'mDNSResponder.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'AppleMobileDeviceService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'taskeng.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'taskeng.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'dwm.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'SLsvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'audiodg.exe' - '0' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'lsm.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'wininit.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
          '71' processus ont été contrôlés avec '71' modules

          La recherche sur les secteurs d'amorçage maître commence :
          Secteur d'amorçage maître HD0
          [INFO] Aucun virus trouvé !
          Secteur d'amorçage maître HD1
          [INFO] Aucun virus trouvé !
          [INFO] Veuillez relancer la recherche avec les droits d'administrateur

          La recherche sur les secteurs d'amorçage commence :
          Secteur d'amorçage 'C:\'
          [INFO] Aucun virus trouvé !
          Secteur d'amorçage 'D:\'
          [INFO] Aucun virus trouvé !

          La recherche sur les renvois aux fichiers exécutables (registre) commence :
          Le registre a été contrôlé ( '43' fichiers).

          La recherche sur les fichiers sélectionnés commence :

          Recherche débutant dans 'C:\' <HP>
          C:\hiberfil.sys
          [AVERTISSEMENT] Impossible d'ouvrir le fichier !
          [REMARQUE] Ce fichier est un fichier système Windows.
          [REMARQUE] Il est correct que ce fichier ne puisse pas être ouvert pour la recherche.
          C:\pagefile.sys
          [AVERTISSEMENT] Impossible d'ouvrir le fichier !
          [REMARQUE] Ce fichier est un fichier système Windows.
          [REMARQUE] Il est correct que ce fichier ne puisse pas être ouvert pour la recherche.
          C:\Windows\System32\drivers\sptd.sys
          [AVERTISSEMENT] Impossible d'ouvrir le fichier !
          Recherche débutant dans 'D:\' <Recovery>

          Fin de la recherche : mercredi 8 juillet 2009 21:25
          Temps nécessaire: 1:08:48 Heure(s)

          La recherche a été effectuée intégralement

          25168 Les répertoires ont été contrôlés
          498441 Des fichiers ont été contrôlés
          0 Des virus ou programmes indésirables ont été trouvés
          0 Des fichiers ont été classés comme suspects
          0 Des fichiers ont été supprimés
          0 Des virus ou programmes indésirables ont été réparés
          0 Les fichiers ont été déplacés dans la quarantaine
          0 Les fichiers ont été renommés
          3 Impossible de contrôler des fichiers
          498438 Fichiers non infectés
          4595 Les archives ont été contrôlées
          3 Avertissements
          2 Consignes
          101092 Des objets ont été contrôlés lors du Rootkitscan
          5 Des objets cachés ont été trouvés
          1. Utilisateur anonyme
            Télécharge Ccleaner sur ton Bureau, il y a 5 objets cachés dans ton registre :

            https://forums.cnetfrance.fr/tutoriels-logiciels-et-applis/7669-ccleaner-telecharger-et-utiliser

            * Clique sur "download the latest version"
            * Installe-le en laissant seulement les options suivantes cochées :

            - Ajouter un raccourci sur le Bureau
            - Contrôler automatiquement les mises à jour de CCleaner

            * Lance le Nettoyage
            * Clique sur Chercher des erreurs et sauvegarde si tu le souhaites.

            tuto Comment utiliser CCleaner.

            http://www.infos-du-net.com/forum/272336-7-aide-ccleaner
            1. bleurk Auteur
              bonjour, après lancement de Ccleaner, j'ai relancer Spybots, toujours le même problème! voici le rapport

              --- Search result list ---
              Win32.TDSS.reg: [SBI $2867D4A5] Réglages (Modification du registre, fixing failed)
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules\msqpdxserv

              Win32.TDSS.reg: [SBI $EDA68CC2] Réglages (Modification du registre, fixing failed)
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules\msqpdxserv

              Win32.TDSS.reg: [SBI $667311C3] Réglages (Modification du registre, fixing failed)
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msqpdxserv.sys\modules\msqpdxl

              Win32.TDSS.reg: [SBI $99E026E5] Réglages (Modification du registre, fixing failed)
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules\msqpdxl

              --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

              2009-01-26 blindman.exe (1.0.0.8)
              2008-01-28 SDDelFile.exe (1.0.2.4)
              2009-01-26 SDFiles.exe (1.6.1.7)
              2009-01-26 SDMain.exe (1.0.0.6)
              2009-01-26 SDShred.exe (1.0.2.5)
              2009-01-26 SDUpdate.exe (1.6.0.12)
              2009-01-26 SDWinSec.exe (1.0.0.12)
              2009-01-26 SpybotSD.exe (1.6.2.46)
              2009-03-05 TeaTimer.exe (1.6.6.32)
              2009-03-30 unins000.exe (51.49.0.0)
              2009-01-26 Update.exe (1.6.0.7)
              2009-01-26 advcheck.dll (1.6.2.15)
              2007-04-02 aports.dll (2.1.0.0)
              2008-06-14 DelZip179.dll (1.79.11.1)
              2009-01-26 SDHelper.dll (1.6.2.14)
              2008-06-19 sqlite3.dll
              2008-10-22 Tools.dll (2.1.6.8)
              2009-01-16 UninsSrv.dll (1.0.0.0)
              2009-05-19 Includes\Adware.sbi (*)
              2009-06-02 Includes\AdwareC.sbi (*)
              2009-01-22 Includes\Cookies.sbi (*)
              2009-05-19 Includes\Dialer.sbi (*)
              2009-06-02 Includes\DialerC.sbi (*)
              2009-01-22 Includes\HeavyDuty.sbi (*)
              2009-05-26 Includes\Hijackers.sbi (*)
              2009-06-23 Includes\HijackersC.sbi (*)
              2009-06-23 Includes\Keyloggers.sbi (*)
              2009-06-30 Includes\KeyloggersC.sbi (*)
              2004-11-29 Includes\LSP.sbi (*)
              2009-06-30 Includes\Malware.sbi (*)
              2009-06-30 Includes\MalwareC.sbi (*)
              2009-03-25 Includes\PUPS.sbi (*)
              2009-06-30 Includes\PUPSC.sbi (*)
              2009-01-22 Includes\Revision.sbi (*)
              2009-01-13 Includes\Security.sbi (*)
              2009-06-02 Includes\SecurityC.sbi (*)
              2008-06-03 Includes\Spybots.sbi (*)
              2008-06-03 Includes\SpybotsC.sbi (*)
              2009-04-07 Includes\Spyware.sbi (*)
              2009-06-02 Includes\SpywareC.sbi (*)
              2009-06-08 Includes\Tracks.uti
              2009-06-17 Includes\Trojans.sbi (*)
              2009-06-30 Includes\TrojansC.sbi (*)
              2008-03-04 Plugins\Chai.dll
              2008-03-05 Plugins\Fennel.dll
              2008-02-26 Plugins\Mate.dll
              2008-12-24 Plugins\TCPIPAddress.dll

              --- System information ---
              Windows Vista (Build: 6001) Service Pack 1 (6.0.6001)

              --- Startup entries list ---
              Located: HK_LM:Run, Adobe Reader Speed Launcher
              command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
              size: 39792
              MD5: 392845E8D49B5F0E81AAC4D795000A8C

              Located: HK_LM:Run, avgnt
              command: "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
              file: C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
              size: 209153
              MD5: 29680A793F690EEF4AAA68479D2A6DF8

              Located: HK_LM:Run, F-Secure ExploitShield
              command: "C:\Program Files\F-Secure\ExploitShield\fsesgui.exe"
              file: C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
              size: 629376
              MD5: C3195D1010CE4EE40219566DC2135268

              Located: HK_LM:Run, GrooveMonitor
              command: "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
              file: C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
              size: 31072
              MD5: 644795F6985C740F5E36E9336B837D0B

              Located: HK_LM:Run, iTunesHelper
              command: "C:\Program Files\iTunes\iTunesHelper.exe"
              file: C:\Program Files\iTunes\iTunesHelper.exe
              size: 292136
              MD5: 9D4F3923F8D3A13F2FEADB66C62FE5D0

              Located: HK_LM:Run, QuickTime Task
              command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
              file: C:\Program Files\QuickTime\QTTask.exe
              size: 413696
              MD5: FABAD2BFD44661D8CC627E5485BFAFAF

              Located: HK_LM:RunOnce, Launcher
              command: %WINDIR%\SMINST\launcher.exe
              file: C:\Windows\SMINST\launcher.exe
              size: 44168
              MD5: 31539595F006DAE39F719735F30C3570

              Located: HK_CU:Run, ehTray.exe
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: C:\Windows\ehome\ehTray.exe
              file: C:\Windows\ehome\ehTray.exe
              size: 125952
              MD5: BF08674925F151BD4537B89A493E3E0C

              Located: HK_CU:Run, ISUSPM Startup
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
              file: C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
              size: 249856
              MD5: 1C46FC1AB600766B8554580204806E84

              Located: HK_CU:Run, LDM
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
              file: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
              size: 36864
              MD5: 75A8679F5D996D286FC8649E74394B79

              Located: HK_CU:Run, msnlivesearch
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
              file: C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
              size: 49152
              MD5: BEB9FB770075D484ACFB2645EB788527

              Located: HK_CU:Run, Sidebar
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
              file: C:\Program Files\Windows Sidebar\sidebar.exe
              size: 1233920
              MD5: FD278E51A7D6F52D22FCE6C67E037AD6

              Located: HK_CU:Run, SpybotSD TeaTimer
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              size: 2260480
              MD5: 390679F7A217A5E73D756276C40AE887

              Located: HK_CU:Run, swg
              where: S-1-5-21-3603102019-2234686749-2930555637-1000...
              command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              size: 39408
              MD5: 5D61BE7DB55B026A5D61A3EED09D0EAD

              Located: Démarrage (tous utilisateurs), Logitech Desktop Messenger.lnk
              where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
              command: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
              file: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
              size: 196608
              MD5: 6F2E5108667BF1149D884E3CBEB9CDD1

              Located: Démarrage (tous utilisateurs), PDFCreator.lnk
              where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
              command: C:\Program Files\PDFCreator\PDFCreator.exe
              file: C:\Program Files\PDFCreator\PDFCreator.exe
              size: 2641920
              MD5: 4DB47E14FF62720ADA91BE1E40226ACF

              Located: Démarrage (utilisateur), Adobe Gamma.lnk
              where: C:\Users\johnny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup...
              command: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
              file: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
              size: 113664
              MD5: C2FF17734176CD15221C10044EF0BA1A

              --- Browser helper object list ---
              {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name: Download Manager Browser Helper Object
              Path: C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\
              Long name: XEBDLHelper.dll
              Short name: XEBDLH~1.DLL
              Date (created): 21/05/2007 11:34:48
              Date (last access): 15/10/2007 13:54:34
              Date (last write): 21/05/2007 11:34:48
              Filesize: 525792
              Attributes: archive
              MD5: FD850334FE0EAC8B286235996E533B10
              CRC32: E6717AAB
              Version: 1.0.0.14

              {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name: SWEETIE
              CLSID name:

              {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (WormRadar.com IESiteBlocker.NavFilter)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name: WormRadar.com IESiteBlocker.NavFilter
              CLSID name:

              {5C255C8A-E604-49b4-9D64-90988571CECB} ()
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name:

              {64F56FC1-1272-44CD-BA6E-39723696E350} (EoRezoBHO)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name: EoRezoBHO
              CLSID name:

              {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (Groove GFS Browser Helper)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name: Groove GFS Browser Helper
              Path: C:\Program Files\Microsoft Office\Office12\
              Long name: GrooveShellExtensions.dll
              Short name: GRA8E1~1.DLL
              Date (created): 12/02/2009 15:19:32
              Date (last access): 01/05/2009 10:21:28
              Date (last write): 12/02/2009 15:19:32
              Filesize: 2217848
              Attributes: archive
              MD5: A6B5A41C0ED007AB6C43CAD899E533D8
              CRC32: BA078F79
              Version: 12.0.6421.1000

              {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name: Programme d'aide de l'Assistant de connexion Windows Live
              Path: C:\Program Files\Common Files\Microsoft Shared\Windows Live\
              Long name: WindowsLiveLogin.dll
              Short name: WINDOW~1.DLL
              Date (created): 22/01/2009 16:41:30
              Date (last access): 18/02/2009 16:20:22
              Date (last write): 22/01/2009 16:41:30
              Filesize: 408448
              Attributes: archive
              MD5: B7899C3E21B299D7A3C0DA96CAE340BD
              CRC32: 288935F8
              Version: 5.0.818.5

              {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name: Google Toolbar Helper
              description: Google toolbar
              classification: Open for discussion
              known filename: googletoolbar.dll<br>googletoolbar*.dll<br>(* = number)<br>googletoolbar_en_*.**-big.dll<br>Googletoolbar_en_*.*.**-deleon.dll
              info link: http://www.google.com/intl/fr/toolbar/ie/index.html
              info source: TonyKlein
              Path: C:\Program Files\Google\Google Toolbar\
              Long name: GoogleToolbar.dll
              Short name: GOOGLE~1.DLL
              Date (created): 14/01/2009 14:31:22
              Date (last access): 14/01/2009 14:31:22
              Date (last write): 14/01/2009 14:30:30
              Filesize: 251504
              Attributes: archive
              MD5: 105EBC389FEB20A5A6DE47316001B7F1
              CRC32: 3760EC78

              {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name: Google Toolbar Notifier BHO
              Path: C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\
              Long name: swg.dll
              Short name:
              Date (created): 08/07/2009 20:53:46
              Date (last access): 08/07/2009 20:53:46
              Date (last write): 08/07/2009 20:53:46
              Filesize: 669168
              Attributes: archive
              MD5: 7C987CAB519BC858FD4DBB6B40EE4BD2
              CRC32: 2CC83660
              Version: 5.1.1309.15642

              {C7B76B90-3455-4AE6-A752-EAC4D19689E5} (EoBHO)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name: EoBHO
              CLSID name:

              {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (Google Dictionary Compression sdch)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name: Google Dictionary Compression sdch
              CLSID name: Google Dictionary Compression sdch
              Path: C:\Program Files\Google\Google Toolbar\Component\
              Long name: fastsearch_219B3E1547538286.dll
              Short name: FASTSE~1.DLL
              Date (created): 14/01/2009 14:30:26
              Date (last access): 14/01/2009 14:30:26
              Date (last write): 14/01/2009 14:30:26
              Filesize: 522224
              Attributes: archive
              MD5: E27153F524C86807079F62550094B073
              CRC32: E181FF40
              Version: 1.0.610.10250

              {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java(tm) Plug-In 2 SSV Helper)
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name: Java(tm) Plug-In 2 SSV Helper
              Path: C:\Program Files\Java\jre6\bin\
              Long name: jp2ssv.dll
              Short name:
              Date (created): 26/11/2008 14:02:44
              Date (last access): 10/11/2008 04:39:26
              Date (last write): 10/11/2008 06:43:16
              Filesize: 34816
              Attributes: archive
              MD5: 5D57FD3DF32DC69CEC3D1D54B4C43162
              CRC32: D7C13FB2
              Version: 6.0.110.3

              {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} ()
              location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
              BHO name:
              CLSID name:

              --- ActiveX list ---
              {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool)
              DPF name:
              CLSID name: MSN Photo Upload Tool
              Installer: C:\Windows\Downloaded Program Files\MSNPUpld.inf
              Codebase: http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
              description:
              classification: Legitimate
              known filename: MsnPUpld.dll
              info link:
              info source: Safer Networking Ltd.
              Path: C:\Windows\Downloaded Program Files\
              Long name: MsnPUpld.dll
              Short name:
              Date (created): 20/11/2006 11:04:16
              Date (last access): 20/11/2006 11:04:16
              Date (last write): 20/11/2006 11:04:16
              Filesize: 543544
              Attributes: archive
              MD5: A0F541D9D2CACEEC7A4A378CD0C31626
              CRC32: 035C591F
              Version: 10.0.914.0

              {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()
              DPF name:
              CLSID name:
              Installer: C:\Windows\Downloaded Program Files\erma.inf
              Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
              description:
              classification: Open for discussion
              known filename:
              info link:
              info source: Safer Networking Ltd.

              {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
              DPF name: Java Runtime Environment 1.6.0
              CLSID name: Java Plug-in 1.6.0_11
              Installer:
              Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
              description:
              classification: Legitimate
              known filename: npjpi150_06.dll
              info link:
              info source: Safer Networking Ltd.
              Path: C:\Program Files\Java\jre6\bin\
              Long name: npjpi160_11.dll
              Short name: NPJPI1~1.DLL
              Date (created): 10/11/2008 04:39:26
              Date (last access): 10/11/2072 04:39:26
              Date (last write): 10/11/2008 06:43:32
              Filesize: 132504
              Attributes: archive
              MD5: D400116F6776ACB6EDB6B1F5EEB9F92D
              CRC32: CECB5751
              Version: 6.0.110.3

              --- Process list ---
              PID: 1816 (1176) C:\Windows\system32\Dwm.exe
              size: 81920
              MD5: 59903071D7ACE6A02093C47E9E38AF97
              PID: 1840 (1800) C:\Windows\Explorer.EXE
              size: 2927104
              MD5: 4F554999D7D5F05DAAEBBA7B5BA1089D
              PID: 1980 (1208) C:\Windows\system32\taskeng.exe
              size: 169472
              MD5: 5F109032CE46B7184ED9E50F9FE8489E
              PID: 2160 (2084) C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
              size: 186904
              MD5: 38440FE1A65B1FE3D246C5C4CAD22F53
              PID: 3348 (1840) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
              size: 209153
              MD5: 29680A793F690EEF4AAA68479D2A6DF8
              PID: 3456 (1840) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
              size: 31072
              MD5: 644795F6985C740F5E36E9336B837D0B
              PID: 3532 (1840) C:\Program Files\iTunes\iTunesHelper.exe
              size: 292136
              MD5: 9D4F3923F8D3A13F2FEADB66C62FE5D0
              PID: 3560 (1840) C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
              size: 629376
              MD5: C3195D1010CE4EE40219566DC2135268
              PID: 3592 (1840) C:\Program Files\Windows Sidebar\sidebar.exe
              size: 1233920
              MD5: FD278E51A7D6F52D22FCE6C67E037AD6
              PID: 3604 (1840) C:\Windows\ehome\ehtray.exe
              size: 125952
              MD5: BF08674925F151BD4537B89A493E3E0C
              PID: 3652 (1840) C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
              size: 49152
              MD5: BEB9FB770075D484ACFB2645EB788527
              PID: 3764 (1840) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              size: 39408
              MD5: 5D61BE7DB55B026A5D61A3EED09D0EAD
              PID: 3780 ( 856) C:\Windows\ehome\ehmsas.exe
              size: 37376
              MD5: 0F4195B9B348DE5CF9B822F81704B20E
              PID: 3808 (1840) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              size: 2260480
              MD5: 390679F7A217A5E73D756276C40AE887
              PID: 3868 (1840) C:\Program Files\PDFCreator\PDFCreator.exe
              size: 2641920
              MD5: 4DB47E14FF62720ADA91BE1E40226ACF
              PID: 2404 ( 856) C:\Windows\System32\mobsync.exe
              size: 95744
              MD5: 9B89B3BB79EA1ACF041F40A7B6FC5827
              PID: 1108 (3592) C:\Program Files\Windows Sidebar\sidebar.exe
              size: 1233920
              MD5: FD278E51A7D6F52D22FCE6C67E037AD6
              PID: 2276 ( 856) C:\Windows\system32\wbem\unsecapp.exe
              size: 37888
              MD5: 25873356E52849C3F5B3F1B02317E8C8
              PID: 5652 (1840) C:\Program Files\Mozilla Firefox\firefox.exe
              size: 307704
              MD5: 26C3F01DF1B1AA6CFEC22D75F1E072F9
              PID: 5500 (1840) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
              size: 5365592
              MD5: 0477C2F9171599CA5BC3307FDFBA8D89
              PID: 2260 ( 856) C:\Windows\system32\DllHost.exe
              size: 7168
              MD5: BE01E566D1F569AAB32D0335613E1EEA
              PID: 6044 ( 856) C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
              size: 14456
              MD5: B7A2FBBEB343CC841BB2A0E846455769
              PID: 0 ( 0) [System Process]
              PID: 4 ( 0) System
              PID: 520 ( 4) smss.exe
              size: 64000
              PID: 596 ( 584) csrss.exe
              size: 6144
              PID: 648 ( 584) wininit.exe
              size: 96768
              PID: 660 ( 640) csrss.exe
              size: 6144
              PID: 696 ( 648) services.exe
              size: 279040
              PID: 712 ( 648) lsass.exe
              size: 9728
              PID: 720 ( 648) lsm.exe
              size: 229888
              PID: 856 ( 696) svchost.exe
              size: 21504
              PID: 892 ( 640) winlogon.exe
              size: 314880
              PID: 980 ( 696) svchost.exe
              size: 21504
              PID: 1020 ( 696) svchost.exe
              size: 21504
              PID: 1112 ( 696) svchost.exe
              size: 21504
              PID: 1176 ( 696) svchost.exe
              size: 21504
              PID: 1208 ( 696) svchost.exe
              size: 21504
              PID: 1272 (1112) audiodg.exe
              size: 88064
              PID: 1296 ( 696) svchost.exe
              size: 21504
              PID: 1320 ( 696) SLsvc.exe
              size: 2623488
              PID: 1364 ( 696) svchost.exe
              size: 21504
              PID: 1484 ( 696) svchost.exe
              size: 21504
              PID: 1948 ( 696) spoolsv.exe
              size: 125952
              PID: 1972 ( 696) sched.exe
              PID: 1992 ( 696) svchost.exe
              size: 21504
              PID: 532 (1208) taskeng.exe
              size: 169472
              PID: 2000 ( 696) a2service.exe
              PID: 12 ( 696) avguard.exe
              PID: 1756 ( 696) AppleMobileDeviceService.exe
              PID: 1748 ( 696) mDNSResponder.exe
              PID: 1344 ( 696) fsessrv.exe
              PID: 752 ( 696) LSSrvc.exe
              PID: 1292 ( 696) PIFSvc.exe
              PID: 2084 ( 696) LVComSer.exe
              PID: 2116 ( 696) LVPrcSrv.exe
              PID: 2140 ( 696) NBService.exe
              PID: 2204 ( 696) AluSchedulerSvc.exe
              PID: 2296 ( 696) PnkBstrA.exe
              size: 66872
              PID: 2308 ( 696) PnkBstrB.exe
              size: 107832
              PID: 2324 ( 696) svchost.exe
              size: 21504
              PID: 2340 ( 696) svchost.exe
              size: 21504
              PID: 2392 ( 696) svchost.exe
              size: 21504
              PID: 2424 ( 696) SearchIndexer.exe
              size: 439808
              PID: 2524 ( 696) SDWinSec.exe
              PID: 2640 (1176) WUDFHost.exe
              size: 142336
              PID: 3304 ( 696) svchost.exe
              size: 21504
              PID: 3100 ( 696) iPodService.exe
              PID: 2692 ( 856) WmiPrvSE.exe
              PID: 4336 ( 208) conime.exe
              size: 69120
              PID: 4172 (1208) taskeng.exe
              size: 169472
              PID: 6136 ( 696) VSSVC.exe
              size: 1054720
              PID: 1532 ( 696) svchost.exe
              size: 21504
              PID: 1724 (2424) SearchProtocolHost.exe
              size: 184832
              PID: 2728 (2424) SearchFilterHost.exe
              size: 87552

              --- Browser start & search pages list ---
              Spybot - Search & Destroy browser pages report, 09/07/2009 14:57:14

              HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
              C:\Windows\system32\blank.htm
              HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
              https://www.google.fr/?gws_rd=ssl
              HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
              https://www.msn.com/fr-fr/?ocid=iehp
              HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
              http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
              C:\Windows\System32\blank.htm
              HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
              https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
              https://www.msn.com/fr-fr/
              HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
              https://www.msn.com/fr-fr/?ocid=iehp
              HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
              https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

              --- Winsock Layered Service Provider list ---
              Namespace Provider 1: Fournisseur Shim d'affectation de noms de messagerie
              GUID: {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE}
              Filename:

              Namespace Provider 2: Fournisseur d'espace de noms du nuage PNRP
              GUID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D}
              Filename:

              Namespace Provider 3: Fournisseur d'espace de noms du nom PNRP
              GUID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D}
              Filename:

              --- Uninstall list ---

              --- System Services ---
              Service (registry key): .NET CLR Data
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): .NET CLR Networking
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): .NET Data Provider for Oracle
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): .NET Data Provider for SqlServer
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): .NETFramework
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): 61883
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Pilote d'unité 61883
              Image path: system32\DRIVERS\61883.sys
              Image size: 45696
              Image MD5: 585E64BB6DFBC0A2F1F0B554DED012DF
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): a2free
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: a-squared Free Service
              Description: Scans the PC for unwanted software and provides protection from malicious code
              Object name: LocalSystem
              Image path: "C:\Program Files\a-squared Free\a2service.exe"
              Image size: 718880
              Image MD5: A86B9739EFB314FC13D81A21CC4E5102
              Control Set: CurrentControlSet
              Start: 2
              Type: 16
              Error Control: 1

              Service (registry key): ACPI
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Pilote ACPI Microsoft
              Image path: system32\drivers\acpi.sys
              Image size: 266808
              Image MD5: FCB8C7210F0135E24C6580F7F649C73C
              Control Set: CurrentControlSet
              Start: 0
              Type: 1
              Error Control: 3

              Service (registry key): Adobe LM Service
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Adobe LM Service
              Description: AdobeLM Service
              Object name: LocalSystem
              Image path: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
              Image size: 72704
              Image MD5: 8B46D5A1D3EF08232C04D0EAFB871FB2
              Control Set: CurrentControlSet
              Start: 3
              Type: 16
              Error Control: 1

              Service (registry key): adp94xx
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\adp94xx.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): adpahci
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\adpahci.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): adpu160m
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\adpu160m.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): adpu320
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\adpu320.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): adsi
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): AeLookupSvc
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\aelupsvc.dll,-1
              Description: @%SystemRoot%\system32\aelupsvc.dll,-2
              Object name: localSystem
              Image path: %systemroot%\system32\svchost.exe -k netsvcs
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1

              Service (registry key): AFD
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Ancilliary Function Driver for Winsock
              Description: Ancilliary Function Driver for Winsock
              Image path: \SystemRoot\system32\drivers\afd.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 1
              Type: 1
              Error Control: 1

              Service (registry key): agp440
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Intel AGP Bus Filter
              Image path: \SystemRoot\system32\drivers\agp440.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): aic78xx
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\djsvs.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): ALG
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\Alg.exe,-112
              Description: @%SystemRoot%\system32\Alg.exe,-113
              Object name: NT AUTHORITY\LocalService
              Image path: %SystemRoot%\System32\alg.exe
              Image size: 59392
              Image MD5: A1545B731579895D8CC44FC0481C1192
              Control Set: CurrentControlSet
              Start: 3
              Type: 16
              Error Control: 1

              Service (registry key): aliide
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\aliide.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 3

              Service (registry key): amdagp
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: AMD AGP Bus Filter Driver
              Image path: \SystemRoot\system32\drivers\amdagp.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): amdide
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\amdide.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 3

              Service (registry key): AmdK7
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: AMD K7 Processor Driver
              Image path: \SystemRoot\system32\drivers\amdk7.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): AmdK8
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Pilote de processeur AMD K8
              Image path: system32\DRIVERS\amdk8.sys
              Image size: 44032
              Image MD5: 93AE7F7DD54AB986A6F1A1B37BE7442D
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): AntiVirSchedulerService
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Avira AntiVir Planificateur
              Description: Service de commande des tâches de contrôle et mises à jour Avira AntiVir Personal - Free Antivirus.
              Object name: LocalSystem
              Image path: "C:\Program Files\Avira\AntiVir Desktop\sched.exe"
              Image size: 108289
              Image MD5: 7C98F7A5BDE8A775B7DB9A1E808266D9
              Control Set: CurrentControlSet
              Start: 2
              Type: 16
              Error Control: 1

              Service (registry key): AntiVirService
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Avira AntiVir Guard
              Description: Offre une protection permanente contre les virus et les logiciels malveillants grâce au moteur de recherche AntiVir.
              Object name: LocalSystem
              Image path: "C:\Program Files\Avira\AntiVir Desktop\avguard.exe"
              Image size: 185089
              Image MD5: 81E58F368D62EC818F49D1C5CF3854C3
              Control Set: CurrentControlSet
              Start: 2
              Type: 16
              Error Control: 1

              Service (registry key): Appinfo
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%systemroot%\system32\appinfo.dll,-100
              Description: @%systemroot%\system32\appinfo.dll,-101
              Object name: LocalSystem
              Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 3
              Type: 32
              Error Control: 1
              Depends On services: RpcSs,ProfSvc

              Service (registry key): Apple Mobile Device
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Apple Mobile Device
              Description: Fournit l’interface pour les appareils mobiles Apple.
              Object name: LocalSystem
              Image path: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
              Image size: 144712
              Image MD5: 7E94E567C1AA5ABE6174032B3DAB6C23
              Control Set: CurrentControlSet
              Start: 2
              Type: 16
              Error Control: 1
              Depends On services: Tcpip

              Service (registry key): arc
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\arc.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): arcsas
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\arcsas.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): ASP.NET_1.1.4322
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): AsyncMac
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Pilote de média asynchrone RAS
              Description: Pilote de média asynchrone RAS
              Image path: system32\DRIVERS\asyncmac.sys
              Image size: 17408
              Image MD5: 53B202ABEE6455406254444303E87BE1
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): atapi
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Canal IDE
              Image path: system32\drivers\atapi.sys
              Image size: 21560
              Image MD5: 2D9C903DC76A66813D350A562DE40ED9
              Control Set: CurrentControlSet
              Start: 0
              Type: 1
              Error Control: 3

              Service (registry key): athr
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Atheros Extensible Wireless LAN device driver
              Image path: system32\DRIVERS\athr.sys
              Image size: 952832
              Image MD5: ACDB46B1A467752A2F280C68C8461556
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): AudioEndpointBuilder
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\audiosrv.dll,-204
              Description: @%SystemRoot%\System32\audiosrv.dll,-205
              Object name: LocalSystem
              Image path: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: PlugPlay

              Service (registry key): Audiosrv
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\audiosrv.dll,-200
              Description: @%SystemRoot%\System32\audiosrv.dll,-201
              Object name: NT AUTHORITY\LocalService
              Image path: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: AudioEndpointBuilder,RpcSs,MMCSS

              Service (registry key): Avc
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Périphérique AVC
              Image path: system32\DRIVERS\avc.sys
              Image size: 40448
              Image MD5: F4B56425A00BEB32F5FA6603FF7B0EA2
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): avgio
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: avgio
              Image path: \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 1
              Type: 1
              Error Control: 1
              Depends On services: FltMgr

              Service (registry key): avgntflt
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: avgntflt
              Description: Avira files mini-filter driver
              Image path: system32\DRIVERS\avgntflt.sys
              Image size: 55640
              Image MD5: 76C10D80E46CB79570479CB7CF205D39
              Control Set: CurrentControlSet
              Start: 2
              Type: 2
              Error Control: 1
              Depends On services: FltMgr

              Service (registry key): avipbb
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: avipbb
              Description: Avira's Driver for RootKit Detection
              Image path: system32\DRIVERS\avipbb.sys
              Image size: 96104
              Image MD5: AD9BD66A862116E79CB45BB6BE46055F
              Control Set: CurrentControlSet
              Start: 1
              Type: 1
              Error Control: 1

              Service (registry key): BattC
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): BDFsDrv
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: BDFsDrv
              Image path: \??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): Beep
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Beep
              Control Set: CurrentControlSet
              Start: 1
              Type: 1
              Error Control: 1

              Service (registry key): BFE
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\bfe.dll,-1001
              Description: @%SystemRoot%\system32\bfe.dll,-1002
              Object name: NT AUTHORITY\LocalService
              Image path: %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: RpcSs

              Service (registry key): BITS
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\qmgr.dll,-1000
              Description: @%SystemRoot%\system32\qmgr.dll,-1001
              Object name: LocalSystem
              Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: RpcSs,EventSystem

              Service (registry key): blbdrive
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\blbdrive.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): Bonjour Service
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Service Bonjour
              Description: Bonjour permet à des applications comme iTunes et Safari d’annoncer et de découvrir des services sur le réseau local. En gardant Bonjour en exécution, vous pouvez vous connecter à des périphériques comme l’Apple TV et à des services logiciels comme le partage iTunes et AirTunes. Si vous désactivez Bonjour, tous les services réseau qui en dépendent de manière explicite ne démarreront pas.
              Object name: LocalSystem
              Image path: "C:\Program Files\Bonjour\mDNSResponder.exe"
              Image size: 238888
              Image MD5: 3F56903E124E820AEECE6D471583C6C1
              Control Set: CurrentControlSet
              Start: 2
              Type: 16
              Error Control: 1
              Depends On services: Tcpip

              Service (registry key): Boonty Games
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Boonty Games
              Description: Boonty Games
              Object name: LocalSystem
              Image path: "C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 16
              Error Control: 1

              Service (registry key): bowser
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Bowser
              Description: Implements the datagram receiver for the computer browser browser service.
              Image path: system32\DRIVERS\bowser.sys
              Image size: 69632
              Image MD5: 74B442B2BE1260B7588C136177CEAC66
              Control Set: CurrentControlSet
              Start: 3
              Type: 2
              Error Control: 1

              Service (registry key): BrFiltLo
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Brother USB Mass-Storage Lower Filter Driver
              Image path: \SystemRoot\system32\drivers\brfiltlo.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): BrFiltUp
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Brother USB Mass-Storage Upper Filter Driver
              Image path: \SystemRoot\system32\drivers\brfiltup.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): Browser
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%systemroot%\system32\browser.dll,-100
              Description: @%systemroot%\system32\browser.dll,-101
              Object name: LocalSystem
              Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: LanmanWorkstation,LanmanServer

              Service (registry key): Brserid
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Brother MFC Serial Port Interface Driver (WDM)
              Image path: \SystemRoot\system32\drivers\brserid.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): BrSerWdm
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Brother WDM Serial driver
              Image path: \SystemRoot\system32\drivers\brserwdm.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): BrUsbMdm
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Brother MFC USB Fax Only Modem
              Image path: \SystemRoot\system32\drivers\brusbmdm.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): BrUsbSer
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Brother MFC USB Serial WDM Driver
              Image path: \SystemRoot\system32\drivers\brusbser.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): BTHMODEM
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Bluetooth Serial Communications Driver
              Image path: \SystemRoot\system32\drivers\bthmodem.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): cdfs
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: CD/DVD File System Reader
              Description: ISO9660/Joliet File System Reader for CD/DVDs. (Core) (All pieces)
              Image path: system32\DRIVERS\cdfs.sys
              Image size: 70144
              Image MD5: 7ADD03E75BEB9E6DD102C3081D29840A
              Control Set: CurrentControlSet
              Start: 4
              Type: 2
              Error Control: 1
              Depends On group: "SCSI CDROM Class"

              Service (registry key): cdrom
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Pilote de CD-ROM
              Image path: system32\DRIVERS\cdrom.sys
              Image size: 67072
              Image MD5: 1EC25CEA0DE6AC4718BF89F9E1778B57
              Control Set: CurrentControlSet
              Start: 1
              Type: 1
              Error Control: 1

              Service (registry key): CertPropSvc
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\System32\certprop.dll,-11
              Description: @%SystemRoot%\System32\certprop.dll,-12
              Object name: LocalSystem
              Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 3
              Type: 32
              Error Control: 1
              Depends On services: RpcSs

              Service (registry key): circlass
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Consumer IR Devices
              Image path: \SystemRoot\system32\drivers\circlass.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): CLFS
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Common Log (CLFS)
              Description: Common Log (CLFS)
              Image path: System32\CLFS.sys
              Image size: 247352
              Image MD5: 465745561C832B29F7C48B488AAB3842
              Control Set: CurrentControlSet
              Start: 0
              Type: 1
              Error Control: 3

              Service (registry key): clr_optimization_v2.0.50727_32
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Microsoft .NET Framework NGEN v2.0.50727_X86
              Description: Microsoft .NET Framework NGEN
              Object name: LocalSystem
              Image path: %systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
              Image size: 69632
              Image MD5: D87ACAED61E417BBA546CED5E7E36D9C
              Control Set: CurrentControlSet
              Start: 3
              Type: 16
              Error Control: 0

              Service (registry key): cmdide
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Image path: \SystemRoot\system32\drivers\cmdide.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 3

              Service (registry key): Compbatt
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Microsoft Composite Battery Driver
              Image path: \SystemRoot\system32\drivers\compbatt.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 3

              Service (registry key): COMSysApp
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @comres.dll,-947
              Description: @comres.dll,-948
              Object name: LocalSystem
              Image path: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
              Image size: 7168
              Image MD5: BE01E566D1F569AAB32D0335613E1EEA
              Control Set: CurrentControlSet
              Start: 3
              Type: 16
              Error Control: 1
              Depends On services: RpcSs,EventSystem,SENS

              Service (registry key): crcdisk
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Crcdisk Filter Driver
              Image path: system32\drivers\crcdisk.sys
              Image size: 22632
              Image MD5: 2A213AE086BBEC5E937553C7D9A2B22C
              Control Set: CurrentControlSet
              Start: 0
              Type: 1
              Error Control: 1

              Service (registry key): Crusoe
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Transmeta Crusoe Processor Driver
              Image path: \SystemRoot\system32\drivers\crusoe.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 4
              Type: 1
              Error Control: 1

              Service (registry key): crypt32
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): CryptSvc
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\cryptsvc.dll,-1001
              Description: @%SystemRoot%\system32\cryptsvc.dll,-1002
              Object name: NT Authority\NetworkService
              Image path: %SystemRoot%\system32\svchost.exe -k NetworkService
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: RpcSs

              Service (registry key): DCLocator
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Control Set: CurrentControlSet
              Start: 0
              Type: 0
              Error Control: 0

              Service (registry key): DcomLaunch
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @oleres.dll,-5012
              Description: @oleres.dll,-5013
              Object name: LocalSystem
              Image path: %SystemRoot%\system32\svchost.exe -k DcomLaunch
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1

              Service (registry key): DfsC
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%systemroot%\system32\drivers\dfsc.sys,-101
              Description: @%systemroot%\system32\drivers\dfsc.sys,-102
              Image path: System32\Drivers\dfsc.sys
              Image size: 75264
              Image MD5: 9E635AE5E8AD93E2B5989E2E23679F97
              Control Set: CurrentControlSet
              Start: 1
              Type: 2
              Error Control: 1
              Depends On services: Mup

              Service (registry key): DFSR
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @dfsrres.dll,-101
              Description: @dfsrres.dll,-102
              Object name: LocalSystem
              Image path: %SystemRoot%\system32\DFSR.exe
              Image size: 2091520
              Image MD5: FA3463F25F9CC9C3BCF1E7912FEFF099
              Control Set: CurrentControlSet
              Start: 3
              Type: 16
              Error Control: 1
              Depends On services: RpcSs,EventSystem

              Service (registry key): Dhcp
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\system32\dhcpcsvc.dll,-100
              Description: @%SystemRoot%\system32\dhcpcsvc.dll,-101
              Object name: NT Authority\LocalService
              Image path: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: NSI,Tdx,Afd

              Service (registry key): disk
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Pilote de disque
              Image path: system32\drivers\disk.sys
              Image size: 55352
              Image MD5: 64109E623ABD6955C8FB110B592E68B7
              Control Set: CurrentControlSet
              Start: 0
              Type: 1
              Error Control: 1

              Service (registry key): Dnscache
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\System32\dnsapi.dll,-101
              Description: @%SystemRoot%\System32\dnsapi.dll,-102
              Object name: NT AUTHORITY\NetworkService
              Image path: %SystemRoot%\system32\svchost.exe -k NetworkService
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1
              Depends On services: Tdx

              Service (registry key): dot3svc
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%systemroot%\system32\dot3svc.dll,-1102
              Description: @%systemroot%\system32\dot3svc.dll,-1103
              Object name: localSystem
              Image path: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 3
              Type: 32
              Error Control: 1
              Depends On services: RpcSs,Ndisuio,Eaphost

              Service (registry key): DPS
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%systemroot%\system32\dps.dll,-500
              Description: @%systemroot%\system32\dps.dll,-501
              Object name: NT AUTHORITY\LocalService
              Image path: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 2
              Type: 32
              Error Control: 1

              Service (registry key): drmkaud
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Filtre de décodeur DRM (Noyau Microsoft)
              Image path: system32\drivers\drmkaud.sys
              Image size: 5632
              Image MD5: 97FEF831AB90BEE128C9AF390E243F80
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): DXGKrnl
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: LDDM Graphics Subsystem
              Description: Controls the underlying video driver stacks to provide fully-featured display capabilities.
              Image path: \SystemRoot\System32\drivers\dxgkrnl.sys
              Image size: 0
              Image MD5: D41D8CD98F00B204E9800998ECF8427E
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 0

              Service (registry key): E1G60
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: Intel(R) PRO/1000 NDIS 6 Adapter Driver
              Image path: system32\DRIVERS\E1G60I32.sys
              Image size: 117760
              Image MD5: F88FB26547FD2CE6D0A5AF2985892C48
              Control Set: CurrentControlSet
              Start: 3
              Type: 1
              Error Control: 1

              Service (registry key): EapHost
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%systemroot%\system32\eapsvc.dll,-1
              Description: @%systemroot%\system32\eapsvc.dll,-2
              Object name: localSystem
              Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
              Image size: 21504
              Image MD5: 3794B461C45882E06856F282EEF025AF
              Control Set: CurrentControlSet
              Start: 3
              Type: 32
              Error Control: 1
              Depends On services: RPCSS,KeyIso

              Service (registry key): Ecache
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: ReadyBoost Caching Driver
              Description: ReadyBoost Caching Driver
              Image path: System32\drivers\ecache.sys
              Image size: 143416
              Image MD5: DD2CD259D83D8B72C02C5F2331FF9D68
              Control Set: CurrentControlSet
              Start: 0
              Type: 1
              Error Control: 3

              Service (registry key): ehRecvr
              Registry path: \SYSTEM\CurrentControlSet\Services\
              Display name: @%SystemRoot%\ehome\ehrecvr.exe,-101
              Description: @%SystemRoot%\ehome\ehrecvr.exe,-102
              Ob
              1. Utilisateur anonyme
                bonjour, ne cherche pas, tu es infecté par un trojan msqpdxserv.sys qui c'est installé dans le registre.

                télécharge GenProc sur ton bureau :
                http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip
                ou ici : http://www.genproc.com/GenProc.exe
                dézippe le dossier, double-clique sur GenProc.bat
                poste le contenu du rapport qui s'ouvre

                Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

                ou télécharge GenProc http://www.genproc.com/GenProc.exe

                double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre ensuite tu suit la procédure dans l'ordre .
                2. bleurk Auteur
                  il met même impossible de suprimer le dossier genproc de mon bureau!
                  1. Utilisateur anonyme
                    telecharge le fichier genproc et enregistre le sur ton bureau.
                    essaie de le relancer
                    2. Utilisateur anonyme
                      tu as ce problème depuis quand? arrives tu a trouvé un point de restauration de système enterieur à la date en question?
                      1. bleurk Auteur
                        je sais pas, je dirai 2 sem.

                        dit moi ce que tu en pensse de ce rapport s'il te plait

                        ***** THE SYSTEM HAS BEEN RESTARTED *****
                        10/07/2009 15:48:42: Trojan Remover has been restarted
                        =======================================================
                        Removing the following registry keys:
                        HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys - Ownership taken
                        HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys - already removed (or did not exist)
                        =======================================================
                        10/07/2009 15:48:42: Trojan Remover closed
                        ************************************************************

                        ***** NORMAL SCAN FOR ACTIVE MALWARE *****
                        Trojan Remover Ver 6.7.9.2584. For information, email support@simplysup.com
                        [Unregistered version]
                        Scan started at: 15:46:02 10 juil. 2009
                        Using Database v7358
                        Operating System: Windows Vista Home Premium (SP1) [Build: 6.0.6001]
                        File System: NTFS
                        User Account Control is DISABLED.
                        UserData directory: C:\Users\johnny\AppData\Roaming\Simply Super Software\Trojan Remover\
                        Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
                        Logfile directory: C:\Users\johnny\Documents\Simply Super Software\Trojan Remover Logfiles\
                        Program directory: C:\Program Files\Trojan Remover\
                        Running with Administrator privileges

                        ************************************************************
                        The following Anti-Malware program(s) are loaded:
                        Avira AntiVir

                        ************************************************************

                        ************************************************************
                        15:46:02: ----- SCANNING FOR ROOTKIT SERVICES -----
                        No hidden Services were detected.

                        ************************************************************
                        15:46:03: Scanning -----WINDOWS REGISTRY-----
                        --------------------
                        Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
                        --------------------
                        Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
                        This key's "Shell" value calls the following program(s):
                        Key value: [explorer.exe]
                        File: explorer.exe
                        C:\Windows\explorer.exe
                        2927104 bytes
                        Created: 10/12/2008 22:54
                        Modified: 29/10/2008 08:29
                        Company: Microsoft Corporation
                        ----------
                        This key's "Userinit" value calls the following program(s):
                        Key value: [C:\Windows\system32\userinit.exe,]
                        File: C:\Windows\system32\userinit.exe
                        C:\Windows\system32\userinit.exe
                        25088 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        ----------
                        --------------------
                        Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
                        --------------------
                        Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
                        Value Name: load
                        --------------------
                        Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                        Value Name: Adobe Reader Speed Launcher
                        Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                        C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                        39792 bytes
                        Created: 15/10/2008 02:04
                        Modified: 15/10/2008 02:04
                        Company: Adobe Systems Incorporated
                        --------------------
                        Value Name: avgnt
                        Value Data: "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
                        C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
                        209153 bytes
                        Created: 01/05/2009 08:38
                        Modified: 02/03/2009 13:08
                        Company: Avira GmbH
                        --------------------
                        Value Name: GrooveMonitor
                        Value Data: "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
                        C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
                        31072 bytes
                        Created: 25/10/2008 11:44
                        Modified: 25/10/2008 11:44
                        Company: Microsoft Corporation
                        --------------------
                        Value Name: QuickTime Task
                        Value Data: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                        C:\Program Files\QuickTime\QTTask.exe
                        413696 bytes
                        Created: 26/05/2009 17:18
                        Modified: 26/05/2009 17:18
                        Company: Apple Inc.
                        --------------------
                        Value Name: iTunesHelper
                        Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
                        C:\Program Files\iTunes\iTunesHelper.exe
                        292136 bytes
                        Created: 05/06/2009 13:39
                        Modified: 05/06/2009 13:39
                        Company: Apple Inc.
                        --------------------
                        Value Name: F-Secure ExploitShield
                        Value Data: "C:\Program Files\F-Secure\ExploitShield\fsesgui.exe"
                        C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
                        629376 bytes
                        Created: 05/07/2009 14:34
                        Modified: 29/06/2009 12:14
                        Company: F-Secure Corporation
                        --------------------
                        Value Name: TrojanScanner
                        Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
                        C:\Program Files\Trojan Remover\Trjscan.exe
                        1059720 bytes
                        Created: 10/07/2009 15:45
                        Modified: 01/06/2009 17:06
                        Company: Simply Super Software
                        --------------------
                        --------------------
                        Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
                        Value Name: Launcher
                        Value Data: %WINDIR%\SMINST\launcher.exe
                        C:\Windows\SMINST\launcher.exe
                        44168 bytes
                        Created: 07/03/2007 11:09
                        Modified: 07/03/2007 11:09
                        Company: soft thinks
                        --------------------
                        --------------------
                        Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
                        This Registry Key appears to be empty
                        --------------------
                        Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
                        This Registry Key appears to be empty
                        --------------------
                        Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
                        Value Name: Sidebar
                        Value Data: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                        C:\Program Files\Windows Sidebar\sidebar.exe
                        1233920 bytes
                        Created: 10/05/2008 20:02
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        Value Name: ehTray.exe
                        Value Data: C:\Windows\ehome\ehTray.exe
                        C:\Windows\ehome\ehTray.exe
                        125952 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        Value Name: LDM
                        Value Data: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                        C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                        36864 bytes
                        Created: 10/08/2008 11:50
                        Modified: 10/08/2008 11:50
                        Company: Logitech
                        --------------------
                        Value Name: msnlivesearch
                        Value Data: C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
                        C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
                        49152 bytes
                        Created: 04/10/2008 09:29
                        Modified: 04/10/2008 09:29
                        Company: Microsoft
                        --------------------
                        Value Name: ISUSPM Startup
                        Value Data: "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
                        C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
                        249856 bytes
                        Created: 27/10/2007 18:59
                        Modified: 11/08/2005 15:30
                        Company: Macrovision Corporation
                        --------------------
                        Value Name: swg
                        Value Data: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                        39408 bytes
                        Created: 14/01/2009 14:31
                        Modified: 14/01/2009 14:31
                        Company: Google Inc.
                        --------------------
                        Value Name: SpybotSD TeaTimer
                        Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        2260480 bytes
                        Created: 07/10/2007 13:59
                        Modified: 05/03/2009 16:07
                        Company: Safer-Networking Ltd.
                        --------------------
                        --------------------
                        Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
                        This Registry Key appears to be empty
                        --------------------
                        Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
                        This Registry Key appears to be empty
                        --------------------
                        Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
                        This Registry Key appears to be empty

                        ************************************************************
                        15:46:05: Scanning -----SHELLEXECUTEHOOKS-----
                        ValueName: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}
                        Value: Groove GFS Stub Execution Hook
                        File: C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
                        C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
                        2217848 bytes
                        Created: 12/02/2009 15:19
                        Modified: 12/02/2009 15:19
                        Company: Microsoft Corporation
                        ----------

                        ************************************************************
                        15:46:05: Scanning -----HIDDEN REGISTRY ENTRIES-----
                        Taskdir check completed
                        ----------
                        No Hidden File-loading Registry Entries found
                        ----------

                        ************************************************************
                        15:46:05: Scanning -----ACTIVE SCREENSAVER-----
                        ScreenSaver: C:\Windows\GAIA3D~1.SCR
                        C:\Windows\GAIA3D~1.SCR - [file not found to scan]
                        --------------------

                        ************************************************************
                        15:46:05: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

                        ************************************************************
                        15:46:05: Scanning ----- SERVICEDLL REGISTRY KEYS -----

                        ************************************************************
                        15:46:05: Scanning ----- SERVICES REGISTRY KEYS -----
                        Key: 61883
                        ImagePath: system32\DRIVERS\61883.sys
                        C:\Windows\system32\DRIVERS\61883.sys
                        45696 bytes
                        Created: 10/05/2008 19:59
                        Modified: 19/01/2008 07:53
                        Company: Microsoft Corporation
                        ----------
                        Key: a2free
                        ImagePath: "C:\Program Files\a-squared Free\a2service.exe"
                        C:\Program Files\a-squared Free\a2service.exe
                        718880 bytes
                        Created: 08/07/2009 15:40
                        Modified: 08/07/2009 15:48
                        Company: Emsi Software GmbH
                        ----------
                        Key: Adobe LM Service
                        ImagePath: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
                        C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
                        72704 bytes
                        Created: 23/10/2007 12:21
                        Modified: 23/10/2007 12:21
                        Company: Adobe Systems
                        ----------
                        Key: athr
                        ImagePath: system32\DRIVERS\athr.sys
                        C:\Windows\system32\DRIVERS\athr.sys
                        952832 bytes
                        Created: 29/12/2008 23:57
                        Modified: 29/12/2008 23:57
                        Company: Atheros Communications, Inc.
                        ----------
                        Key: Avc
                        ImagePath: system32\DRIVERS\avc.sys
                        C:\Windows\system32\DRIVERS\avc.sys
                        40448 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 07:53
                        Company: Microsoft Corporation
                        ----------
                        Key: BDFsDrv
                        ImagePath: \??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys
                        C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys - [file not found to scan]
                        ----------
                        Key: blbdrive
                        ImagePath: \SystemRoot\system32\drivers\blbdrive.sys - file is missing - alert is globally excluded
                        ----------
                        Key: Boonty Games
                        ImagePath: "C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
                        C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe - [file not found to scan]
                        ----------
                        Key: ExploitShield
                        ImagePath: "C:\Program Files\F-Secure\ExploitShield\fsessrv.exe"
                        C:\Program Files\F-Secure\ExploitShield\fsessrv.exe
                        326272 bytes
                        Created: 05/07/2009 14:34
                        Modified: 29/06/2009 12:14
                        Company: F-Secure Corporation
                        ----------
                        Key: IDriverT
                        ImagePath: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
                        C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe - [file not found to scan]
                        ----------
                        Key: IpInIp
                        ImagePath: system32\DRIVERS\ipinip.sys - file is missing - alert is globally excluded
                        ----------
                        Key: kbdhid
                        ImagePath: \SystemRoot\system32\drivers\kbdhid.sys
                        C:\Windows\system32\drivers\kbdhid.sys
                        15872 bytes
                        Created: 02/11/2006 10:51
                        Modified: 02/11/2006 10:51
                        Company: Microsoft Corporation
                        ----------
                        Key: LHidKe
                        ImagePath: system32\DRIVERS\LHidKE.Sys
                        C:\Windows\system32\DRIVERS\LHidKE.Sys
                        27136 bytes
                        Created: 22/11/2007 12:09
                        Modified: 19/07/2006 13:29
                        Company: Logitech Inc.
                        ----------
                        Key: LiveUpdate
                        ImagePath: "C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"
                        C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                        2918008 bytes
                        Created: 27/06/2007 23:24
                        Modified: 11/01/2007 11:13
                        Company: Symantec Corporation
                        ----------
                        Key: LiveUpdate Notice Ex
                        ImagePath: "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
                        c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe - [file not found to scan]
                        ----------
                        Key: LiveUpdate Notice Service
                        ImagePath: "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll"
                        C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                        517768 bytes
                        Created: 12/03/2007 10:22
                        Modified: 12/03/2007 10:22
                        Company: Symantec Corporation
                        ----------
                        Key: LVCOMSer
                        ImagePath: "C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe"
                        C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                        186904 bytes
                        Created: 26/07/2008 08:23
                        Modified: 26/07/2008 08:23
                        Company: Logitech Inc.
                        ----------
                        Key: LVPr2Mon
                        ImagePath: system32\DRIVERS\LVPr2Mon.sys
                        C:\Windows\system32\DRIVERS\LVPr2Mon.sys
                        25624 bytes
                        Created: 26/07/2008 08:25
                        Modified: 26/07/2008 08:25
                        Company: Logitech Inc.
                        ----------
                        Key: LVPrcSrv
                        ImagePath: "C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe"
                        C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                        150040 bytes
                        Created: 26/07/2008 08:25
                        Modified: 26/07/2008 08:25
                        Company: Logitech Inc.
                        ----------
                        Key: LVRS
                        ImagePath: system32\DRIVERS\lvrs.sys
                        C:\Windows\system32\DRIVERS\lvrs.sys
                        627864 bytes
                        Created: 23/09/2008 00:53
                        Modified: 26/07/2008 17:25
                        Company: Logitech Inc.
                        ----------
                        Key: maxidemo
                        ImagePath: system32\DRIVERS\maxidemo.sys
                        C:\Windows\system32\DRIVERS\maxidemo.sys - [file not found to scan]
                        ----------
                        Key: MSDV
                        ImagePath: system32\DRIVERS\msdv.sys
                        C:\Windows\system32\DRIVERS\msdv.sys
                        52608 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 07:53
                        Company: Microsoft Corporation
                        ----------
                        Key: msiserver
                        ImagePath: %systemroot%\system32\msiexec /V
                        ----------
                        Key: Nero BackItUp Scheduler 3
                        ImagePath: C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                        C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                        836904 bytes
                        Created: 08/08/2007 09:25
                        Modified: 08/08/2007 09:25
                        Company: Nero AG
                        ----------
                        Key: nvstor32
                        ImagePath: system32\drivers\nvstor32.sys
                        C:\Windows\system32\drivers\nvstor32.sys
                        110624 bytes
                        Created: 26/10/2007 19:51
                        Modified: 26/10/2007 19:51
                        Company: NVIDIA Corporation
                        ----------
                        Key: NwlnkFlt
                        ImagePath: system32\DRIVERS\nwlnkflt.sys - file is missing - alert is globally excluded
                        ----------
                        Key: NwlnkFwd
                        ImagePath: system32\DRIVERS\nwlnkfwd.sys - file is missing - alert is globally excluded
                        ----------
                        Key: PcdrNdisuio
                        ImagePath: system32\DRIVERS\pcdrndisuio.sys
                        C:\Windows\system32\DRIVERS\pcdrndisuio.sys - [file not found to scan]
                        ----------
                        Key: pcouffin
                        ImagePath: System32\Drivers\pcouffin.sys
                        C:\Windows\System32\Drivers\pcouffin.sys
                        47360 bytes
                        Created: 10/10/2007 15:43
                        Modified: 10/10/2007 15:43
                        Company: VSO Software
                        ----------
                        Key: pepifilter
                        ImagePath: system32\DRIVERS\lv302af.sys
                        C:\Windows\system32\DRIVERS\lv302af.sys
                        13848 bytes
                        Created: 23/09/2008 00:53
                        Modified: 26/07/2008 17:22
                        Company: Logitech Inc.
                        ----------
                        Key: Planificateur LiveUpdate automatique
                        ImagePath: "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
                        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                        554616 bytes
                        Created: 27/06/2007 23:24
                        Modified: 11/01/2007 11:13
                        Company: Symantec Corporation
                        ----------
                        Key: PnkBstrA
                        ImagePath: C:\Windows\system32\PnkBstrA.exe
                        C:\Windows\system32\PnkBstrA.exe
                        66872 bytes
                        Created: 20/12/2007 00:12
                        Modified: 15/05/2009 10:50
                        Company: [no info]
                        ----------
                        Key: PnkBstrB
                        ImagePath: C:\Windows\system32\PnkBstrB.exe
                        C:\Windows\system32\PnkBstrB.exe
                        107832 bytes
                        Created: 20/12/2007 00:12
                        Modified: 15/05/2009 10:50
                        Company: [no info]
                        ----------
                        Key: RoxMediaDB9
                        ImagePath: "c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe"
                        c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                        887544 bytes
                        Created: 26/03/2007 13:21
                        Modified: 26/03/2007 13:21
                        Company: Sonic Solutions
                        ----------
                        Key: SBSDWSCService
                        ImagePath: C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                        C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                        1153368 bytes
                        Created: 07/10/2007 13:59
                        Modified: 26/01/2009 15:31
                        Company: Safer Networking Ltd.
                        ----------
                        Key: Serenum
                        ImagePath: \SystemRoot\system32\drivers\serenum.sys
                        C:\Windows\system32\drivers\serenum.sys
                        17920 bytes
                        Created: 02/11/2006 10:51
                        Modified: 02/11/2006 10:51
                        Company: Microsoft Corporation
                        ----------
                        Key: Serial
                        ImagePath: \SystemRoot\system32\drivers\serial.sys
                        C:\Windows\system32\drivers\serial.sys
                        83456 bytes
                        Created: 02/11/2006 10:51
                        Modified: 02/11/2006 10:51
                        Company: Microsoft Corporation
                        ----------
                        Key: sfdrv01
                        ImagePath: System32\drivers\sfdrv01.sys
                        C:\Windows\System32\drivers\sfdrv01.sys
                        59256 bytes
                        Created: 05/07/2006 14:39
                        Modified: 05/07/2006 14:39
                        Company: Protection Technology (StarForce)
                        ----------
                        Key: sfhlp02
                        ImagePath: System32\drivers\sfhlp02.sys
                        C:\Windows\System32\drivers\sfhlp02.sys
                        13680 bytes
                        Created: 14/06/2006 16:56
                        Modified: 14/06/2006 16:56
                        Company: Protection Technology (StarForce)
                        ----------
                        Key: sfvfs02
                        ImagePath: System32\drivers\sfvfs02.sys
                        C:\Windows\System32\drivers\sfvfs02.sys
                        83320 bytes
                        Created: 08/02/2007 19:44
                        Modified: 08/02/2007 19:44
                        Company: Protection Technology (StarForce)
                        ----------
                        Key: sptd
                        ImagePath: System32\Drivers\sptd.sys - this file is globally excluded
                        ----------
                        Key: stllssvr
                        ImagePath: "c:\Program Files\Common Files\SureThing Shared\stllssvr.exe"
                        c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                        -R- 74656 bytes
                        Created: 08/03/2007 18:54
                        Modified: 08/03/2007 18:54
                        Company: MicroVision Development, Inc.
                        ----------
                        Key: usbbus
                        ImagePath: system32\DRIVERS\lgusbbus.sys
                        C:\Windows\system32\DRIVERS\lgusbbus.sys
                        12416 bytes
                        Created: 19/04/2009 13:04
                        Modified: 11/07/2007 10:40
                        Company: LG Electronics Inc.
                        ----------
                        Key: UsbDiag
                        ImagePath: system32\DRIVERS\lgusbdiag.sys
                        C:\Windows\system32\DRIVERS\lgusbdiag.sys
                        19840 bytes
                        Created: 19/04/2009 13:04
                        Modified: 11/07/2007 15:51
                        Company: LG Electronics Inc.
                        ----------
                        Key: USBModem
                        ImagePath: system32\DRIVERS\lgusbmodem.sys
                        C:\Windows\system32\DRIVERS\lgusbmodem.sys
                        21632 bytes
                        Created: 19/04/2009 13:04
                        Modified: 11/07/2007 10:45
                        Company: LG Electronics Inc.
                        ----------
                        Key: VBoxDrv
                        ImagePath: system32\DRIVERS\VBoxDrv.sys
                        C:\Windows\system32\DRIVERS\VBoxDrv.sys
                        117136 bytes
                        Created: 05/07/2009 10:48
                        Modified: 16/06/2009 19:07
                        Company: Sun Microsystems, Inc.
                        ----------
                        Key: VBoxNetAdp
                        ImagePath: system32\DRIVERS\VBoxNetAdp.sys
                        C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
                        91280 bytes
                        Created: 16/06/2009 19:07
                        Modified: 16/06/2009 19:07
                        Company: Sun Microsystems, Inc.
                        ----------
                        Key: VBoxNetFlt
                        ImagePath: system32\DRIVERS\VBoxNetFlt.sys
                        C:\Windows\system32\DRIVERS\VBoxNetFlt.sys
                        99216 bytes
                        Created: 16/06/2009 19:07
                        Modified: 16/06/2009 19:07
                        Company: Sun Microsystems, Inc.
                        ----------
                        Key: VBoxUSBMon
                        ImagePath: system32\DRIVERS\VBoxUSBMon.sys
                        C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
                        41424 bytes
                        Created: 05/07/2009 10:47
                        Modified: 16/06/2009 19:07
                        Company: Sun Microsystems, Inc.
                        ----------
                        Key: WpdUsb
                        ImagePath: system32\DRIVERS\wpdusb.sys
                        C:\Windows\system32\DRIVERS\wpdusb.sys
                        39936 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 08:04
                        Company: Microsoft Corporation
                        ----------

                        ************************************************************
                        15:46:27: Scanning -----VXD ENTRIES-----

                        ************************************************************
                        15:46:27: Scanning ----- WINLOGON\NOTIFY DLLS -----
                        No Winlogon\Notify DLLs found to scan

                        ************************************************************
                        15:46:27: Scanning ----- CONTEXTMENUHANDLERS -----
                        Key: {100BD527-7304-4b7f-BEE2-26D97B04EBA4}
                        Path: C:\Program Files\Nero\Nero8\Nero BackItUp\NBShell.dll
                        C:\Program Files\Nero\Nero8\Nero BackItUp\NBShell.dll
                        255272 bytes
                        Created: 08/08/2007 09:25
                        Modified: 08/08/2007 09:25
                        Company: Nero AG
                        ----------

                        ************************************************************
                        15:46:27: Scanning ----- FOLDER\COLUMNHANDLERS -----
                        Key: {7D4D6379-F301-4311-BEBA-E26EB0561882}
                        File: C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll
                        C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll
                        1803560 bytes
                        Created: 08/08/2007 09:26
                        Modified: 08/08/2007 09:26
                        Company: Nero AG
                        ----------

                        ************************************************************
                        15:46:27: Scanning ----- BROWSER HELPER OBJECTS -----
                        Key: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8}
                        BHO: C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                        C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                        525792 bytes
                        Created: 21/05/2007 11:34
                        Modified: 21/05/2007 11:34
                        Company: Protect Software GmbH
                        ----------
                        Key: {53707962-6F74-2D53-2644-206D7942484F}
                        BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        1879896 bytes
                        Created: 07/10/2007 13:59
                        Modified: 26/01/2009 15:31
                        Company: Safer Networking Limited
                        ----------
                        Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
                        BHO: C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                        C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                        251504 bytes
                        Created: 14/01/2009 14:31
                        Modified: 14/01/2009 14:30
                        Company: [no info]
                        ----------
                        Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
                        BHO: C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
                        C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
                        669168 bytes
                        Created: 08/07/2009 20:53
                        Modified: 08/07/2009 20:53
                        Company: Google Inc.
                        ----------

                        ************************************************************
                        15:46:28: Scanning ----- SHELLSERVICEOBJECTS -----

                        ************************************************************
                        15:46:28: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

                        ************************************************************
                        15:46:28: Scanning ----- IMAGEFILE DEBUGGERS -----
                        No "Debugger" entries found.

                        ************************************************************
                        15:46:28: Scanning ----- APPINIT_DLLS -----
                        The AppInit_DLLs value is blank or does not exist

                        ************************************************************
                        15:46:28: Scanning ----- SECURITY PROVIDER DLLS -----

                        ************************************************************
                        15:46:28: Scanning ------ COMMON STARTUP GROUP ------
                        [C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
                        The Common Startup Group attempts to load the following file(s) at boot time:
                        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
                        -HS- 174 bytes
                        Created: 02/11/2006 14:50
                        Modified: 11/05/2008 00:05
                        Company: [no info]
                        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini - no action taken on this file
                        --------------------
                        Logitech Desktop Messenger.lnk - links to C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe
                        C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe
                        196608 bytes
                        Created: 10/08/2008 11:50
                        Modified: 10/08/2008 11:50
                        Company: Logitech
                        --------------------
                        PDFCreator.lnk - links to C:\PROGRA~1\PDFCRE~1\PDFCRE~1.EXE
                        C:\PROGRA~1\PDFCRE~1\PDFCRE~1.EXE
                        2641920 bytes
                        Created: 11/01/2008 19:04
                        Modified: 11/01/2008 19:04
                        Company: pdfforge https://www.pdfforge.org/
                        --------------------

                        ************************************************************
                        15:46:28: Scanning ----- USER STARTUP GROUPS -----
                        Checking Startup Group for: Invité
                        [C:\Users\Invité\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
                        --------------------
                        Checking Startup Group for: johnny
                        [C:\Users\johnny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
                        Adobe Gamma.lnk - links to C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE
                        C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE
                        113664 bytes
                        Created: 16/03/2005 19:16
                        Modified: 16/03/2005 19:16
                        Company: Adobe Systems, Inc.
                        ----------
                        C:\Users\johnny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
                        -HS- 174 bytes
                        Created: 02/10/2007 16:21
                        Modified: 03/10/2007 21:17
                        Company: [no info]
                        C:\Users\johnny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini - no action taken on this file
                        ----------
                        --------------------

                        ************************************************************
                        15:46:29: Scanning ----- SCHEDULED TASKS -----
                        Taskname: {3319FB9B-F5CA-46FD-9403-D5A69DCB65ED}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Users\johnny\Desktop\Downloads\alcohol-120_alcohol_120_1.9.7_build_6022_anglais_11016.exe -d C:\Users\johnny\Desktop\Downloads
                        ----------
                        Taskname: {626AC99C-304A-4506-B490-AD93A7963559}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Users\johnny\Desktop\Downloads\strip-poker.exe -d C:\Users\johnny\Desktop\Downloads
                        ----------
                        Taskname: {85CFB0C3-1862-4302-B41E-9F6753A37B96}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Users\johnny\Desktop\Downloads\incrazyball_demo_jouable_1_multijoueurs_multi-langues_15284.exe -d C:\Users\johnny\Desktop\Downloads
                        ----------
                        Taskname: {A1142016-46B0-4BDF-BFA7-F1C28C376760}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe -c /M{CEBB0413-2628-4C49-8332-5EEC640B8005}
                        ----------
                        Taskname: {AF269F44-98B9-49E1-B3D4-78582CEFE5B3}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" -c /uninstall
                        ----------
                        Taskname: {AFCD4E48-9750-4765-9A0C-6D7DCA693DDB}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a "C:\Users\johnny\Desktop\Downloads\POOL\Play89 Pool.exe" -d C:\Users\johnny\Desktop\Downloads\POOL
                        ----------
                        Taskname: {B56FE104-B28B-44A8-9A1C-B4FF525B7812}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Windows\unvise32.exe -d C:\Windows -c C:\PROGRA~1\SCIGAM~1\CONSTA~1\uninstal.log
                        ----------
                        Taskname: {B8C2FEA5-B1D7-438F-A239-55825B10C86F}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Users\johnny\Desktop\Downloads\DEMO\Attack_of_the_Silver_Ball_Demo_du_jeu.exe -d C:\Users\johnny\Desktop\Downloads\DEMO
                        ----------
                        Taskname: {B915C2C6-9BB9-47A2-8087-DD366E848FA7}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Users\johnny\Desktop\Downloads\f.e.a.r._perseus_mandate_demo_jouable_1_anglais_46000.exe -d C:\Users\johnny\Desktop\Downloads
                        ----------
                        Taskname: {D85907C9-3B7F-43A3-988D-06A72F06F68D}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a C:\Users\johnny\Desktop\Downloads\call_of_duty_4_modern_warfare_demo_en.exe -d C:\Users\johnny\Desktop\Downloads
                        ----------
                        Taskname: {E9D6FB80-F966-40B4-8805-9E2EE57A3028}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a "C:\Users\johnny\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DOESYUTJ\daemon408-x86[1].exe" -d C:\Users\johnny
                        ----------
                        Taskname: {EBFF3A6B-13F3-4915-BA6B-16E71B6BDF83}
                        File: C:\Windows\system32\pcalua.exe - globally excluded
                        Parameters: -a E:\CommonEASO\EASOInstaller.exe -d E:\CommonEASO
                        ----------

                        ************************************************************
                        15:46:29: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

                        ************************************************************
                        15:46:29: Scanning ----- DEVICE DRIVER ENTRIES -----
                        Value: VIDC.I420
                        File: lvcodec2.dll
                        C:\Windows\system32\lvcodec2.dll
                        416280 bytes
                        Created: 03/10/2007 21:27
                        Modified: 26/07/2008 17:23
                        Company: Logitech Inc.
                        ----------
                        Value: VIDC.FFDS
                        File: ff_vfw.dll
                        C:\Windows\system32\ff_vfw.dll
                        7680 bytes
                        Created: 04/10/2007 13:34
                        Modified: 07/09/2007 19:32
                        Company: [no info]
                        ----------
                        Value: msacm.vorbis
                        File: vorbis.acm
                        C:\Windows\system32\vorbis.acm
                        1294336 bytes
                        Created: 01/11/2007 22:33
                        Modified: 08/07/2002 00:14
                        Company: HMS http://hp.vector.co.jp/authors/VA012897/
                        ----------

                        ************************************************************
                        15:46:30: ----- ADDITIONAL CHECKS -----
                        Hidden or inaccessible Services entry: [msqpdxserv.sys]
                        ImagePath: \systemroot\system32\drivers\msqpdxvtsiprcf.sys
                        Entry has been scheduled for deletion when the PC is restarted
                        \systemroot\system32\drivers\msqpdxvtsiprcf.sys - no action requested on this file
                        ----------
                        Winlogon registry rootkit checks completed
                        ----------
                        Heuristic checks for hidden files/drivers completed
                        ----------
                        Layered Service Provider entries checks completed
                        ----------
                        Windows Explorer Policies checks completed
                        ----------
                        Desktop Wallpaper: C:\Users\johnny\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
                        C:\Users\johnny\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
                        261265 bytes
                        Created: 13/04/2009 20:24
                        Modified: 13/04/2009 20:24
                        Company: [no info]
                        ----------
                        Web Desktop Wallpaper: %APPDATA%\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
                        C:\Users\johnny\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg
                        261265 bytes
                        Created: 13/04/2009 20:24
                        Modified: 13/04/2009 20:24
                        Company: [no info]
                        ----------
                        Checks for rogue DNS NameServers completed
                        ----------
                        Additional checks completed

                        ************************************************************
                        15:46:56: Scanning ----- RUNNING PROCESSES -----

                        C:\Windows\System32\smss.exe
                        64000 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\csrss.exe
                        6144 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\wininit.exe
                        96768 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\csrss.exe - file already scanned
                        --------------------
                        C:\Windows\system32\services.exe
                        279040 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\lsass.exe
                        9728 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\lsm.exe
                        229888 bytes
                        Created: 10/05/2008 20:02
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\svchost.exe
                        21504 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\winlogon.exe
                        314880 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\System32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\System32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\System32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\SLsvc.exe
                        2623488 bytes
                        Created: 10/05/2008 20:02
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\Dwm.exe
                        81920 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\System32\spoolsv.exe
                        125952 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Program Files\Avira\AntiVir Desktop\sched.exe
                        108289 bytes
                        Created: 01/05/2009 08:38
                        Modified: 01/04/2009 15:46
                        Company: Avira GmbH
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\taskeng.exe
                        169472 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\taskeng.exe - file already scanned
                        --------------------
                        C:\Program Files\a-squared Free\a2service.exe - file already scanned
                        --------------------
                        C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                        185089 bytes
                        Created: 01/05/2009 08:38
                        Modified: 02/03/2009 13:09
                        Company: Avira GmbH
                        --------------------
                        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        144712 bytes
                        Created: 05/06/2009 11:48
                        Modified: 05/06/2009 11:48
                        Company: Apple Inc.
                        --------------------
                        C:\Program Files\Bonjour\mDNSResponder.exe
                        238888 bytes
                        Created: 12/12/2008 11:17
                        Modified: 12/12/2008 11:17
                        Company: Apple Inc.
                        --------------------
                        C:\Program Files\F-Secure\ExploitShield\fsessrv.exe - file already scanned
                        --------------------
                        c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                        61440 bytes
                        Created: 17/01/2007 11:20
                        Modified: 17/01/2007 11:20
                        Company: Hewlett-Packard Company
                        --------------------
                        C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe - file already scanned
                        --------------------
                        C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe - file already scanned
                        --------------------
                        C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe - file already scanned
                        --------------------
                        C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe - file already scanned
                        --------------------
                        C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe - file already scanned
                        --------------------
                        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe - file already scanned
                        --------------------
                        C:\Windows\system32\PnkBstrA.exe - file already scanned
                        --------------------
                        C:\Windows\system32\PnkBstrB.exe - file already scanned
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\System32\svchost.exe - file already scanned
                        --------------------
                        C:\Windows\system32\SearchIndexer.exe
                        439808 bytes
                        Created: 28/07/2008 19:00
                        Modified: 27/05/2008 07:18
                        Company: Microsoft Corporation
                        --------------------
                        C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe - file already scanned
                        --------------------
                        C:\Windows\system32\WUDFHost.exe
                        142336 bytes
                        Created: 10/05/2008 20:01
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Program Files\Avira\AntiVir Desktop\avgnt.exe - file already scanned
                        --------------------
                        C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe - file already scanned
                        --------------------
                        C:\Program Files\iTunes\iTunesHelper.exe - file already scanned
                        --------------------
                        C:\Program Files\F-Secure\ExploitShield\fsesgui.exe - file already scanned
                        --------------------
                        C:\Program Files\Windows Sidebar\sidebar.exe - file already scanned
                        --------------------
                        C:\Windows\ehome\ehtray.exe - file already scanned
                        --------------------
                        C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe - file already scanned
                        --------------------
                        C:\Windows\ehome\ehmsas.exe
                        37376 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe - file already scanned
                        --------------------
                        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - file already scanned
                        --------------------
                        C:\Program Files\PDFCreator\PDFCreator.exe
                        2641920 bytes
                        Created: 11/01/2008 19:04
                        Modified: 11/01/2008 19:04
                        Company: pdfforge https://www.pdfforge.org/
                        --------------------
                        C:\Windows\System32\mobsync.exe
                        95744 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Program Files\Windows Sidebar\sidebar.exe - file already scanned
                        --------------------
                        C:\Windows\system32\svchost.exe - file already scanned
                        --------------------
                        C:\Program Files\iPod\bin\iPodService.exe
                        541992 bytes
                        Created: 05/06/2009 13:39
                        Modified: 05/06/2009 13:39
                        Company: Apple Inc.
                        --------------------
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        307704 bytes
                        Created: 12/01/2009 19:10
                        Modified: 12/06/2009 21:52
                        Company: Mozilla Corporation
                        --------------------
                        C:\Windows\system32\wbem\unsecapp.exe
                        37888 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\wbem\wmiprvse.exe
                        247296 bytes
                        Created: 16/04/2009 20:04
                        Modified: 03/03/2009 04:16
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\system32\conime.exe
                        69120 bytes
                        Created: 10/05/2008 20:00
                        Modified: 19/01/2008 09:33
                        Company: Microsoft Corporation
                        --------------------
                        C:\Windows\explorer.exe - file already scanned
                        --------------------
                        C:\Program Files\Trojan Remover\Rmvtrjan.exe
                        FileSize: 3015544
                        [This is a Trojan Remover component]
                        --------------------

                        ************************************************************
                        15:47:01: Checking HOSTS file
                        No malicious entries were found in the HOSTS file

                        ************************************************************
                        === CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
                        Scan completed at: 15:47:01 10 juil. 2009
                        Total Scan time: 00:00:58
                        -------------------------------------------------------------------------
                        One or more files could not be moved or renamed as requested.
                        They may be in use by Windows, so Trojan Remover needs
                        to restart the system in order to deal with these files.
                        10/07/2009 15:47:06: restart commenced
                        ************************************************************
                        1. Utilisateur anonyme
                          ils sont toujours là :

                          Removing the following registry keys:
                          HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys - Ownership taken
                          HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys - already removed (or did not exist)

                          on va les fixer avec hijackthis

                          pass un log de hijackthis et poste son rapport ici
                          1. bleurk Auteur
                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 16:11:20, on 10/07/2009
                            Platform: Windows Vista SP1 (WinNT 6.00.1905)
                            MSIE: Internet Explorer v8.00 (8.00.6001.18702)
                            Boot mode: Normal

                            Running processes:
                            C:\Windows\system32\Dwm.exe
                            C:\Windows\Explorer.EXE
                            C:\Windows\system32\taskeng.exe
                            C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                            C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
                            C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
                            C:\Program Files\iTunes\iTunesHelper.exe
                            C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
                            C:\Program Files\Windows Sidebar\sidebar.exe
                            C:\Windows\ehome\ehtray.exe
                            C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
                            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                            C:\Program Files\PDFCreator\PDFCreator.exe
                            C:\Windows\ehome\ehmsas.exe
                            C:\Program Files\Windows Sidebar\sidebar.exe
                            C:\Windows\system32\wbem\unsecapp.exe
                            C:\Program Files\Mozilla Firefox\firefox.exe
                            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                            C:\Windows\system32\SearchFilterHost.exe

                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                            O1 - Hosts: ::1 localhost
                            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                            O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                            O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
                            O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
                            O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                            O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                            O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
                            O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
                            O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - (no file)
                            O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
                            O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                            O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - (no file)
                            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
                            O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKLM\..\Run: [F-Secure ExploitShield] "C:\Program Files\F-Secure\ExploitShield\fsesgui.exe"
                            O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                            O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
                            O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                            O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                            O4 - HKCU\..\Run: [msnlivesearch] C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
                            O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                            O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                            O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
                            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                            O4 - Global Startup: PDFCreator.lnk = C:\Program Files\PDFCreator\PDFCreator.exe
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                            O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                            O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                            O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
                            O9 - Extra button: (no name) - {49783ED4-258D-4f9f-BE11-137C18D3E543} - (no file)
                            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                            O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
                            O13 - Gopher Prefix:
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
                            O18 - Protocol: bw+0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw+0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw-0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw-0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw00 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw00s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw10 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw10s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw20 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw20s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw30 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw30s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw40 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw40s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw50 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw50s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw60 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw60s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw70 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw70s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw80 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw80s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw90 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bw90s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwa0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwa0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwb0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwb0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwc0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwc0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwd0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwd0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwe0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwe0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwf0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwf0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                            O18 - Protocol: bwg0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwg0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwh0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwh0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwi0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwi0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwj0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwj0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwk0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwk0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwl0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwl0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwm0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwm0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwn0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwn0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwo0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwo0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwp0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwp0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwq0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwq0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwr0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwr0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bws0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bws0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwt0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwt0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwu0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwu0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwv0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwv0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bww0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bww0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwx0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwx0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwy0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwy0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwz0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: bwz0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
                            O18 - Protocol: offline-8876480 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                            O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
                            O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
                            O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
                            O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                            O23 - Service: F-Secure Exploit Shield Service (ExploitShield) - F-Secure Corporation - C:\Program Files\F-Secure\ExploitShield\fsessrv.exe
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
                            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                            O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
                            O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                            O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                            O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                            O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                            O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
                            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                            O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
                            O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
                            O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                            O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                            O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                            2. Utilisateur anonyme
                              ok, pas de soucis
                              quand tu revient fais ceci :

                              télécharge GenProc sur ton bureau :
                              http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip
                              ou ici : http://www.genproc.com/GenProc.exe
                              dézippe le dossier, double-clique sur GenProc.bat
                              poste le contenu du rapport qui s'ouvre

                              Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html
                              poste son rapport ici

                              à +
                              1. bleurk Auteur
                                voila le rapport
                                Rapport GenProc 2.602 [1] - 10/07/2009 à 17:45:32
                                @ Windows Vista Service Pack 1 - Mode normal
                                @ Mozilla Firefox (3.0.11) [Navigateur par défaut]

                                GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

                                Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
                                - coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
                                - C:\Program Files\EsetOnlineScanner\log.txt

                                ~~~~ INFORMATION COMPLEMENTAIRE ~~~~

                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 17:46:19, on 10/07/2009
                                Platform: Windows Vista SP1 (WinNT 6.00.1905)
                                MSIE: Internet Explorer v8.00 (8.00.6001.18702)
                                Boot mode: Normal

                                Running processes:
                                C:\Windows\system32\Dwm.exe
                                C:\Windows\Explorer.EXE
                                C:\Windows\system32\taskeng.exe
                                C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                                C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
                                C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
                                C:\Program Files\iTunes\iTunesHelper.exe
                                C:\Program Files\F-Secure\ExploitShield\fsesgui.exe
                                C:\Program Files\Windows Sidebar\sidebar.exe
                                C:\Windows\ehome\ehtray.exe
                                C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
                                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                C:\Program Files\PDFCreator\PDFCreator.exe
                                C:\Windows\ehome\ehmsas.exe
                                C:\Program Files\Windows Sidebar\sidebar.exe
                                C:\Windows\system32\wbem\unsecapp.exe
                                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                                C:\Program Files\Mozilla Firefox\firefox.exe
                                C:\Windows\system32\SearchFilterHost.exe
                                C:\Windows\system32\cmd.exe
                                C:\Windows\system32\conime.exe
                                C:\GenProc\outil\johnny_GenProc.exe

                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                                O1 - Hosts: ::1 localhost
                                O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                                O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
                                O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
                                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                                O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                                O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
                                O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
                                O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - (no file)
                                O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
                                O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                                O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - (no file)
                                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
                                O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                O4 - HKLM\..\Run: [F-Secure ExploitShield] "C:\Program Files\F-Secure\ExploitShield\fsesgui.exe"
                                O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                                O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
                                O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                                O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                                O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                O4 - HKCU\..\Run: [msnlivesearch] C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
                                O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
                                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                                O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                                O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                                O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
                                O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                                O4 - Global Startup: PDFCreator.lnk = C:\Program Files\PDFCreator\PDFCreator.exe
                                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                                O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                                O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
                                O9 - Extra button: (no name) - {49783ED4-258D-4f9f-BE11-137C18D3E543} - (no file)
                                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
                                O13 - Gopher Prefix:
                                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
                                O18 - Protocol: bw+0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw+0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw-0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw-0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw00 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw00s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw10 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw10s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw20 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw20s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw30 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw30s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw40 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw40s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw50 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw50s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw60 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw60s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw70 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw70s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw80 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw80s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw90 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bw90s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwa0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwa0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwb0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwb0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwc0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwc0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwd0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwd0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwe0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwe0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwf0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwf0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                                O18 - Protocol: bwg0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwg0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwh0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwh0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwi0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwi0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwj0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwj0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwk0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwk0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwl0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwl0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwm0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwm0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwn0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwn0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwo0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwo0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwp0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwp0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwq0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwq0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwr0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwr0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bws0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bws0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwt0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwt0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwu0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwu0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwv0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwv0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bww0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bww0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwx0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwx0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwy0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwy0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwz0 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: bwz0s - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
                                O18 - Protocol: offline-8876480 - {2E1C31C2-8A6F-4CE6-AD09-DD880558C06B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
                                O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                                O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
                                O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
                                O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                                O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                                O23 - Service: F-Secure Exploit Shield Service (ExploitShield) - F-Secure Corporation - C:\Program Files\F-Secure\ExploitShield\fsessrv.exe
                                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
                                O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                                O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                                O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
                                O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                                O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                                O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                                O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
                                O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
                                O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
                                O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                                O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                                O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                                1. Utilisateur anonyme
                                  déjà on va supprimer le restant de norton de ton pc :

                                  Pour désinstaller Norton
                                  http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
                                  • 1
                                  • 2
                                  • 3

                                  Discussions similaires

                                  Aide pour un virus
                                  cerise92700

                                  41 réponses
                                  Trojan impossible à supprimer!
                                  Gridouu

                                  12 réponses
                                  Comment supprimer le virus Trojan
                                  vitsou

                                  18 réponses
                                  Cheval de Troie- e.tre456.worm.windows
                                  Ninou037

                                  13 réponses
                                  trojan-spy.win32@mx
                                  caramel79

                                  3 réponses