Recherche Google redirigé vers Yahoo?§§

oui

Voila le resultat :
Rapport GenProc 2.613 [1] - 11/08/2009 à 11:25:02
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.5.2) [Navigateur par défaut]

# Etape 1/ Télécharge :

- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- WORT http://pc-system.fr/ (dj QUIOU) sur le Bureau.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

- ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau.
Désactive ton antivirus, ton pare-feu et ferme tes programmes en cours. Lance combofix.exe et accepte les termes en cliquant sur OUI. Patiente. Au message "ComboFix a détecté que la 'console de récupération Windows' n'existe pas sur ce PC", clique sur oui puis sur OK, puis patiente. Valide le CLUF Microsoft. Au message "La console de récupération a été installée avec succès", clique impérativement sur NON pour quitter le programme (ferme également le rapport CF-RC.txt qui s'est ouvert)

- MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau.

- USBFix http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe (Chiquitine29) sur le Bureau, et procède simplement à son installation.

Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; Choisis ta session courante *** CHECHO *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).

# Etape 2/

Lance Toolbar-S&D situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/

Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le Bureau. Exécute l'option R : si l'infection est détectée, exécute l'option N. Sauvegarde ce rapport sur ton bureau.

# Etape 4/

Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectées sans les ouvrir, puis double-clique sur le raccourci USBFix présent sur ton Bureau : choisis l' option 2 (Suppression), ton bureau disparaitra et le pc redémarrera. Au redémarrage, USBFix scannera ton pc, laisse travailler l'outil.

# Etape 5/

Double-clique sur le fichier WORT.exe et sélectionne le Bureau à l'aide du bouton "Parcourir". Suis les instructions et double-clique sur le fichier Wareout Removal Tool.bat qui vient d'être créé sur le Bureau. Sélectionne l'option 1 et valide par entrée.

# Etape 6/

Double clique sur combofix.exe et suis les instructions. Attention de ne pas utiliser ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne au risque de figer l'ordinateur.

# Etape 7/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 8/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport Combofix.txt situé dans C:\ ;
- Le contenu du rapport msnfix.txt situé dans C:\WINDOWS ;
- Le contenu du rapport TB.txt situé dans C:\ ;
- Le contenu du rapport WORT_report.txt situé dans C:\Wort ;
- Le contenu du rapport UsbFix.txt situé dans C:\ ;
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~

# Détections [1] GenProc 2.613 11/08/2009 à 11:25:35
WareOut:le 11/08/2009 à 11:27:23
[HKEY_LOCAL_MACHINE\system\controlset003\services\tcpip\parameters\interfaces\{CF08BBF9-509F-48E6-817B-E7724D700C6E}]
NameServer REG_SZ 85.255.112.139,85.255.112.136
Toolbar:le 11/08/2009 à 11:27:26 "C:\Program Files\AskSBar"
Vundo:le 11/08/2009 à 11:27:27 "C:\WINDOWS\system32\*.bak1"
MSNFix:le 11/08/2009 à 11:27:34 "C:\WINDOWS\cookies.ini"
USBFix:le 11/08/2009 à 11:27:34 "C:\WINDOWS\cookies.ini"

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 11:28:45 ~~

fait tous ça sauf MSNfix

Je vais essayer, mais pas sur d'y arriver. Un peu compliqué la solution!!!

Re Bonjour!
NON! ca n'a pas marche, le problème est la!!
J'ai même restauré sur des dates antérieures...mais non!!
Bizarre tout ca!!
Si t'a un autre idée,sera la bienvenue!!!
MERCI d'avance!

- Le contenu du rapport Combofix.txt situé dans C:\ ;
- Le contenu du rapport TB.txt situé dans C:\ ;
- Le contenu du rapport WORT_report.txt situé dans C:\Wort ;
- Le contenu du rapport UsbFix.txt situé dans C:\ ;
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

Les voici:
ComboFix 09-08-10.04 - CHECHO 11/08/2009 12:27.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2046.1128 [GMT 2:00]
Running from: c:\documents and settings\CHECHO\Mes documents\Achats Internet\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090810-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
c:\documents and settings\CHECHO\Application Data\inst.exe
c:\windows\cookies.ini
c:\windows\Installer\2671f2.msi
c:\windows\Installer\29747ae2.msi
c:\windows\Installer\32c7d1.msi
c:\windows\Installer\7dbc840.msp
c:\windows\Installer\7dbc845.msp
c:\windows\kb913800.exe
c:\windows\system32\abadd.bak1
c:\windows\system32\abadd.bak2
c:\windows\system32\abadd.ini
c:\windows\system32\abadd.ini2
c:\windows\system32\abadd.tmp
c:\windows\system32\adufyfvt.ini
c:\windows\system32\aiokbbhk.ini
c:\windows\system32\ajhhdsno.ini
c:\windows\system32\ajmfiqkb.ini
c:\windows\system32\aqyxtulc.ini
c:\windows\system32\cksfxyix.ini
c:\windows\system32\djwybchy.ini
c:\windows\system32\dtdulpkd.ini
c:\windows\system32\enclrsoc.ini
c:\windows\system32\eusqnjtc.ini
c:\windows\system32\fcvgkfcl.ini
c:\windows\system32\fvauqdaq.ini
c:\windows\system32\fxjjokgn.ini
c:\windows\system32\fyykulvh.ini
c:\windows\system32\hatechus.ini
c:\windows\system32\hllnmojt.ini
c:\windows\system32\hntyeiud.ini
c:\windows\system32\hxjortkp.ini
c:\windows\system32\iknknqbk.ini
c:\windows\system32\imjhukoh.ini
c:\windows\system32\iwbamimp.ini
c:\windows\system32\jbtidtrq.ini
c:\windows\system32\jcbvocxt.ini
c:\windows\system32\jkofqsto.ini
c:\windows\system32\jyhfagbw.ini
c:\windows\system32\kgphbgdd.ini
c:\windows\system32\lfsknrfm.ini
c:\windows\system32\lvpvxhis.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\mhorlwaw.ini
c:\windows\system32\micavjpd.ini
c:\windows\system32\mijokvao.ini
c:\windows\system32\miwnktwt.ini
c:\windows\system32\MSIVXcount
c:\windows\system32\nkbcjwjd.ini
c:\windows\system32\ogxngsxd.ini
c:\windows\system32\omaxwwva.ini
c:\windows\system32\omcuaubx.ini
c:\windows\system32\ooptdsho.ini
c:\windows\system32\oqtwa.bak1
c:\windows\system32\oqtwa.bak2
c:\windows\system32\oqtwa.ini
c:\windows\system32\oqtwa.ini2
c:\windows\system32\oqtwa.tmp
c:\windows\system32\oyoejvqe.ini
c:\windows\system32\plaewkye.ini
c:\windows\system32\psjwfcfv.ini
c:\windows\system32\pwnaubpd.ini
c:\windows\system32\rceiuspg.ini
c:\windows\system32\rlhgcxyb.ini
c:\windows\system32\roehlaan.ini
c:\windows\system32\rtlhhrpn.ini
c:\windows\system32\smnbqjid.ini
c:\windows\system32\uakmkjpv.ini
c:\windows\system32\uhnhoqgt.ini
c:\windows\system32\vflxoqsh.ini
c:\windows\system32\vjjnjahp.ini
c:\windows\system32\vkqspaae.ini
c:\windows\system32\vpbbaelm.ini
c:\windows\system32\vtxcosrn.ini
c:\windows\system32\wjbqerjr.ini
c:\windows\system32\wknexker.ini
c:\windows\system32\xbupivgr.ini
c:\windows\system32\xebsdftr.ini
c:\windows\system32\xrbnnrcx.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DOMAINSERVICE
-------\Legacy_MSIVXSERV.SYS
-------\Service_MSIVXserv.sys

((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.

2009-08-11 10:21 . 2009-08-11 10:21 -------- dc----w- C:\ToolBar SD
2009-08-11 10:17 . 2009-08-11 10:17 -------- d-----w- c:\program files\CCleaner
2009-08-11 09:24 . 2009-08-11 09:24 -------- dc----w- C:\Genproc
2009-08-10 13:29 . 2009-08-10 13:29 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-10 13:28 . 2009-08-10 13:28 152576 ----a-w- c:\documents and settings\CHECHO\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-09 15:17 . 2009-08-09 15:17 -------- d-----w- c:\program files\iPod
2009-08-09 15:17 . 2009-08-09 15:18 -------- d-----w- c:\program files\iTunes
2009-08-09 15:07 . 2009-08-09 15:07 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-08-06 16:55 . 2009-08-06 16:55 -------- d-----w- c:\program files\La Chaîne Météo
2009-08-03 13:21 . 2009-08-03 13:21 -------- d-----w- c:\documents and settings\CHECHO\Application Data\Ambient Design
2009-08-02 10:28 . 2009-08-02 10:36 -------- d-----w- c:\program files\Corel
2009-08-02 10:17 . 2009-08-02 10:17 -------- d-----w- c:\program files\Seagrand
2009-08-02 10:13 . 2009-08-02 10:14 -------- d-----w- c:\program files\Paint.NET
2009-08-02 10:13 . 2009-08-03 12:52 -------- d-----w- c:\documents and settings\CHECHO\Local Settings\Application Data\Paint.NET
2009-08-01 19:06 . 2009-08-01 19:08 -------- d-----w- c:\documents and settings\CHECHO\Application Data\PhotoFiltre Studio X
2009-08-01 19:06 . 2009-08-01 19:06 -------- d-----w- c:\program files\PhotoFiltre Studio X
2009-07-30 10:59 . 2007-12-06 16:12 110592 ----a-w- c:\windows\system32\SynTPCo4.dll
2009-07-30 09:51 . 2009-07-30 09:51 21935408 ----a-w- c:\program files\QuickTimeInstaller.exe
2009-07-29 08:19 . 2009-07-29 08:19 18015723 ----a-w- c:\program files\vlc-1.0.1-win32.exe
2009-07-18 22:34 . 2009-08-09 14:20 -------- d-----w- c:\documents and settings\CHECHO\Local Settings\Application Data\Temp
2009-07-16 09:58 . 2009-07-16 09:59 -------- d-----w- c:\documents and settings\CHECHO\Local Settings\Application Data\Deployment
2009-07-13 10:41 . 2009-07-13 10:41 -------- d-----w- c:\documents and settings\CHECHO\Application Data\com.adobe.example.widget.33A7EEEDEE7A114BE5163F740489DD413641A8EC.1
2009-07-13 10:41 . 2009-08-11 07:39 38208 ----a-w- c:\documents and settings\CHECHO\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-13 10:41 . 2009-08-11 07:40 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 10:46 . 2009-06-27 13:57 -------- dc----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-08-11 10:43 . 2007-12-11 15:55 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-11 10:43 . 2007-12-11 17:20 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-11 10:42 . 2009-06-27 13:57 942112 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-08-11 10:42 . 2009-06-27 13:57 87104 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-11 10:42 . 2009-06-27 13:57 5348 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-08-11 10:42 . 2009-06-27 13:57 10608672 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-11 10:41 . 2007-10-12 12:55 489 ----a-w- c:\windows\system32\mhncache.dat
2009-08-10 13:28 . 2006-10-11 04:27 -------- d-----w- c:\program files\Java
2009-08-10 13:09 . 2006-10-19 14:06 -------- d-----w- c:\documents and settings\CHECHO\Application Data\Vso
2009-08-09 15:28 . 2008-08-08 16:54 -------- d-----w- c:\program files\Safari
2009-08-09 15:17 . 2008-08-08 16:58 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-08-03 17:03 . 2006-10-14 14:28 13406 -csha-w- c:\windows\system32\KGyGaAvL.sys
2009-08-03 17:03 . 2006-10-13 14:25 -------- d-----w- c:\documents and settings\CHECHO\Application Data\Corel
2009-08-03 17:02 . 2007-09-12 11:40 248 --sh--r- c:\windows\system32\34154C61AE.sys
2009-08-03 12:36 . 2008-12-22 14:51 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-07-30 09:53 . 2008-11-27 08:07 -------- d-----w- c:\program files\QuickTime
2009-07-29 09:02 . 2006-10-14 19:25 -------- d-----w- c:\program files\Logitech
2009-07-29 09:01 . 2006-10-11 04:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-29 09:00 . 2007-08-12 17:42 -------- d-----w- c:\program files\MUSICMATCH
2009-07-28 13:22 . 2006-11-23 11:39 -------- d-----w- c:\documents and settings\CHECHO\Application Data\Canon
2009-07-27 11:38 . 2009-06-30 12:33 208616 -c--a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-07-18 18:12 . 2006-11-14 10:08 -------- d-----w- c:\documents and settings\CHECHO\Application Data\Skype
2009-07-16 09:58 . 2009-07-16 09:58 9515 ----a-w- c:\program files\DellDriverDownloadManager.application
2009-07-16 07:13 . 2006-10-11 04:15 48346 ----a-w- c:\windows\system32\nvModes.dat
2009-07-11 07:40 . 2008-08-31 21:34 -------- d-----w- c:\documents and settings\CHECHO\Application Data\uTorrent
2009-07-09 14:06 . 2006-12-28 10:51 -------- d-----w- c:\documents and settings\CHECHO\Application Data\dvdcss
2009-07-08 08:10 . 2009-07-08 08:10 17828326 ----a-w- c:\program files\vlc-1.0.0-win32.exe
2009-07-06 20:39 . 2009-07-09 09:59 937984 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2009-07-06 20:39 . 2009-07-09 09:59 106496 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
2009-07-06 20:39 . 2009-07-09 09:59 103424 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2009-07-06 20:39 . 2009-07-09 09:59 344064 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2009-07-06 20:39 . 2009-07-09 09:59 65536 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2009-07-06 20:39 . 2009-07-09 09:59 4722688 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\libs\cooliris19.dll
2009-07-04 14:16 . 2005-09-01 04:53 96764 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-04 14:16 . 2005-09-01 04:53 540958 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-04 11:54 . 2009-07-04 11:54 10909139 ----a-w- c:\program files\pfs-setup-fr-01net.exe
2009-07-02 12:40 . 2009-07-02 12:40 2424944 ----a-w- c:\program files\GoogleToolbarInstaller_en32_signed.exe
2009-07-01 10:29 . 2009-07-01 10:29 759280 ----a-w- c:\program files\Google Chrome.lnk
2009-07-01 08:01 . 2009-06-02 11:58 -------- d-----r- c:\program files\Skype
2009-07-01 07:58 . 2009-07-01 07:58 2033448 ----a-w- c:\program files\SkypeSetup.exe
2009-07-01 07:51 . 2009-07-01 07:51 8171320 ----a-w- c:\program files\Firefox Setup 3.5.exe
2009-06-30 13:46 . 2008-08-13 14:44 61224 ----a-w- c:\documents and settings\CHECHO\GoToAssistDownloadHelper.exe
2009-06-30 12:34 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-30 12:34 . 2009-06-27 13:59 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-30 12:34 . 2009-06-27 13:59 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-30 12:33 . 2009-06-30 12:33 33808 -c--a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-30 12:33 . 2009-06-30 12:33 226832 -c--a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-06-29 13:28 . 2009-07-01 07:54 106496 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Plugins\npcoolirisplugin.dll
2009-06-29 13:28 . 2009-07-01 07:54 65536 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com-trash\components\coolirisstub.dll
2009-06-29 13:28 . 2009-07-01 07:54 4734976 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com-trash\libs\cooliris19.dll
2009-06-28 15:31 . 2007-12-11 15:49 -------- d-----w- c:\program files\Fichiers communs\LogiShrd
2009-06-27 13:57 . 2009-06-27 13:57 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-27 13:42 . 2009-01-24 19:01 -------- dc----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-27 13:13 . 2009-06-27 13:09 35649608 ----a-w- c:\program files\setupfrepro.exe
2009-06-27 10:28 . 2009-06-27 10:27 7645176 ----a-w- c:\program files\Firefox Setup 3.0.11.exe
2009-06-27 09:25 . 2009-06-26 16:33 0 ----a-w- c:\program files\DMSetup.exe
2009-06-27 09:20 . 2009-06-26 15:50 1212 ----a-w- c:\program files\McAfeeOnlineServiceInfo_FR.html
2009-06-27 09:05 . 2009-06-24 13:46 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-06-26 18:09 . 2009-01-27 15:02 35391144 ----a-w- c:\program files\setupfre.exe
2009-06-26 07:10 . 2009-06-26 07:09 8171320 ----a-w- c:\program files\Firefox Setup 3.5 RC 3.exe
2009-06-25 17:50 . 2009-06-25 17:50 339257 ----a-w- c:\program files\CleanUp452.exe
2009-06-25 17:30 . 2009-06-25 17:30 3252640 ----a-w- c:\program files\ccsetup221.exe
2009-06-24 14:25 . 2009-06-24 14:25 7645176 ----a-w- c:\program files\mozilla-firefox_mozilla_firefox_3.0.11_francais_11003.exe
2009-06-24 13:46 . 2009-06-24 13:46 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-06-24 13:41 . 2008-12-22 14:50 -------- dcsh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-06-24 13:41 . 2009-06-24 13:37 17879808 ----a-w- c:\program files\TU2009TrialFR.exe
2009-06-23 14:40 . 2009-06-23 14:40 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-06-23 14:13 . 2009-06-23 14:13 -------- d-----w- c:\program files\BlueRaTech
2009-06-18 14:14 . 2009-06-22 18:59 51200 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{a6e4a4eb-d169-4e99-8988-250fcbafe767}\components\FFExternalAlert.dll
2009-06-18 14:14 . 2009-06-22 18:59 114688 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{a6e4a4eb-d169-4e99-8988-250fcbafe767}\components\npmozax.dll
2009-06-17 05:59 . 2008-10-16 13:21 -------- dc----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-16 13:10 . 2006-10-19 14:55 -------- d-----w- c:\documents and settings\CHECHO\Application Data\BitTorrent
2009-06-15 15:44 . 2009-06-18 07:09 90112 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\entbcompose.dll
2009-06-15 15:44 . 2009-06-18 07:09 245760 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\enclip.dll
2009-06-15 15:44 . 2009-06-18 07:09 167936 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\enbar3.dll
2009-06-15 15:44 . 2009-06-18 07:09 114688 ----a-w- c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\ENImaDLL.dll
2009-06-02 11:55 . 2009-06-02 11:54 1988392 ----a-w- c:\program files\SkypeSetup-Beta.exe
2009-06-02 11:47 . 2009-06-02 11:47 18932358 ----a-w- c:\program files\vlc-1.0.0-rc2-win32.exe
2009-05-29 11:36 . 2009-03-13 18:44 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 11:36 . 2007-09-17 10:20 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-24 22:24 . 2008-05-26 20:18 350208 ------w- c:\windows\system32\mssph.dll
2009-05-24 12:41 . 2009-02-02 11:54 12473256 ----a-w- c:\program files\copytodvd4_setup.exe
2009-05-22 06:38 . 2008-08-10 18:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-04-16 18:18 . 2009-04-16 18:13 20475688 ----a-w- c:\program files\SkypeSetupFull.exe
2009-04-13 18:47 . 2009-04-13 18:47 547488 ----a-w- c:\program files\GoogleEarthProSetup.exe
2009-04-13 18:37 . 2009-04-13 18:37 1075832 ----a-w- c:\program files\Google Updater.exe
2009-04-13 18:37 . 2009-04-13 18:37 547488 ----a-w- c:\program files\GoogleEarthPluginSetup.exe
2009-04-13 18:36 . 2009-04-13 18:36 547480 ----a-w- c:\program files\GoogleEarthSetup.exe
2009-04-06 18:46 . 2009-04-06 18:46 476696 ----a-w- c:\program files\RealPlayer11GOLD_fr.exe
2009-04-03 14:58 . 2009-04-03 14:57 16742799 ----a-w- c:\program files\vlc-0.9.9-win32.exe
2009-03-03 11:56 . 2009-03-03 11:55 6059667 ----a-w- c:\program files\agenduswinouedsetup.exe
2009-03-03 11:52 . 2006-10-25 18:27 5753717 ----a-w- c:\program files\agenduswinpdedsetup.exe
2009-02-19 19:01 . 2009-02-19 18:32 25839688 ----a-w- c:\program files\wmp11-windowsxp-x86-FR-FR.exe
2009-02-07 15:06 . 2009-02-07 15:06 956344 ----a-w- c:\program files\SaveAsPDFandXPS.exe
2009-01-31 18:49 . 2009-01-31 18:48 16973664 ----a-w- c:\program files\IE8-WindowsXP-x86-FRA.exe
2009-01-31 18:32 . 2009-01-31 18:32 10999224 ----a-w- c:\program files\word2007-kb934173-fullfile-x86-glb.exe
2009-01-31 18:27 . 2009-01-31 18:27 15161032 ----a-w- c:\program files\outlook2007-kb950219-fullfile-x86-fr-fr.exe
2008-12-30 17:00 . 2008-10-24 15:21 1851544 ----a-w- c:\program files\install_flash_player.exe
2008-12-30 16:10 . 2008-10-24 09:26 14771744 ----a-w- c:\program files\IE7-WindowsXP-x86-fra.exe
2008-12-20 14:15 . 2007-07-13 17:46 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-12-31 16:53 . 2006-10-14 14:31 56 --sh--r- c:\windows\system32\758928A9F6.sys
2007-08-25 09:24 . 2007-08-25 09:24 1255101 --sh--w- c:\windows\system32\ajgsbqoe.tmp
2007-07-11 13:04 . 2006-10-14 14:28 88 -csh--r- c:\windows\system32\F6A9288975.sys
2007-08-27 17:16 . 2007-08-27 17:16 23 --sha-w- c:\windows\system32\fadcbfeccaf7_r.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-09-03 17:46 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 68856]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2009\MemOptimizer.exe" [2009-04-27 163072]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-12-20 29744]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-07-27 208616]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-28 8429568]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-20 177472]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-10 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\CHECHO\Menu D‚marrer\Programmes\D‚marrage\
La ChaŒne M‚t‚o.lnk - c:\program files\La ChaŒne M‚t‚o\La ChaŒne M‚t‚o.exe [2009-8-6 95744]

c:\documents and settings\CHECHO\Menu D‚marrer\Programmes\D‚marrage\
La ChaŒne M‚t‚o.lnk - c:\program files\La ChaŒne M‚t‚o\La ChaŒne M‚t‚o.exe [2009-8-6 95744]

c:\documents and settings\CHECHO\Menu D‚marrer\Programmes\D‚marrage\
La ChaŒne M‚t‚o.lnk - c:\program files\La ChaŒne M‚t‚o\La ChaŒne M‚t‚o.exe [2009-8-6 95744]

c:\documents and settings\CHECHO\Menu D‚marrer\Programmes\D‚marrage\
La ChaŒne M‚t‚o.lnk - c:\program files\La ChaŒne M‚t‚o\La ChaŒne M‚t‚o.exe [2009-8-6 95744]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-13 14:44 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-05-25 13:22 63040 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\I:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Espace Client"=c:\progra~1\Wanadoo\GestionnaireInternet.exe msg
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"Eraser"=c:\program files\Eraser\Eraser.exe -hide
"Mozilla Thunderbird"=c:\program files\Mozilla Thunderbird\thunderbird.exe -mail
"eMuleAutoStart"=c:\program files\eMule\emule.exe -AutoStart
"Copernic Desktop Search 2"="c:\program files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"
"Windows Media Player"=c:\program files\Windows Media Player\wmplayer.exe
"BitTorrent"="c:\program files\BitTorrent\bittorrent.exe"
"Firefox"=c:\program files\Mozilla Firefox\firefox.exe
"Internet Explorer"=c:\program files\Internet Explorer\iexplore.exe
"Winamp"=c:\program files\Winamp\winamp.exe
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"iTunes"=c:\program files\iTunes\iTunes.exe
"Microsoft Office Outlook"=c:\progra~1\MICROS~3\Office12\OUTLOOK.EXE /recycle
"Outlook Express"=c:\program files\Outlook Express\msimn.exe
"uTorrent"="c:\program files\uTorrent\uTorrent.exe"
"Widget LOTO"="c:\program files\fdjeux\Widget LOTO\launcher.exe"
"Copernic Desktop Search - Home"="c:\program files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" -s
"Firefox325"=c:\program files\Mozilla Firefox\firefox.exe
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" -bootmode
"Google Update"="c:\documents and settings\CHECHO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WOOTASKBARICON"=c:\progra~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
"WOOWATCH"=c:\progra~1\Wanadoo\Watch.exe
"ehTray"=c:\windows\ehome\ehtray.exe
"NVHotkey"=rundll32.exe nvHotkey.dll,Start
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
"SigmatelSysTrayApp"=stsystra.exe
"MSOffice"=rundll32.exe "c:\windows\system32\avwwxamo.dll",sitypnow
"Corel Photo Downloader"="c:\program files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"SearchIndexer"=rundll32.exe "c:\windows\system32\yhcbywjd.dll",sitypnow
"nwiz"=nwiz.exe /installquiet
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
"Creative WebCam Tray"=c:\program files\Creative\Shared Files\CamTray.exe
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" /hide
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe"
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit
"Logitech Utility"=Logi_MwX.Exe
"SynTPEnh"=c:\program files\Synaptics\SynTP\SynTPEnh.exe
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\e-Carte Bleue Banque Populaire\\ecbl-nxbp.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 33808]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [27/06/2009 18:23 114768]
R1 DCDisk;DCDisk;c:\windows\system32\drivers\DCDisk.sys [24/08/2007 10:54 50606]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27/06/2009 18:23 20560]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [08/08/2007 17:16 46112]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [30/07/2007 17:16 2368]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/04/2009 13:57 92008]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S2 gupdate1c9bc68816515b5;Google Update Service (gupdate1c9bc68816515b5);c:\program files\Google\Update\GoogleUpdate.exe [13/04/2009 20:48 133104]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 exdisk;Express Disk Service;c:\windows\system32\DRIVERS\exdisk.sys --> c:\windows\system32\DRIVERS\exdisk.sys [?]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [13/07/2007 19:46 29744]
S3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\drivers\P1130Vid.sys [23/10/2007 15:00 90229]
S3 v800bus;Sony Ericsson V800-Vodafone 802SE driver (WDM);c:\windows\system32\drivers\v800bus.sys [30/08/2004 13:55 52416]
S3 v800mdfl;Sony Ericsson V800-Vodafone 802SE USB WMC Modem Filter;c:\windows\system32\drivers\v800mdfl.sys [30/08/2004 13:55 6160]
S3 v800mdm;Sony Ericsson V800-Vodafone 802SE USB WMC Modem Driver;c:\windows\system32\drivers\v800mdm.sys [30/08/2004 13:55 84544]
S3 v800mgmt;Sony Ericsson V800-Vodafone 802SE USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\v800mgmt.sys [30/08/2004 13:55 77760]
S3 v800obex;Sony Ericsson V800-Vodafone 802SE USB WMC OBEX Interface;c:\windows\system32\drivers\v800obex.sys [30/08/2004 13:55 75584]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-13 18:48]

2009-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-13 18:48]

2009-08-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3642955836-2522512011-1508442211-1005Core.job
- c:\documents and settings\CHECHO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-20 22:20]

2009-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3642955836-2522512011-1508442211-1005UA.job
- c:\documents and settings\CHECHO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-20 22:20]

2009-08-11 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:42]

2009-08-11 c:\windows\Tasks\User_Feed_Synchronization-{E473248A-5544-4481-BDBE-25CA8B43D2B1}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

2009-08-10 c:\windows\Tasks\VSO Task ackupToDVD0474594322E2254.job
- c:\progra~1\VSO\BACKUP~1\BackupToDVD.exe [2007-10-12 09:56]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
Notify-ddaba - (no file)

.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/ig
mStart Page = hxxp://www.tropal.net/
uInternet Settings,ProxyOverride = localhost;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Page à noter (Google Bloc-notes) - c:\program files\Google\Google Notebook\gnotes1.0.2.19-1118010007.dll/gn_menu1.html
IE: À noter (Google Bloc-notes) - c:\program files\Google\Google Notebook\gnotes1.0.2.19-1118010007.dll/gn_menu2.html
IE: { - c:\program files\Messenger\msmsgs.exe
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - UserLogos
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox
FF - component: c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{a6e4a4eb-d169-4e99-8988-250fcbafe767}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\enbar3.dll
FF - component: c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Copernic Desktop Search 2\FirefoxConnector\components\CSPXPCOMBridge.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\CHECHO\Application Data\Mozilla\Firefox\Profiles\labumrlv.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\CHECHO\Application Data\Mozilla\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\CHECHO\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service

FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 12:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,6b,49,8d,f5,ec,d7,40,be,b5,50,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,6b,49,8d,f5,ec,d7,40,be,b5,50,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1216)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(3304)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\program files\ArcSoft\Software Suite\PhotoImpression\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\LMIRfsClientNP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\msdtc.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\FTRTSVC.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\program files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PSIService.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\locator.exe
c:\windows\system32\vssvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\dllhost.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2009-08-11 13:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-11 10:58

Pre-Run: 15 855 165 440 octets libres
Post-Run: 15 986 987 008 octets libres

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
559 --- E O F --- 2009-06-17 06:00

Initialisation GenProc 2.613 [11/08/2009] à [13:05:03]

*** Variables initiales SET et temporaires ***

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\CHECHO\Application Data
Arguments=C:\Genproc\Arguments
Canned=C:\Genproc\Canned
ChangeLog=C:\Genproc\ChangeLog
CheminBatch=C:\Genproc
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
ComptBagle=0
ComptFixWebHancer=0
ComptFxNdotN=0
ComptHaxfix=0
ComptLook2Me=0
ComptLop=0
ComptMBR=0
ComptMSNfix=0
ComptNavipromo=0
ComptPurity=0
ComptRemGAIN=0
ComptRustock=0
ComptSDfix=0
ComptSmitfraud=0
ComptTDSS=0
ComptToolbarSD=0
ComptUSBFix=0
ComptVundo=0
ComptWareOut=0
ComptWinSoftware=0
ComptYoog=0
COMPUTERNAME=INSPIRON9400
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
GenProcVersion=2.613
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\CHECHO
LOGONSERVER=\\INSPIRON9400
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
outil=C:\Genproc\outil
Page=C:\Genproc\Page
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\Fichiers communs\GIS\Tools;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3;C:\Program Files\Smart Projects\IsoBuster;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\CHECHO\LOCALS~1\Temp
TMP=C:\DOCUME~1\CHECHO\LOCALS~1\Temp
USERDOMAIN=INSPIRON9400
USERNAME=CHECHO
USERPROFILE=C:\Documents and Settings\CHECHO
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI

*** Liste des composants GenProc ***

C:\Genproc\Arguments
C:\Genproc\Canned
C:\Genproc\ChangeLog
C:\Genproc\GenProc.bat
C:\Genproc\outil
C:\Genproc\Page
C:\Genproc\Arguments\Argument.html
C:\Genproc\Arguments\Argument.txt
C:\Genproc\Arguments\Debug.txt
C:\Genproc\Arguments\design.css
C:\Genproc\Arguments\GenProc[1].txt
C:\Genproc\Arguments\Uninstall.html
C:\Genproc\Arguments\Uninstall.txt
C:\Genproc\Canned\ASquared.txt
C:\Genproc\Canned\Bagle2_Dl.txt
C:\Genproc\Canned\bfu_Dl.txt
C:\Genproc\Canned\CCleaner_48H.txt
C:\Genproc\Canned\CCleaner_Dl.txt
C:\Genproc\Canned\CCleaner_Exec.txt
C:\Genproc\Canned\FixWebHancer_Dl.txt
C:\Genproc\Canned\FixWebHancer_Exec.txt
C:\Genproc\Canned\FxNdotN_Dl.txt
C:\Genproc\Canned\FxNdotN_Exec.txt
C:\Genproc\Canned\HaxFix_Dl.txt
C:\Genproc\Canned\HaxFix_Exec.txt
C:\Genproc\Canned\Look2me_Dl.txt
C:\Genproc\Canned\Look2me_Exec.txt
C:\Genproc\Canned\Lop_Dl.txt
C:\Genproc\Canned\Lop_Exec.txt
C:\Genproc\Canned\MBR_Dl.txt
C:\Genproc\Canned\MBR_Exec.txt
C:\Genproc\Canned\MSE.txt
C:\Genproc\Canned\MSNfix_Dl.txt
C:\Genproc\Canned\MSNfix_Exec.txt
C:\Genproc\Canned\Navilog1_Dl.txt
C:\Genproc\Canned\Navilog1_Exec.txt
C:\Genproc\Canned\Purity_Dl.txt
C:\Genproc\Canned\Purity_Exec.txt
C:\Genproc\Canned\RemGAIN_Dl.txt
C:\Genproc\Canned\RemGAIN_Exec.txt
C:\Genproc\Canned\Rustock_Dl.txt
C:\Genproc\Canned\ScanAntivirusNod32.txt
C:\Genproc\Canned\ScanAntivirusPanda.txt
C:\Genproc\Canned\SDfix_Dl.txt
C:\Genproc\Canned\SDfix_Exec.txt
C:\Genproc\Canned\SmitfraudFix_Dl.txt
C:\Genproc\Canned\SmitfraudFix_Exec.txt
C:\Genproc\Canned\SpywareTerminator.txt
C:\Genproc\Canned\TeaTimer.txt
C:\Genproc\Canned\ToolbarSD_Dl.txt
C:\Genproc\Canned\ToolbarSD_Exec.txt
C:\Genproc\Canned\ToolCleaner.txt
C:\Genproc\Canned\USBFix_Dl.txt
C:\Genproc\Canned\USBFix_Exec.txt
C:\Genproc\Canned\Vundo_Dl.txt
C:\Genproc\Canned\Vundo_Exec.txt
C:\Genproc\Canned\Vundo_Recovery_Dl.txt
C:\Genproc\Canned\Winsoftware_bfu_Dl.txt
C:\Genproc\Canned\Winsoftware_bfu_Exec.txt
C:\Genproc\Canned\WORT_Dl.txt
C:\Genproc\Canned\WORT_Exec.txt
C:\Genproc\Canned\Yoog_Dl.txt
C:\Genproc\Canned\Yoog_Exec.txt
C:\Genproc\ChangeLog\BagleLog.txt
C:\Genproc\ChangeLog\FixWebHancerLog.txt
C:\Genproc\ChangeLog\FxNdotNLog.txt
C:\Genproc\ChangeLog\HaxFixLog.txt
C:\Genproc\ChangeLog\Look2MeLog.txt
C:\Genproc\ChangeLog\LopLog.txt
C:\Genproc\ChangeLog\MSNFixLog.txt
C:\Genproc\ChangeLog\NaviLog.txt
C:\Genproc\ChangeLog\PathFF.txt
C:\Genproc\ChangeLog\Profils_FF.txt
C:\Genproc\ChangeLog\PurityLog.txt
C:\Genproc\ChangeLog\RemGainLog.txt
C:\Genproc\ChangeLog\RustockLog.txt
C:\Genproc\ChangeLog\SDfixLog.txt
C:\Genproc\ChangeLog\SmitLog.txt
C:\Genproc\ChangeLog\TDSSLog.txt
C:\Genproc\ChangeLog\ToolbarSDLog.txt
C:\Genproc\ChangeLog\USBFixLog.txt
C:\Genproc\ChangeLog\VundoLog.txt
C:\Genproc\ChangeLog\WareOutLog.txt
C:\Genproc\ChangeLog\WinSoftware.txt
C:\Genproc\ChangeLog\YoogLog.txt
C:\Genproc\ChangeLog\YoogLog1.txt
C:\Genproc\ChangeLog\YoogLogFF.txt
C:\Genproc\outil\1.txt
C:\Genproc\outil\Affichages.bat
C:\Genproc\outil\Arborescence.txt
C:\Genproc\outil\CCleanerOK.txt
C:\Genproc\outil\Cherche_Navig.bat
C:\Genproc\outil\commandes.sed
C:\Genproc\outil\CompareDate.bat
C:\Genproc\outil\Complement_Infection.bat
C:\Genproc\outil\curl.exe
C:\Genproc\outil\DateInst.txt
C:\Genproc\outil\Debug.bat
C:\Genproc\outil\EnableWSH.bat
C:\Genproc\outil\EpurOS.bat
C:\Genproc\outil\Exclusions.sed
C:\Genproc\outil\Exe.txt
C:\Genproc\outil\GenVbs.bat
C:\Genproc\outil\GetVersion.exe
C:\Genproc\outil\grep.exe
C:\Genproc\outil\HTTP_Request.bat
C:\Genproc\outil\icon_genproc.ico
C:\Genproc\outil\inf.txt
C:\Genproc\outil\Infection.bat
C:\Genproc\outil\Init_Debug.bat
C:\Genproc\outil\lab.bat
C:\Genproc\outil\Lancements.bat
C:\Genproc\outil\libiconv2.dll
C:\Genproc\outil\libintl3.dll
C:\Genproc\outil\Licence
C:\Genproc\outil\mbr.exe
C:\Genproc\outil\message.vbs
C:\Genproc\outil\OSVers.bat
C:\Genproc\outil\Parameters.txt
C:\Genproc\outil\pcre3.dll
C:\Genproc\outil\regex2.dll
C:\Genproc\outil\Resident.bat
C:\Genproc\outil\sed.exe
C:\Genproc\outil\Son.vbs
C:\Genproc\outil\Supprime.bat
C:\Genproc\outil\swreg.exe
C:\Genproc\outil\Termine.wav
C:\Genproc\outil\Uninstall.bat
C:\Genproc\outil\uniq.exe
C:\Genproc\outil\Var.bat
C:\Genproc\outil\Web.bat
C:\Genproc\outil\[1].txt
C:\Genproc\outil\Licence\copying.txt
C:\Genproc\outil\Licence\license.txt
C:\Genproc\Page\GenProcPage
C:\Genproc\Page\GenProc[1].html
C:\Genproc\Page\GenProcPage\1.gif
C:\Genproc\Page\GenProcPage\2.gif
C:\Genproc\Page\GenProcPage\4.gif
C:\Genproc\Page\GenProcPage\aide.gif
C:\Genproc\Page\GenProcPage\design.css
C:\Genproc\Page\GenProcPage\important.gif

*** Liste des étapes franchies avec succès ***

EnableWSH
OSVers
AVNorton
EpurOS.bat
Var.bat
Lancements
Protections résidentes
TeaTimer
SpywareTerminator
ASquared
Verif CCleaner
CM_Dl
Initialisation GenProc 2.613 [11/08/2009] à [13:05:03]

*** Variables initiales SET et temporaires ***

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\CHECHO\Application Data
Arguments=C:\Genproc\Arguments
Canned=C:\Genproc\Canned
ChangeLog=C:\Genproc\ChangeLog
CheminBatch=C:\Genproc
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
ComptBagle=0
ComptFixWebHancer=0
ComptFxNdotN=0
ComptHaxfix=0
ComptLook2Me=0
ComptLop=0
ComptMBR=0
ComptMSNfix=0
ComptNavipromo=0
ComptPurity=0
ComptRemGAIN=0
ComptRustock=0
ComptSDfix=0
ComptSmitfraud=0
ComptTDSS=0
ComptToolbarSD=0
ComptUSBFix=0
ComptVundo=0
ComptWareOut=0
ComptWinSoftware=0
ComptYoog=0
COMPUTERNAME=INSPIRON9400
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
GenProcVersion=2.613
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\CHECHO
LOGONSERVER=\\INSPIRON9400
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
outil=C:\Genproc\outil
Page=C:\Genproc\Page
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\Fichiers communs\GIS\Tools;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3;C:\Program Files\Smart Projects\IsoBuster;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\CHECHO\LOCALS~1\Temp
TMP=C:\DOCUME~1\CHECHO\LOCALS~1\Temp
USERDOMAIN=INSPIRON9400
USERNAME=CHECHO
USERPROFILE=C:\Documents and Settings\CHECHO
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI

*** Liste des composants GenProc ***

C:\Genproc\Arguments
C:\Genproc\Canned
C:\Genproc\ChangeLog
C:\Genproc\GenProc.bat
C:\Genproc\outil
C:\Genproc\Page
C:\Genproc\Arguments\Argument.html
C:\Genproc\Arguments\Argument.txt
C:\Genproc\Arguments\Debug.txt
C:\Genproc\Arguments\design.css
C:\Genproc\Arguments\GenProc[1].txt
C:\Genproc\Arguments\Uninstall.html
C:\Genproc\Arguments\Uninstall.txt
C:\Genproc\Canned\ASquared.txt
C:\Genproc\Canned\Bagle2_Dl.txt
C:\Genproc\Canned\bfu_Dl.txt
C:\Genproc\Canned\CCleaner_48H.txt
C:\Genproc\Canned\CCleaner_Dl.txt
C:\Genproc\Canned\CCleaner_Exec.txt
C:\Genproc\Canned\FixWebHancer_Dl.txt
C:\Genproc\Canned\FixWebHancer_Exec.txt
C:\Genproc\Canned\FxNdotN_Dl.txt
C:\Genproc\Canned\FxNdotN_Exec.txt
C:\Genproc\Canned\HaxFix_Dl.txt
C:\Genproc\Canned\HaxFix_Exec.txt
C:\Genproc\Canned\Look2me_Dl.txt
C:\Genproc\Canned\Look2me_Exec.txt
C:\Genproc\Canned\Lop_Dl.txt
C:\Genproc\Canned\Lop_Exec.txt
C:\Genproc\Canned\MBR_Dl.txt
C:\Genproc\Canned\MBR_Exec.txt
C:\Genproc\Canned\MSE.txt
C:\Genproc\Canned\MSNfix_Dl.txt
C:\Genproc\Canned\MSNfix_Exec.txt
C:\Genproc\Canned\Navilog1_Dl.txt
C:\Genproc\Canned\Navilog1_Exec.txt
C:\Genproc\Canned\Purity_Dl.txt
C:\Genproc\Canned\Purity_Exec.txt
C:\Genproc\Canned\RemGAIN_Dl.txt
C:\Genproc\Canned\RemGAIN_Exec.txt
C:\Genproc\Canned\Rustock_Dl.txt
C:\Genproc\Canned\ScanAntivirusNod32.txt
C:\Genproc\Canned\ScanAntivirusPanda.txt
C:\Genproc\Canned\SDfix_Dl.txt
C:\Genproc\Canned\SDfix_Exec.txt
C:\Genproc\Canned\SmitfraudFix_Dl.txt
C:\Genproc\Canned\SmitfraudFix_Exec.txt
C:\Genproc\Canned\SpywareTerminator.txt
C:\Genproc\Canned\TeaTimer.txt
C:\Genproc\Canned\ToolbarSD_Dl.txt
C:\Genproc\Canned\ToolbarSD_Exec.txt
C:\Genproc\Canned\ToolCleaner.txt
C:\Genproc\Canned\USBFix_Dl.txt
C:\Genproc\Canned\USBFix_Exec.txt
C:\Genproc\Canned\Vundo_Dl.txt
C:\Genproc\Canned\Vundo_Exec.txt
C:\Genproc\Canned\Vundo_Recovery_Dl.txt
C:\Genproc\Canned\Winsoftware_bfu_Dl.txt
C:\Genproc\Canned\Winsoftware_bfu_Exec.txt
C:\Genproc\Canned\WORT_Dl.txt
C:\Genproc\Canned\WORT_Exec.txt
C:\Genproc\Canned\Yoog_Dl.txt
C:\Genproc\Canned\Yoog_Exec.txt
C:\Genproc\ChangeLog\BagleLog.txt
C:\Genproc\ChangeLog\FixWebHancerLog.txt
C:\Genproc\ChangeLog\FxNdotNLog.txt
C:\Genproc\ChangeLog\HaxFixLog.txt
C:\Genproc\ChangeLog\Look2MeLog.txt
C:\Genproc\ChangeLog\LopLog.txt
C:\Genproc\ChangeLog\MSNFixLog.txt
C:\Genproc\ChangeLog\NaviLog.txt
C:\Genproc\ChangeLog\PathFF.txt
C:\Genproc\ChangeLog\Profils_FF.txt
C:\Genproc\ChangeLog\PurityLog.txt
C:\Genproc\ChangeLog\RemGainLog.txt
C:\Genproc\ChangeLog\RustockLog.txt
C:\Genproc\ChangeLog\SDfixLog.txt
C:\Genproc\ChangeLog\SmitLog.txt
C:\Genproc\ChangeLog\TDSSLog.txt
C:\Genproc\ChangeLog\ToolbarSDLog.txt
C:\Genproc\ChangeLog\USBFixLog.txt
C:\Genproc\ChangeLog\VundoLog.txt
C:\Genproc\ChangeLog\WareOutLog.txt
C:\Genproc\ChangeLog\WinSoftware.txt
C:\Genproc\ChangeLog\YoogLog.txt
C:\Genproc\ChangeLog\YoogLog1.txt
C:\Genproc\ChangeLog\YoogLogFF.txt
C:\Genproc\outil\1.txt
C:\Genproc\outil\Affichages.bat
C:\Genproc\outil\Arborescence.txt
C:\Genproc\outil\CCleanerOK.txt
C:\Genproc\outil\Cherche_Navig.bat
C:\Genproc\outil\commandes.sed
C:\Genproc\outil\CompareDate.bat
C:\Genproc\outil\Complement_Infection.bat
C:\Genproc\outil\curl.exe
C:\Genproc\outil\DateInst.txt
C:\Genproc\outil\Debug.bat
C:\Genproc\outil\EnableWSH.bat
C:\Genproc\outil\EpurOS.bat
C:\Genproc\outil\Exclusions.sed
C:\Genproc\outil\Exe.txt
C:\Genproc\outil\GenVbs.bat
C:\Genproc\outil\GetVersion.exe
C:\Genproc\outil\grep.exe
C:\Genproc\outil\HTTP_Request.bat
C:\Genproc\outil\icon_genproc.ico
C:\Genproc\outil\inf.txt
C:\Genproc\outil\Infection.bat
C:\Genproc\outil\Init_Debug.bat
C:\Genproc\outil\lab.bat
C:\Genproc\outil\Lancements.bat
C:\Genproc\outil\libiconv2.dll
C:\Genproc\outil\libintl3.dll
C:\Genproc\outil\Licence
C:\Genproc\outil\mbr.exe
C:\Genproc\outil\message.vbs
C:\Genproc\outil\OSVers.bat
C:\Genproc\outil\Parameters.txt
C:\Genproc\outil\pcre3.dll
C:\Genproc\outil\regex2.dll
C:\Genproc\outil\Resident.bat
C:\Genproc\outil\sed.exe
C:\Genproc\outil\Son.vbs
C:\Genproc\outil\Supprime.bat
C:\Genproc\outil\swreg.exe
C:\Genproc\outil\Termine.wav
C:\Genproc\outil\Uninstall.bat
C:\Genproc\outil\uniq.exe
C:\Genproc\outil\Var.bat
C:\Genproc\outil\Web.bat
C:\Genproc\outil\[1].txt
C:\Genproc\outil\Licence\copying.txt
C:\Genproc\outil\Licence\license.txt
C:\Genproc\Page\GenProcPage
C:\Genproc\Page\GenProc[1].html
C:\Genproc\Page\GenProcPage\1.gif
C:\Genproc\Page\GenProcPage\2.gif
C:\Genproc\Page\GenProcPage\4.gif
C:\Genproc\Page\GenProcPage\aide.gif
C:\Genproc\Page\GenProcPage\design.css
C:\Genproc\Page\GenProcPage\important.gif

WORT le dossier est vide

Rapport HiJack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:55:18, on 11/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wir

relis bien, il manque plusieurs rapports

Bonjour,

télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre