Rootkit : chacun son tour !!! HELP ! Help !

Reciff Messages postés 17 Statut Membre -  
verni29 Messages postés 6805 Statut Contributeur sécurité -
Bonjour,
C'est a mon tour de vous solliciter parce que je mon pc est infecté par " BACKDOOR:WINNT/RUSTOCK.AN" et il est bien sur impossible de le supprimer de maniere classique !!
Y aurait il une ame charitable pour m'aider , please ?
Configuration: Windows XP
Google Chrome
1 Go de Ram

14 réponses

  1.
    verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    Bonsoir,

    Pour plus d'informations,

    Télécharge Random's System Information Tool (RSIT) de random/random et enregistre le sur ton Bureau.
    http://images.malwareremoval.com/random/RSIT.exe

    # Double-clique sur " RSIT.exe " pour le lancer .
    # dans la fenêtre qui va s’ouvrir choisis 1 month pour l'option "List files/folders created ...".
    # clique ensuite sur " Continue " pour lancer l'analyse ...

    Si la dernière version de HijackThis n'est pas trouvée sur ton PC, RSIT la téléchargera et te demandera d'accepter la licence.

    Attends jusqu’à la fin de l’analyse. deux rapports vont être crées.

    # Poste en deux messages le contenu de " log.txt ", et de " info.txt " ( dans la barre des tâches).

    Note : Si tu ne les trouves pas,les rapports sont sauvegardés dans le dossier C:\rsit.

    A+
    0
  2. Reciff Messages postés 17 Statut Membre
     
    ok, merci pour la rapidité de la reponse, je m'execute tout de suite !
    0
  3. Reciff Messages postés 17 Statut Membre
     
    Voila !!!
    et un log.txt, un !!!

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by XXXXXXX at 2009-09-05 20:29:36
    Microsoft Windows XP Édition familiale Service Pack 3
    System drive C: has 13 GB (24%) free of 56 GB
    Total RAM: 1535 MB (48% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:31:05, on 05/09/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Fichiers communs\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\WINDOWS\system32\RemoteControlService.exe
    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\ATK_XP_060823\HControl.exe
    C:\Program Files\ASUS\Wireless Console\wcourier.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe
    C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
    C:\WINDOWS\ATK_XP_060823\ATKOSD.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    D:\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
    C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\SuperCopier2\SuperCopier2.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    D:\HP\Digital Imaging\bin\hpqtra08.exe
    D:\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\TARET Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\TARET Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\TARET Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\TARET Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\TARET Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\TARET Stan\Bureau\RSIT.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\trend micro\TARET Stan.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
    O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK_XP_060823\HControl.exe
    O4 - HKLM\..\Run: [Wireless Console] C:\Program Files\ASUS\Wireless Console\wcourier.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [HP Software Update] "D:\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\TARET Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = D:\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\HP\Digital Imaging\bin\hpqtra08.exe
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=https://www.asus.com/fr/
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
    O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by115fd.bay115.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/luxor_amun_rising/mjolauncher.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/diner_dash/DinerDash.1.0.0.80.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{80DFA119-E7D9-4998-A62A-A5F057EE1B94}: NameServer = 193.252.19.3,193.252.19.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8BD1E4E6-ED43-4297-9593-B68EA4811FDF}: NameServer = 80.10.246.130,80.10.246.3
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Fichiers communs\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Update Service (gupdate1c98eaf9fe14472) (gupdate1c98eaf9fe14472) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: ITE Remote Control Service (ITECIRService) - ITE Tech. Inc. - C:\WINDOWS\system32\RemoteControlService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service (lavasoft ad-aware service) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    0
  4. Reciff Messages postés 17 Statut Membre
     
    bon, apres 5 essais je m'avoue vaincu ! impossible de poster le fichier info.txt !
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Reciff Messages postés 17 Statut Membre
     
    A moins de le scinder en deux peut etre .....

    info.txt logfile of random's system information tool 1.06 2009-09-05 20:31:10

    ======Uninstall list======

    -->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
    -->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
    -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
    -->C:\WINDOWS\UNNMP.exe /UNINSTALL
    -->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {926CC8AE-8414-43DF-8EB4-CF26D9C3C663}
    -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E47302B-8081-46D3-9FEA-BEB2E5F5C3EC}\setup.exe" -l0x40c anything
    -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD4F051C-1A2B-4A91-B187-B093C597418C}\setup.exe" -l0x40c anything
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00BA-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0100-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0101-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
    2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
    32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
    Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
    Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
    Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
    Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
    Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
    Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
    Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
    Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
    Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
    Adobe Color Common Settings-->C:\Program Files\Fichiers communs\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
    Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
    Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
    Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
    Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
    Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
    Adobe ExtendScript Toolkit 2-->C:\Program Files\Fichiers communs\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
    Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
    Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
    Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
    Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
    Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
    Adobe Photoshop CS3-->C:\Program Files\Fichiers communs\Adobe\Installers\32e9033392a51340b32fdc6ad893ab7\Setup.exe
    Adobe Photoshop CS3-->MsiExec.exe /I{BF794769-8875-4E01-B7BE-E00104604F4A}
    Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
    Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
    Adobe Setup-->MsiExec.exe /I{926DEB4E-2B0A-4C5C-AE4A-BF6C06949702}
    Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
    Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
    Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
    Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
    Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
    Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
    Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
    Apple Software Update-->MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6}
    Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
    Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
    Asus ChkMail-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Asus\Asus ChkMail\Uninst.isu"
    ASUS Enhanced Display Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\SETUP.EXE" -l0x9
    ASUS GameFace Live-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{68D8533B-9EE7-46AB-B8B2-D643F888C5DF}
    ASUS Probe V2.12-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\ASUS Probe\Uninst.isu"
    ASUS VideoSecurity Online-->c:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{169E414A-37C7-434E-9021-27A03AE087CD}
    Asus_A_Series_ScreenSaver-->C:\WINDOWS\ASUS A Series ScreenSaver Uninstaller.exe
    ASUSDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
    ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
    ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
    ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    ATK0100 ACPI UTILITY-->C:\WINDOWS\ATK0100\XPunin.exe
    Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe -runfromtemp -l0x0009 -removeonly
    Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
    Azureus-->C:\Program Files\Azureus\Uninstall.exe
    Bejeweled 2 Deluxe 1.0-->C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\Install.log"
    Bejeweled Twist(TM)-->"C:\Program Files\Zylom Games\Bejeweled Twist(TM)\GameInstlr.exe" --uninstall UnInstall.log
    BisonCam, NB Pro-->C:\WINDOWS\BisonRem.exe
    Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
    Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
    Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
    Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
    Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
    Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
    Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
    dBpoweramp DSP Effects-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpoweramp DSP Effects.dat
    dBpoweramp FLAC Codec-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat
    dBpoweramp Monkeys Audio Codec-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat
    dBpoweramp Music Converter-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
    Disk Checker-->"C:\Program Files\Disk Checker\uninstall.exe"
    Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
    EasyRecovery Professional-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{268723B7-A994-4286-9F85-B974D5CAFC7B} /l1036
    EAX(tm) Unified (SHELL)-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative Labs\EAX(tm) Unified (SHELL)\Uninst.isu"
    e-COMO-->"C:\Program Files\ColiPoste\eCOMO\uninstall.exe"
    eMule-->"C:\Program Files\eMule\Uninstall.exe"
    GEAR 32bit Driver Installer-->MsiExec.exe /X{E89B484C-B913-49A0-959B-89E836001658}
    GoldWave v5.06-->"C:\Program Files\GoldWave\unstall.exe" "GoldWave v5.06" "C:\Program Files\GoldWave\unstall.log"
    Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
    Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
    Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
    Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
    Gordon's Gate Flash Driver 1.1.0.12-->C:\Program Files\Sony Ericsson\Gordons Gate\uninst.exe
    GPL Ghostscript 8.60-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\gs8.60\uninstal.txt"
    GPL Ghostscript Fonts-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\fonts\uninstal.txt"
    HDAUDIO SoftV92 Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10431966\HXFSETUP.EXE -U -IHDAUDIO\FUNC_02&VEN_14F1&DEV_2BFA&SUBSYS_10431966
    HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    HP Image Zone 4.2-->D:\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
    HP PSC & OfficeJet 4.2-->"D:\HP\Digital Imaging\{A1062847-0846-427A-92A1-BB8251A91E91}\setup\hpzscr01.exe" -datfile hposcr04.dat
    HP Software Update-->MsiExec.exe /X{457791C5-D702-4143-A7B2-2744BE9573F2}
    Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
    Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
    Intel PROSet Wireless-->Intel PROSet Wireless
    iTunes-->MsiExec.exe /I{AB90749C-7422-4580-8A7A-66CC5E9E5F98}
    Ivalice Launcher Version 11-->"D:\World of Warcraft\unins000.exe"
    J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
    J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
    Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
    Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
    Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
    Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
    Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
    Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
    LG PC Suite III-->C:\Program Files\InstallShield Installation Information\{C0E18DC4-C74A-4889-AE3A-933471023787}\setup.exe -runfromtemp -l0x040c -removeonly
    LG USB Modem Drivers-->MsiExec.exe /I{FA02ACAC-9E14-4878-A257-92A22A647C2C}
    Medal of Honor Allied Assault US 1.10 Patch-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{74A38758-E123-4CB9-9CB6-D630BA7517EB}\Setup.exe" -l0x9
    Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
    Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
    Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
    Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
    Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
    Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
    Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft ActiveSync 4.0-->MsiExec.exe /I{B208806F-A231-4FA0-AB3F-5C1B8979223E}
    Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
    Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
    Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
    Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
    Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
    Microsoft Office Enterprise 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
    Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
    Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
    Microsoft Office Groove MUI (French) 2007-->MsiExec.exe /X{90120000-00BA-040C-0000-0000000FF1CE}
    Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
    Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
    Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
    Microsoft Office Language Pack 2007 - French/Français-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall OMUI.FR-FR /dll OSETUP.DLL
    Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
    Microsoft Office O MUI (French) 2007-->MsiExec.exe /X{90120000-0100-040C-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
    Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
    Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
    Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
    Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
    Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office SharePoint Designer 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-0017-040C-0000-0000000FF1CE} /uninstall {5DD79E02-6B69-4BC5-AFA8-914C6A910458}
    Microsoft Office SharePoint Designer MUI (French) 2007-->MsiExec.exe /X{90120000-0017-040C-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
    Microsoft Office X MUI (French) 2007-->MsiExec.exe /X{90120000-0101-040C-0000-0000000FF1CE}
    Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
    Microsoft VC80 Support DLLs-->MsiExec.exe /I{342F5437-C87D-4BB5-89B9-B23E16C6A395}
    Microsoft Visio Professional 2002 [FRA]-->MsiExec.exe /I{9051040C-6D54-11D4-BEE3-00C04F990354}
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
    Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

    ------------FIN DE LA 1ERE PARTIE ------------------------------
    0
  7. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    Je vois que tu as passé ComBoFix.

    Peux-tu poster le rapport ?
    Il se trouve en C:\ComboFix.txt

    A+
    0
    1. Reciff Messages postés 17 Statut Membre
       
      Pas de probleme.....



      ComboFix 09-09-04.01 - TARET Stan 05/09/2009 0:35.2.1 - NTFSx86
      Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1535.847 [GMT -4:00]
      Running from: c:\documents and settings\TARET Stan\Bureau\ComboFix.exe
      AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

      WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      ---- Previous Run -------
      .
      c:\docume~1\TARETS~1\LOCALS~1\Temp\install_flash_player.exe
      c:\documents and settings\TARET Stan\Application Data\wiaserva.log
      c:\documents and settings\TARET Stan\RavMonLog
      c:\program files\webmediaplayer\resources\languages.xml
      c:\program files\webmediaplayer\resources\webmedias
      c:\program files\webmediaplayer\skins\classic.skn
      c:\program files\webmediaplayer\sqlite3.dll
      c:\program files\webmediaplayer\updates\webmediasDB.upd
      c:\program files\webmediaplayer\WebMediaPlayer.url
      c:\program files\WinPCap\rpcapd.exe
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\cup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\customer_cup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\heart.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_down.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_up.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\plates.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\ticket.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\tray.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\music\mainmenumusic.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_bring_check_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_diner.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_food_ready_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_gain_heart_1.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pencil_write_2.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_rollover_1.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_seat_people_snd.ogg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\choosedifficulty.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\credits.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_lose.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_win.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help1.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help2.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\highscores.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro_mask.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover_mask.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\mainmenu.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup_mask.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradegrid.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradetitle.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upsell.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalk.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalkup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancel.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancelup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\close.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\closeup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continueover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_blue.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_yellow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplay.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplayover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfo.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfoup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off_on.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on_on.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pause.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pauseover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quit.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgame.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgameover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegame.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegameover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submit.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submitup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagain.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagainover.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_over.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_up.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobal.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobalup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscore.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscoreon.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocal.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocalup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\comics\webcomic.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\career.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\customer.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\endless.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\global.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\powerups.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\stove.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\arrow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click2.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\grab.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\open.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\sit_legs.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\arial.mvec
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\komikaaxis.mvec
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt2top.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt4top.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_off.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on1.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on2.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdown.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdownon.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowleft.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowlefton.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowright.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowrighton.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowupon.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\p1icon.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\textedit.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\title.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_a.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_b.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_c.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_a.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_b.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_c.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_d.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_a.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_b.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_c.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_d.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fifth_level_diner.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\first_level_diner.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fourth_level_diner.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\second_level_diner.txt
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\playfirst_logo.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\background.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\frames\upgrade_0001.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\upgrades.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\tableshadow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\choosedifficulty.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooseplayer.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooserestaurant.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\credits.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\game.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\gothighscore.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help2.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscore.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoreinfo.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoresubmit.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelintro.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelover.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\loading.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainloop.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainmenu.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\ok.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\pause.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\style.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\tutorialintro.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upgrade.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upsell.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\webcomic.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\yesno.lua
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\aol_logo.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\gamelabsplash.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\playfirst_logo.jpg
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\strings.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\check.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\checkmark.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\clock.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closed.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closingtime.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\dollar.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\coffee.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\tables.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\wallpaper.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expert.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expertscore.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\fork_timer.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\goalcompleted.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level_career.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\score.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\sound.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staroff.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staron.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumber.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumberup.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\traynumber.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorial_character.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialarrow.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialbox.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.xml
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\drinks.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\maitred.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\oven.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\select.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\shoes.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\stereo.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\table.png
      c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\dinerdash.exe
      c:\windows\Installer\51359.msi
      c:\windows\Installer\52bda4.msp
      c:\windows\system32\AutoRun.inf
      c:\windows\system32\drivers\5b31344a.sys
      c:\windows\system32\drivers\npf.sys
      c:\windows\system32\Packet.dll
      c:\windows\system32\pthreadVC.dll
      c:\windows\system32\WanPacket.dll
      c:\windows\system32\wpcap.dll
      c:\windows\system32\ymkimecuk.dat
      c:\windows\system32\ymkimecuk_nav.dat
      c:\windows\system32\ymkimecuk_navps.dat

      .
      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_npf
      -------\Service_5b31344a
      -------\Service_npf


      ((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
      .

      2009-09-03 23:28 . 2009-09-04 09:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
      2009-09-03 23:28 . 2009-09-03 23:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
      2009-09-02 22:40 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe
      2009-09-02 15:24 . 2009-09-02 15:24 -------- d-----w- c:\documents and settings\LocalService\Bureau
      2009-09-02 14:29 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
      2009-09-02 14:26 . 2009-09-02 14:26 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
      2009-08-20 11:03 . 2009-08-20 11:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
      2009-08-13 05:45 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2009-09-05 04:32 . 2007-04-17 20:47 -------- d-----w- c:\program files\SuperCopier2
      2009-09-04 23:46 . 2006-01-13 21:12 26 ----a-w- c:\windows\popcinfo.dat
      2009-09-04 11:17 . 2007-12-11 18:38 -------- d-----w- c:\program files\eMule
      2009-09-04 08:07 . 2007-01-22 16:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
      2009-09-02 22:40 . 2006-09-28 15:35 -------- d-----w- c:\program files\Disk Checker
      2009-08-30 14:58 . 2007-12-24 14:41 -------- d-----w- c:\documents and settings\TARET Stan\Application Data\Azureus
      2009-08-30 14:34 . 2007-12-24 14:16 -------- d-----w- c:\program files\Azureus
      2009-08-26 12:22 . 2007-01-23 03:17 -------- d-----w- c:\program files\Java
      2009-08-14 22:15 . 2008-06-23 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
      2009-08-05 13:14 . 2009-05-30 13:04 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
      2009-08-05 09:00 . 2004-09-20 21:48 205312 ----a-w- c:\windows\system32\mswebdvd.dll
      2009-07-31 10:20 . 2008-12-16 13:45 -------- d-----w- c:\program files\Microsoft Silverlight
      2009-07-29 04:35 . 2004-09-20 21:48 119808 ----a-w- c:\windows\system32\t2embed.dll
      2009-07-29 04:35 . 2004-09-20 21:48 81920 ----a-w- c:\windows\system32\fontsub.dll
      2009-07-25 09:23 . 2008-12-16 01:52 411368 ----a-w- c:\windows\system32\deploytk.dll
      2009-07-22 17:05 . 2006-03-04 02:13 -------- d-----w- c:\documents and settings\TARET Stan\Application Data\Intel
      2009-07-22 17:05 . 2009-07-22 17:05 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
      2009-07-22 17:05 . 2009-07-22 17:05 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
      2009-07-22 17:05 . 2008-11-21 00:58 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Intel
      2009-07-22 17:05 . 2008-01-18 12:41 -------- d-----w- c:\documents and settings\admin\Application Data\Intel
      2009-07-22 17:00 . 2009-07-22 17:00 -------- d-----w- c:\program files\Fichiers communs\Intel
      2009-07-22 17:00 . 2009-07-22 17:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
      2009-07-22 17:00 . 2005-12-24 04:07 -------- d-----w- c:\program files\Intel
      2009-07-22 16:45 . 2005-12-24 03:59 -------- d--h--w- c:\program files\InstallShield Installation Information
      2009-07-22 13:54 . 2005-12-24 03:59 -------- d-----w- c:\program files\Realtek
      2009-07-22 13:43 . 2009-07-22 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
      2009-07-22 13:40 . 2009-07-22 13:40 0 ----a-w- c:\windows\ativpsrm.bin
      2009-07-22 13:21 . 2007-12-17 15:29 -------- d-----w- c:\program files\ATI Technologies
      2009-07-22 11:45 . 2009-07-22 11:45 -------- d-----w- c:\program files\Driver-Soft
      2009-07-21 22:07 . 2009-07-21 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
      2009-07-17 19:03 . 2004-09-20 21:48 58880 ----a-w- c:\windows\system32\atl.dll
      2009-07-14 03:43 . 2004-09-20 21:49 286208 ----a-w- c:\windows\system32\wmpdxm.dll
      2009-07-08 20:34 . 2009-07-22 16:44 53248 ----a-w- c:\windows\system32\CSVer.dll
      2009-07-06 21:10 . 2005-07-13 09:26 5788672 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
      2009-07-03 16:57 . 2004-09-20 21:49 915456 ------w- c:\windows\system32\wininet.dll
      2009-07-02 23:11 . 2005-07-13 02:37 18665472 ----a-w- c:\windows\RTHDCPL.EXE
      2009-06-28 13:46 . 2006-03-19 21:29 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
      2009-06-26 18:37 . 2009-07-22 13:54 40960 ----a-w- c:\windows\system32\RtkCoInstXP.dll
      2009-06-24 14:43 . 2005-12-24 03:59 831488 ----a-w- c:\windows\RtlExUpd.dll
      2009-06-22 21:39 . 2009-07-22 13:54 1482752 ----a-w- c:\windows\RtlUpd.exe
      2009-06-15 10:44 . 2004-09-20 21:48 78848 ----a-w- c:\windows\system32\telnet.exe
      2009-06-10 14:14 . 2004-09-20 21:48 85504 ----a-w- c:\windows\system32\avifil32.dll
      2009-06-10 13:21 . 2005-12-24 03:49 2066432 ----a-w- c:\windows\system32\mstscax.dll
      2009-06-10 06:15 . 2004-09-20 21:49 132096 ----a-w- c:\windows\system32\wkssvc.dll
      2008-08-18 23:50 . 2008-08-18 23:50 15397 ----a-w- c:\program files\settings.dat
      .

      ((((((((((((((((((((((((((((( SnapShot@2009-09-05_04.24.44 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2009-09-05 04:31 . 2008-10-16 18:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
      + 2009-09-05 04:31 . 2008-04-14 02:34 13824 c:\windows\system32\dllcache\cache\wscntfy.exe
      + 2009-09-05 04:31 . 2008-04-14 02:33 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
      + 2009-09-05 04:31 . 2008-04-14 02:34 26624 c:\windows\system32\dllcache\cache\userinit.exe
      + 2009-09-05 04:31 . 2008-04-14 02:34 14336 c:\windows\system32\dllcache\cache\svchost.exe
      + 2009-09-05 04:31 . 2008-04-14 02:33 71680 c:\windows\system32\dllcache\cache\ssdpsrv.dll
      + 2009-09-05 04:31 . 2008-04-14 02:34 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
      + 2009-09-05 04:32 . 2008-04-14 02:33 59904 c:\windows\system32\dllcache\cache\regsvc.dll
      + 2009-09-05 04:32 . 2008-04-14 02:33 88576 c:\windows\system32\dllcache\cache\rasauto.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 17408 c:\windows\system32\dllcache\cache\powrprof.dll
      + 2009-09-05 04:31 . 2006-10-19 01:47 27136 c:\windows\system32\dllcache\cache\mspmsnsv.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 33792 c:\windows\system32\dllcache\cache\msgsvc.dll
      + 2009-09-05 04:31 . 2008-04-14 02:34 13312 c:\windows\system32\dllcache\cache\lsass.exe
      + 2009-09-05 04:31 . 2008-04-14 02:33 22016 c:\windows\system32\dllcache\cache\lpk.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 19968 c:\windows\system32\dllcache\cache\linkinfo.dll
      + 2009-09-05 04:31 . 2008-04-14 02:05 25216 c:\windows\system32\dllcache\cache\kbdclass.sys
      + 2009-09-05 04:31 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
      + 2009-09-05 04:31 . 2008-04-14 02:33 56320 c:\windows\system32\dllcache\cache\eventlog.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
      + 2009-09-05 04:31 . 2008-04-14 02:33 62464 c:\windows\system32\dllcache\cache\cryptsvc.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 77824 c:\windows\system32\dllcache\cache\browser.dll
      + 2009-09-05 04:31 . 2008-04-13 18:57 14336 c:\windows\system32\dllcache\cache\asyncmac.sys
      + 2009-09-05 04:31 . 2004-08-05 18:00 12032 c:\windows\system32\dllcache\cache\acpiec.sys
      + 2009-09-05 04:31 . 2008-04-14 02:33 5120 c:\windows\system32\dllcache\cache\sfc.dll
      + 2009-09-05 04:31 . 2004-08-05 18:00 2944 c:\windows\system32\dllcache\cache\null.sys
      + 2009-09-05 04:31 . 2004-08-05 18:00 4224 c:\windows\system32\dllcache\cache\beep.sys
      + 2009-09-05 04:31 . 2008-04-14 02:33 129024 c:\windows\system32\dllcache\cache\xmlprov.dll
      + 2009-09-05 04:31 . 2008-04-14 02:34 512000 c:\windows\system32\dllcache\cache\winlogon.exe
      + 2009-09-05 04:31 . 2009-07-03 16:57 915456 c:\windows\system32\dllcache\cache\wininet.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 579584 c:\windows\system32\dllcache\cache\user32.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 186368 c:\windows\system32\dllcache\cache\upnphost.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 297984 c:\windows\system32\dllcache\cache\termsrv.dll
      + 2009-09-05 04:31 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
      + 2009-09-05 04:31 . 2008-04-14 02:33 249856 c:\windows\system32\dllcache\cache\tapisrv.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 171520 c:\windows\system32\dllcache\cache\srsvc.dll
      + 2009-09-05 04:32 . 2008-04-14 02:33 135680 c:\windows\system32\dllcache\cache\shsvcs.dll
      + 2009-09-05 04:31 . 2009-02-09 11:23 111104 c:\windows\system32\dllcache\cache\services.exe
      + 2009-09-05 04:32 . 2008-04-14 02:33 194560 c:\windows\system32\dllcache\cache\schedsvc.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 187392 c:\windows\system32\dllcache\cache\scecli.dll
      + 2009-09-05 04:31 . 2009-02-09 10:53 401408 c:\windows\system32\dllcache\cache\rpcss.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 409088 c:\windows\system32\dllcache\cache\qmgr.dll
      + 2009-09-05 04:32 . 2008-04-14 02:33 438272 c:\windows\system32\dllcache\cache\ntmssvc.dll
      + 2009-09-05 04:31 . 2008-04-13 19:15 574976 c:\windows\system32\dllcache\cache\ntfs.sys
      + 2009-09-05 04:31 . 2008-04-14 02:33 198144 c:\windows\system32\dllcache\cache\netman.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 407040 c:\windows\system32\dllcache\cache\netlogon.dll
      + 2009-09-05 04:31 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
      + 2009-09-05 04:31 . 2008-06-20 17:47 247808 c:\windows\system32\dllcache\cache\mswsock.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 927504 c:\windows\system32\dllcache\cache\mfc40u.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 110080 c:\windows\system32\dllcache\cache\imm32.dll
      + 2009-09-05 04:31 . 2008-07-07 20:28 253952 c:\windows\system32\dllcache\cache\es.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 851968 c:\windows\system32\dllcache\cache\comres.dll
      + 2009-09-05 04:31 . 2008-04-14 02:33 617472 c:\windows\system32\dllcache\cache\comctl32.dll
      + 2009-09-05 04:32 . 2008-04-13 16:39 142592 c:\windows\system32\dllcache\cache\aec.sys
      + 2009-09-05 04:32 . 2008-04-14 02:33 1571840 c:\windows\system32\dllcache\cache\sfcfiles.dll
      + 2009-09-05 04:31 . 2009-02-09 11:24 2191104 c:\windows\system32\dllcache\cache\ntoskrnl.exe
      + 2009-09-05 04:31 . 2009-02-10 23:06 2068096 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
      + 2009-09-05 04:31 . 2009-07-19 13:15 5937152 c:\windows\system32\dllcache\cache\mshtml.dll
      + 2009-09-05 04:31 . 2009-03-21 14:07 1054720 c:\windows\system32\dllcache\cache\kernel32.dll
      + 2009-09-05 04:31 . 2008-04-14 02:34 1037824 c:\windows\system32\dllcache\cache\explorer.exe
      .
      -- Snapshot reset to current date --
      .
      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-16 1204224]
      "SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
      "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [BU]
      "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 68856]
      "Google Update"="c:\documents and settings\TARET Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-11 133104]
      "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [BU]
      "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
      "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "HControl"="c:\windows\ATK_XP_060823\HControl.exe" [2006-08-10 110592]
      "Wireless Console"="c:\program files\ASUS\Wireless Console\wcourier.exe" [2005-07-22 57344]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-05-11 708697]
      "RemoteControl"="c:\program files\ASUSTek\ASUSDVD\PDVDServ.exe" [2003-10-31 32768]
      "Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2005-06-16 86016]
      "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
      "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
      "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
      "HP Software Update"="d:\hp\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
      "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
      "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
      "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
      "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
      "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
      "IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-02-27 1368064]
      "IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2009-02-27 1202448]
      "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
      "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-07-02 18665472]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
      "DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

      c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
      Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-1-14 479232]
      D‚marrage rapide du logiciel HP Image Zone.lnk - d:\hp\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
      HP Digital Imaging Monitor.lnk - d:\hp\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lavasoft ad-aware service]
      @="Service"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
      @="Service"

      [HKLM\~\startupfolder\c:^documents and settings^taret stan^menu démarrer^programmes^démarrage^ikowin32.exe]
      path=c:\documents and settings\TARET Stan\Menu Démarrer\Programmes\Démarrage\ikowin32.exe
      backup=c:\windows\pss\ikowin32.exeStartup

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
      "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
      "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "c:\\Program Files\\iTunes\\iTunes.exe"=
      "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
      "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
      "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
      "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
      "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
      "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
      "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
      "17929:TCP"= 17929:TCP:NortonAV
      "18321:TCP"= 18321:TCP:NortonAV
      "18666:TCP"= 18666:TCP:NortonAV

      R0 lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [02/09/2009 10:29 64160]
      R1 SSHDRV65;SSHDRV65;c:\windows\system32\drivers\SSHDRV65.sys [12/03/2007 07:38 120320]
      R1 SSHDRV79;SSHDRV79;c:\windows\system32\drivers\SSHDRV79.sys [29/09/2008 13:26 75264]
      R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [30/05/2009 09:04 108289]
      R2 ITECIRService;ITE Remote Control Service;c:\windows\system32\RemoteControlService.exe [24/12/2005 00:30 656384]
      R2 lavasoft ad-aware service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 10:49 1029456]
      R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
      R3 ITECIR;ITE CIR Driver;c:\windows\system32\drivers\ITECIR.sys [24/12/2005 00:30 7366]
      S2 gupdate1c98eaf9fe14472;Google Update Service (gupdate1c98eaf9fe14472);c:\program files\Google\Update\GoogleUpdate.exe [14/02/2009 10:22 133104]
      S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [22/07/2009 09:54 1684736]
      S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [03/03/2006 16:23 5824]
      S3 gggen;Generic USB Flash Driver;c:\windows\system32\drivers\gggen.sys [04/01/2008 12:18 11648]
      S3 USRWGU(USR);USRobotics Wireless USB Adapter(USR);c:\windows\system32\DRIVERS\USRWGU.sys --> c:\windows\system32\DRIVERS\USRWGU.sys [?]

      --- Other Services/Drivers In Memory ---

      *Deregistered* - mchInjDrv

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
      .
      Contents of the 'Scheduled Tasks' folder

      2009-09-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
      - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]

      2009-09-03 c:\windows\Tasks\AppleSoftwareUpdate.job
      - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]

      2009-09-05 c:\windows\Tasks\Google Software Updater.job
      - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-22 11:05]

      2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 14:22]

      2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 14:22]

      2009-09-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3481276198-2589740394-3023891886-1005Core.job
      - c:\documents and settings\TARET Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-12 21:28]

      2009-09-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3481276198-2589740394-3023891886-1005UA.job
      - c:\documents and settings\TARET Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-12 21:28]

      2009-09-05 c:\windows\Tasks\MP Scheduled Scan.job
      - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 22:20]

      2009-09-05 c:\windows\Tasks\User_Feed_Synchronization-{23AF0ABD-775B-4ADA-9D07-2D23BD3EB711}.job
      - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
      .
      - - - - ORPHANS REMOVED - - - -

      Toolbar-Locked - (no file)
      HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe


      .
      ------- Supplementary Scan -------
      .
      uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
      uInternet Connection Wizard,ShellNext = iexplore
      uInternet Settings,ProxyOverride = *.local
      uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
      TCP: {80DFA119-E7D9-4998-A62A-A5F057EE1B94} = 193.252.19.3,193.252.19.4
      TCP: {8BD1E4E6-ED43-4297-9593-B68EA4811FDF} = 80.10.246.130,80.10.246.3
      DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - hxxp://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/diner_dash/DinerDash.1.0.0.80.cab
      .

      **************************************************************************

      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2009-09-05 00:42
      Windows 5.1.2600 Service Pack 3 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
      "ImagePath"="\??\c:\docume~1\TARETS~1\LOCALS~1\Temp\mc2A.tmp"
      .
      --------------------- LOCKED REGISTRY KEYS ---------------------

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8e9a-4d4e-9ee9-17a0e48d3bbb}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8e9a-4d4e-9ee9-17a0e48d3bbb}\elevation]
      "Enabled"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8e9a-4d4e-9ee9-17a0e48d3bbb}\localserver32]
      @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

      [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8e9a-4d4e-9ee9-17a0e48d3bbb}\typelib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

      [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1d4c8a81-b7ac-460a-8c23-98713c41d6b3}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker3"

      [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1d4c8a81-b7ac-460a-8c23-98713c41d6b3}\proxystubclsid32]
      @="{00020424-0000-0000-C000-000000000046}"

      [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1d4c8a81-b7ac-460a-8c23-98713c41d6b3}\typelib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"

      [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
      "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
      .
      --------------------- DLLs Loaded Under Running Processes ---------------------

      - - - - - - - > 'winlogon.exe'(748)
      c:\windows\system32\Ati2evxx.dll
      c:\windows\system32\netprovcredman.dll

      - - - - - - - > 'explorer.exe'(1688)
      c:\windows\system32\eappprxy.dll
      c:\windows\system32\webcheck.dll
      c:\windows\system32\WPDShServiceObj.dll
      c:\windows\system32\PortableDeviceTypes.dll
      c:\windows\system32\PortableDeviceApi.dll
      c:\windows\system32\netprovcredman.dll
      .
      Completion time: 2009-09-05 0:46
      ComboFix-quarantined-files.txt 2009-09-05 04:45

      Pre-Run: 13 965 326 336 octets libres
      Post-Run: 13 933 227 008 octets libres

      621 --- E O F --- 2009-08-26 12:13
      0
  8. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    Je regarde le rapport.

    A+
    0
  9. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    ComboFix a supprimé différentes infections ( Navipromo, ... )
    Il faudra passer différents outils pour nettoyer tout cela.

    On va commencer par vérifier pour les rootkits.

    Télécharge gmer
    http://www2.gmer.net/gmer.zip

    # dézippe-le (clic droit et extraire sur le bureau )
    # Ouvre le dossier crée et double-clique sur gmer.exe .
    Si ton antivirus réagit, ne t'inquiète et ignore l'alerte.
    # Le scan va se lancer de lui-même.
    # vérifie que l’outil est sur l’onglet RootKit/Malware.
    # A la fin du scan, clique sur le bouton save pour enregistrer le rapport.
    # Enregistre-le sur le bureau ( fichier .log )

    Édite ce rapport dans ta prochaine réponse.

    A+
    0
    1. Reciff Messages postés 17 Statut Membre
       
      ok !!
      0
      1. Reciff Messages postés 17 Statut Membre > Reciff Messages postés 17 Statut Membre
         
        voila le rapport :

        GMER 1.0.15.15077 [gmer.exe] - http://www.gmer.net
        Rootkit quick scan 2009-09-06 08:50:23
        Windows 5.1.2600 Service Pack 3


        ---- System - GMER 1.0.15 ----

        SSDT splr.sys ZwEnumerateKey [0xB9EC5CA4]
        SSDT splr.sys ZwEnumerateValueKey [0xB9EC6032]

        Code \??\C:\DOCUME~1\TARETS~1\LOCALS~1\Temp\catchme.sys pIofCallDriver

        ---- Devices - GMER 1.0.15 ----

        Device \FileSystem\Ntfs \Ntfs 8A7441F8

        AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
        AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
        AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

        ---- EOF - GMER 1.0.15 ----
        0
  10. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Bonjour, j'ai restauré l'un des postes pris dans les fillets de la blackliste.

    Bonne désinfection,@+
    0
    1. Reciff Messages postés 17 Statut Membre
       
      ok, merci !
      0
    2. verni29 Messages postés 6805 Statut Contributeur sécurité 180
       
      Bonjour, green day

      Merci.

      @+
      0
  11. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    Reciff,

    Pas de rootkits sur ton PC.
    Tu utilises Daemon Tools, émulateur de disque virtuel.
    A chaque fois que tu l'utilises, il crée un nouveau service et également un driver pour pouvoir fonctionner.
    C'est la même choser avec Alcohool.

    1/ Une des infections de ton PC était du à l'installation de Webmediaplayer que tu as du téléchargé sur un site pourri.
    Si tu veux utiliser ce logiciel, télécharge la version officielle à ce lien :
    http://www.azertysite.new.fr/

    2/ Télécharge Navilog d'il mafioso.
    http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe

    Double clique sur Navilog1.exe pour l’installer. Suis les invites.
    · Double-clique sur le raccourci de navilog ( sur le bureau ).
    · Sélectionne la langue puis valide.
    · Choisis l'option 1.

    Une fois l’analyse terminée, un rapport va s’ouvrir dans le bloc-notes.
    Tu copies et colles le texte de ce rapport dans ton prochain message.

    Note : Si tu ne le trouves pas, il est en C:\Cleanavi.txt.

    A+
    0
    1. Reciff Messages postés 17 Statut Membre
       
      voila le rapport :




      Fix Navipromo version 4.0.2 commencé le 06/09/2009 10:11:42,39

      !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
      !!! Postez ce rapport sur le forum pour le faire analyser !!!

      Outil exécuté depuis C:\Program Files\navilog1

      Mise à jour le 27.08.2009 à 11h00 par IL-MAFIOSO

      Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
      X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) M processor 1.73GHz )
      BIOS : Default System BIOS
      USER : TARET Stan ( Administrator )
      BOOT : Normal boot

      Antivirus : AntiVir Desktop 9.0.1.32 (Activated)


      C:\ (Local Disk) - NTFS - Total:54 Go (Free:12 Go)
      D:\ (Local Disk) - NTFS - Total:36 Go (Free:3 Go)
      E:\ (CD or DVD)
      G:\ (CD or DVD)


      Recherche executée en mode normal

      Nettoyage exécuté au redémarrage de l'ordinateur




      Nettoyage contenu C:\WINDOWS\Temp effectué !
      Nettoyage contenu C:\Documents and Settings\TARET Stan\locals~1\Temp effectué !


      *** Sauvegarde du Registre vers dossier Safebackup ***

      sauvegarde du Registre réalisée avec succès !

      *** Nettoyage Registre ***

      Nettoyage Registre Ok
      0
  12. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    1/ Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.
    http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
    # Double-clique sur OTMoveIt.exe pour le lancer.
    # Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.

    :Processes
    explorer.exe

    :services
    ajmiynsw
    mchInjDrv

    :reg
    [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]

    :files
    C:\DOCUME~1\TARETS~1\LOCALS~1\Temp\catchme.sys
    C:\DOCUME~1\TARETS~1\LOCALS~1\Temp\mc2A.tmp
    c:\documents and settings\TARET Stan\Menu Démarrer\Programmes\Démarrage\ikowin32.exe
    c:\windows\pss\ikowin32.exe
    C:\WINDOWS\system32\drivers\ajmiynsw.sys

    :Commands
    [start explorer]


    # clique sur MoveIt! pour lancer la suppression.
    # Le résultat apparaitra dans le cadre "Results".
    # Copie/colle le résultat dans ton prochain message.

    Note : le rapport ( un fichier .log ) est également situé dans C:\_OTMoveIt\MovedFiles.

    2/ Pour supprimer Combofix et la quarantine :
    Démarrer --> exécuter --> tape ComboFix /u
    Vérifie que le dossier C:\Qoobox est bien supprimé.

    3/ Tu télécharges MalwareBytes.
    http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    Tu l'installes. Choisis les options par défaut.
    # A la fin de l’installation, il te sera demandé de mettre à jour MalwareBytes et de l’éxecuter .
    # Accepte. Après la, mise à jour, le logiciel va s’ouvrir.

    # Dans l’onglet Recherche, sélectionne Exécuter un examen complet.
    # Clique sur recherche. Tu ne sélectionnes que les disques durs de l’ordinateur.
    # Clique sur lancer l’examen.

    # A la fin de la recherche, comme il est demandé, clique sur afficher les résultats.
    # Si des infections sont trouvées, clique sur Supprimer la sélection.
    Tu postes le rapport dans ton prochain message.

    Si tu ne retrouves pas le rapport, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs. Il y est. Clique dessus et choisir ouvrir.

    A+
    0
    1. Reciff Messages postés 17 Statut Membre
       
      ok, merci de ta patience, c'est super sympa !!
      voila pour moveit

      ========== PROCESSES ==========
      Process explorer.exe killed successfully!
      ========== SERVICES/DRIVERS ==========
      Service\Driver ajmiynsw not found.
      Service\Driver ajmiynsw not found.
      Service\Driver mchInjDrv not found.
      Service\Driver key mchInjDrv deleted successfully.
      ========== REGISTRY ==========
      Registry key HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv­\ not found.
      ========== FILES ==========
      File/Folder C:\DOCUME~1\TARETS~1\LOCALS~1\Temp\catchme.sys not found.
      File/Folder C:\DOCUME~1\TARETS~1\LOCALS~1\Temp\mc2A.tmp not found.
      File/Folder c:\documents and settings\TARET Stan\Menu Démarrer\Programmes\Démarrage\ikowin32.exe not found.
      File/Folder c:\windows\pss\ikowin32.exe not found.
      File/Folder C:\WINDOWS\system32\drivers\ajmiynsw.sys not found.
      ========== COMMANDS ==========

      OTM by OldTimer - Version 3.0.0.6 log created on 09062009_115055
      0
      1. Reciff Messages postés 17 Statut Membre > Reciff Messages postés 17 Statut Membre
         
        Rapport mbam :



        Malwarebytes' Anti-Malware 1.40
        Version de la base de données: 2748
        Windows 5.1.2600 Service Pack 3

        06/09/2009 15:55:13
        mbam-log-2009-09-06 (15-55-13).txt

        Type de recherche: Examen complet (C:\|D:\|)
        Eléments examinés: 254890
        Temps écoulé: 1 hour(s), 15 minute(s), 48 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 0
        Valeur(s) du Registre infectée(s): 0
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 1

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Valeur(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        C:\Documents and Settings\TARET Stan\Mes documents\SETool2Lite\setool2lt.exe (Malware.Packer.T) -> Quarantined and deleted successfully.
        0
  13. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    Reciff,

    Cela confirme bien l'hypothèse de daemon tools.

    poste le rapport de malwarebytes une fois terminé.

    A+
    0
  14. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    cela semble tout bon.

    Une dernière vérification.

    Fais un scan en ligne avec BitDefender :
    tuto : https://forum.pcastuces.com/default.asp
    Poste le rapport, stp.

    A+
    0
    1. Reciff Messages postés 17 Statut Membre
       
      et on finit par le rapport bitdefender :




      BitDefender Online Scanner
      Rapport d'analyse généré à: Sun, Sep 06, 2009 - 22:22:59
      Voie d'analyse: C:\;D:\;E:\;G:\;
      Statistiques
      Temps
      00:54:28
      Fichiers
      146218
      Directoires
      18323
      Secteurs de boot
      0
      Archives
      2175
      Paquets programmes
      17475
      Résultats
      Virus identifiés
      1
      Fichiers infectés
      2
      Fichiers suspects
      0
      Avertissements
      0
      Désinfectés
      0
      Fichiers effacés
      2
      Info sur les moteurs
      Définition virus
      4068680
      Version des moteurs
      AVCORE v2.1 Windows/i386 11.0.0.26 (Aug 27 2009)
      Analyse des plugins
      17
      Archive des plugins
      45
      Unpack des plugins
      7
      E-mail plugins
      6
      Système plugins
      4
      Paramètres d'analyse
      Première action
      Désinfecté
      Seconde Action
      Supprimé
      Heuristique
      Oui
      Acceptez les avertissements
      Oui
      Extensions analysées
      exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
      Excludez les extensions
      Analyse d'emails
      Oui
      Analyse des Archives
      Oui
      Analyser paquets programmes
      Oui
      Analyse des fichiers
      Oui
      Analyse de boot
      Oui
      Fichier analysé
      Statut

      D:\Bureau\Clé USB\crack doom 3\Doom 3 KG Crack Manual\KG .EXE
      Infecté par: Trojan.Packed.14452

      D:\Bureau\Clé USB\crack doom 3\Doom 3 KG Crack Manual\KG .EXE
      Supprimé

      D:\System Volume Information\_restore{27CA0DCA-67AF-47A9-AE93-130015920642}\RP1\A0000132.EXE
      Infecté par: Trojan.Packed.14452

      D:\System Volume Information\_restore{27CA0DCA-67AF-47A9-AE93-130015920642}\RP1\A0000132.EXE
      Supprimé



      Voila ! je crois qu'on en a vraiment fait le tour, cette fois ci !
      0
  15. verni29 Messages postés 6805 Statut Contributeur sécurité 180
     
    Oui, effectivement, on a fait le tour.

    Attention aux téléchargements. Tu risques d'infecter gravement ton PC un de ces jours ( bagle, Sality ).

    On termine.

    1) On va enlever les logiciels qui ont été utilisés..
    Télécharge ToolsCleaner .sur le bureau
    http://pc-system.fr/

    Double-clique sur ToolsCleaner2.exe --> Recherche --> Suppression.
    Il est possible que ton bureau disparaisse.

    Fais un copier/coller du rapport qui se trouve dans C:\TCleaner.txt.

    2/ Tu vas utiliser CCleaner.
    http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

    utilise les fonctions nettoyeur et registre.

    3) La restauration système a été infectée ( cf scan de bitdefender ). C'est à nettoyer et il faut créer un point propre.

    Les points de restauration :

    - Panneau de configuration --> Système --> Restauration du système

    cocher " Désactiver la restauration .... " ( si elle est cochée sinon la décocher -- > valider -- > cocher )
    Une fenêtre va s’ouvrir pour t’avertir que les poins de restauration existants seront supprimés.
    Accepte.

    Décoche ensuite « Désactiver la restauration .... » pour réactiver la restauration système

    - Tu vas recréer un point de restauration propre.

    Pour recréer un point de restauration :
    Démarrer --> Programmes --> Accessoires --> Outils système --> Restauration système
    Choisis "Créer un point de restauration". Suis les invites.

    --------------------------------------------------------------------------------------------------------

    Ton PC est propre.
    Sois prudent dans ton surf.

    Un peu de lecture :
    projet antimalwares : https://www.malekal.com/fichiers/projetantimalwares/prevention-protection.pdf
    risques du P2P : https://www.futura-sciences.com/tech/actualites/informatique-virut-scribble-retour-infection-redoutable-18310/

    -----------------------------------------------------------------------------------------------------------

    Peux-tu mettre le sujet en résolu ? Merci.

    En te souhaitant bonne lecture et bon surf.

    Salut.
    0

Discussions similaires

win32 Rootkit
Mary -
plopus -

8 réponses
Virus ou rootkit, help !
antoum -
anto -

13 réponses