Mon PC est-il infecté???

Lesix -  
Bonjour,
Voila depuis plusieurs jours je ressens un ralentissement dans mon PC (au démarrage, ouverture des pages internet etc...)
Après quelques recherches je tombe sur votre page : "[Virus] Méthode préliminaire de désinfection"
J'ai donc suivi les instructions et me voici pour poster le résultats des différentes analyses effectuées :

1 - Random's System Information Tool :

Logtxt :
Logfile of random's system information tool 1.06 (written by random/random)
Run by BBD at 2009-10-12 18:43:34
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 15 GB (50%) free of 30 GB
Total RAM: 1023 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:43:38, on 12/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\BBD\Bureau\RSIT.exe
C:\Program Files\trend micro\BBD.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.06\is\PhysX_9.09.0203_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - https://intranet.colas.com/dana-cached/setup/JuniperSetupSP1.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Service Google Update (gupdate1c9f809cb3b95e6) (gupdate1c9f809cb3b95e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 12736 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{AD886787-C255-49DE-B8C4-2508829C1578}.job
C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-04-13 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2009-08-03 202080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-01-28 1554256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-06-28 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-06-06 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-06 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-07-10 732672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
Fast Browser Search Toolbar Helper - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]
{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - Ask Toolbar - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-05-22 262144]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2009-08-03 1471832]
{1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-03-21 16126464]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"ASUSGamerOSD"=C:\Program Files\ASUS\GamerOSD\GamerOSD.exe [2007-07-12 380928]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-11-29 55824]
"CloneCDElbyCDFL"=C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe [2001-12-06 45056]
"Adobe Version Cue CS2"=C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [2005-04-06 856064]
"Acrobat Assistant 7.0"=C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-09 13680640]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-02-09 86016]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"BboxUpdate"=C:\Program Files\BboxUpdate\BTLiveUpdate.exe [2008-08-06 103936]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SGPUpdater"=C:\Program Files\Search Guard PlusU\sgpUpdaters.exe [2009-05-15 67456]
"FBSearch"=C:\Program Files\Search Guard Plus\SearchGuardPlus.exe [2009-05-04 194432]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe [2005-10-28 94208]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-01-28 2097488]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-06-28 39408]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WiseStubReboot"=MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI TRANSFORMS=C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST WISE_SETUP_EXE_PATH=c:\nvidia\winxp\182.06\is\PhysX_9.09.0203_SystemSoftware.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^BBD^Menu Démarrer^Programmes^Démarrage^Bouygues Telecom Mes services en un clic.lnk]
C:\PROGRA~1\BOUYGU~1\BOUYGU~1.EXE [2009-05-08 95744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WmdmPmSN"=3
"mnmsrvc"=3
"SysmonLog"=3
"RDSessMgr"=3
"seclogon"=2
"TrkWks"=2
"RemoteRegistry"=2

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Documents and Settings\BBD\Menu Démarrer\Programmes\Démarrage
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll [2008-01-09 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265088]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=B5000000
"NoInstrumentation"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe"="C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2"
"C:\Program Files\ASUS\GamerOSD\SBS.exe"="C:\Program Files\ASUS\GamerOSD\SBS.exe:*:Enabled:ASUS SBS Application"
"D:\eSKernel.exe"="D:\eSKernel.exe:*:Enabled:Bbox assistant d'installation"
"C:\Program Files\Bbox\eSKernel.exe"="C:\Program Files\Bbox\eSKernel.exe:*:Enabled:Bbox assistant d'installation"
"C:\Program Files\BboxUpdate\BTLiveUpdate.exe"="C:\Program Files\BboxUpdate\BTLiveUpdate.exe:*:Enabled:Bbox - Bouygues Telecom - Utilitaire de mise à jour"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe"="C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 1 months======

2009-10-12 18:05:59 ----D---- C:\WINDOWS\LastGood
2009-10-12 03:23:21 ----SHD---- C:\Config.Msi
2009-10-11 13:40:40 ----D---- C:\Documents and Settings\BBD\Application Data\Malwarebytes
2009-10-11 13:40:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-10-11 13:40:34 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-10-11 11:59:50 ----D---- C:\Program Files\trend micro
2009-10-11 11:59:49 ----D---- C:\rsit
2009-10-11 00:54:51 ----A---- C:\liste.txt
2009-10-09 18:41:15 ----D---- C:\Program Files\CCleaner
2009-10-08 22:51:50 ----A---- C:\WINDOWS\system32\task.exe
2009-10-08 22:46:28 ----HD---- C:\WINDOWS\system32\GroupPolicy
2009-10-07 21:03:27 ----D---- C:\WINDOWS\Prefetch
2009-10-01 22:03:22 ----HD---- C:\WINDOWS\PIF
2009-09-30 22:44:06 ----D---- C:\Documents and Settings\All Users\Application Data\GARMIN
2009-09-30 22:42:53 ----D---- C:\Garmin
2009-09-19 12:58:07 ----D---- C:\Documents and Settings\BBD\Application Data\Download Manager
2009-09-19 12:32:07 ----D---- C:\Program Files\Garmin GPS Plugin
2009-09-15 22:55:27 ----D---- C:\Program Files\SGPSA
2009-09-15 22:55:27 ----D---- C:\Program Files\Search Guard PlusU
2009-09-15 22:55:27 ----D---- C:\Program Files\Search Guard Plus
2009-09-15 22:55:16 ----D---- C:\Program Files\Fast Browser Search
2009-09-15 22:55:09 ----D---- C:\users

======List of files/folders modified in the last 1 months======

2009-10-12 18:09:42 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-10-12 18:09:42 ----D---- C:\WINDOWS\Temp
2009-10-12 18:09:42 ----D---- C:\WINDOWS\BDOSCAN8
2009-10-12 18:09:41 ----HD---- C:\WINDOWS\inf
2009-10-12 18:05:59 ----D---- C:\WINDOWS
2009-10-12 18:02:45 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-12 18:02:26 ----SD---- C:\WINDOWS\Tasks
2009-10-12 06:51:05 ----AC---- C:\WINDOWS\SchedLgU.Txt
2009-10-12 03:29:36 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-12 03:23:26 ----SHD---- C:\WINDOWS\Installer
2009-10-12 03:23:22 ----D---- C:\Program Files\MSN Messenger
2009-10-12 03:21:39 ----D---- C:\WINDOWS\system32\drivers
2009-10-12 01:27:34 ----D---- C:\Program Files\Internet Explorer
2009-10-11 15:45:12 ----D---- C:\WINDOWS\system32\config
2009-10-11 15:45:00 ----D---- C:\WINDOWS\system32\wbem
2009-10-11 15:45:00 ----D---- C:\WINDOWS\Registration
2009-10-11 15:44:35 ----D---- C:\WINDOWS\system32\Restore
2009-10-11 15:29:02 ----D---- C:\WINDOWS\network diagnostic
2009-10-11 13:40:34 ----RD---- C:\Program Files
2009-10-11 11:05:33 ----D---- C:\WINDOWS\system32
2009-10-11 01:10:55 ----ASH---- C:\boot.ini
2009-10-11 01:10:55 ----A---- C:\WINDOWS\win.ini
2009-10-11 01:10:55 ----A---- C:\WINDOWS\system.ini
2009-10-10 23:39:53 ----D---- C:\Documents and Settings\BBD\Application Data\GARMIN
2009-10-10 23:38:58 ----SD---- C:\Documents and Settings\BBD\Application Data\Microsoft
2009-10-10 19:43:58 ----D---- C:\Program Files\eMule
2009-10-10 18:14:08 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-10-10 12:09:04 ----AC---- C:\WINDOWS\NeroDigital.ini
2009-10-10 03:10:55 ----D---- C:\WINDOWS\pss
2009-10-10 00:33:15 ----D---- C:\WINDOWS\Debug
2009-10-09 21:12:24 ----D---- C:\Documents and Settings\BBD\Application Data\Canon Easy-WebPrint EX
2009-10-09 00:28:12 ----D---- C:\Program Files\Messager Wanadoo
2009-10-07 18:24:14 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-10-06 18:40:47 ----D---- C:\WINDOWS\Help
2009-10-04 18:35:24 ----D---- C:\Documents and Settings\BBD\Application Data\Canon
2009-09-28 11:29:56 ----D---- C:\Program Files\Google
2009-09-28 11:29:07 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-09-13 00:51:04 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-09-13 00:50:38 ----A---- C:\WINDOWS\zraidtray.ini
2009-09-13 00:50:30 ----A---- C:\WINDOWS\php.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2007-07-12 11136]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-13 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-08-19 55656]
R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2002-06-12 13300]
R3 asusgsb;ASUS Virtual Video Capture Device Driver; C:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 12416]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2002-06-08 4480]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-03-26 4395008]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-11-29 20240]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-11-29 35088]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-11-29 36368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-28 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-09 6307328]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Video3D;ASUS Video3D Service; C:\WINDOWS\System32\Drivers\Video3D32.sys [2007-07-12 10752]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
S2 ADILOADER;General Purpose USB Driver (adildr.sys); C:\WINDOWS\System32\Drivers\adildr.sys []
S3 adiusbaw;USB ADSL WAN Adapter; C:\WINDOWS\system32\DRIVERS\adiusbaw.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-07-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-19 185089]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-06-06 152984]
R2 Marvell RAID;Marvell RAID Event Agent; C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe [2007-09-06 57344]
R2 MRUWebService;MRU Web Service; C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe [2007-06-18 20539]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-09 163908]
S2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2007-07-12 257024]
S2 gupdate1c9f809cb3b95e6;Service Google Update (gupdate1c9f809cb3b95e6); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-28 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-28 183280]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-12-01 72704]
S3 Adobe Version Cue CS2;Adobe Version Cue CS2; C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [2005-04-06 163840]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe [2008-01-09 121360]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

(Alors déja là, Chapeau pour celui qui me lira et y comprendra quelque chose)

Info.txt
info.txt logfile of random's system information tool 1.06 2009-10-12 18:43:39

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->msiexec /I {236BB7C4-4419-42FD-040C-1E257A25E34D}
-->msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
-->msiexec /I{7F4C8163-F259-49A0-A018-2857A90578BC}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.35 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe AIR-->c:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000101}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101}
Adobe Creative Suite 2-->C:\PROGRA~1\INSTAL~1\{0134A~1\setup.exe /relaunched/rootloc=d:\adobe creative suite 2.0/lang=040c
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-119F-4D52-B551-6739B2B22101}
Adobe Reader 7.0.5 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70500000002}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-0C40-4930-9AFE-113BCE553101}
Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
AIDA32 v3.20-->"C:\Program Files\AIDA32 - Enterprise System Information\unins000.exe"
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x40c
Ask Toolbar-->rundll32 C:\PROGRA~1\AskSBar\bar\1.bin\AskSBar.dll,O
ASUS Gamer OSD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\setup.exe" -l0x40c -removeonly
Attansic Ethernet Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F698102-5739-441E-96F0-74F4EA540F06}\setup.exe" -l0x9 -removeonly
Attansic L1 Gigabit Ethernet Driver-->rundll32.exe C:\WINDOWS\system32\Attansic\L1\atcInst.dll,AtcUninst C:\WINDOWS\system32\Attansic\L1 x86 1969 1048 L1
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Bbox - Bouygues Telecom - Utilitaire de mise à jour-->C:\Program Files\BboxUpdate\uninstall.exe
Big Fish Games Client-->C:\Program Files\bfgclient\Uninstall.exe
Blender (remove only)-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Bouygues Telecom Mes services en un clic-->MsiExec.exe /X{8ED44FA5-DB47-4BF8-646C-4D5590D0363D}
Canon Easy-WebPrint EX-->"C:\Program Files\Canon\Easy-WebPrint EX\Maint.exe" /UninstallRemove C:\Program Files\Canon\Easy-WebPrint EX\uninst.ini
Canon MP Navigator 3.0-->"C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini
Canon MP600-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600 /L0x000c
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
CDex extraction audio-->"C:\Program Files\CDex_170b2\uninstall.exe"
CD-LabelPrint-->"C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
CloneCD-->"C:\Program Files\Elaborate Bytes\CloneCD\ccd-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneCD"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Désinstaller Bouygues Telecom - CD d'installation Bbox-->C:\Program Files\Bbox\eSKernel.exe /Uninstall.xml
Diaporama version 3.0.0.1-->"C:\Program Files\SoftChris\Diaporama\unins000.exe"
Easy-WebPrint-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Enregistrement utilisateur de Canon MP600-->C:\Program Files\Canon\IJEREG\MP600\UNINST.EXE
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
Fast Browser Search (My Tattoons)-->regsvr32 /u /s "C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll"
Garmin City Navigator Europe NT 2010 Update-->MsiExec.exe /X{C07B86C3-1816-4C59-927E-0287925DFB96}
Garmin Communicator Plugin-->MsiExec.exe /X{B3C9A441-C34D-40F3-9D3B-00EDDDAC74F1}
Garmin POI Loader-->MsiExec.exe /X{D9DA2DF6-8CB6-4E3C-A29E-FAECFBA3E9A7}
Garmin USB Drivers-->MsiExec.exe /X{B1102A25-3AA3-446B-AA0F-A699B07A02FD}
Garmin WebUpdater-->MsiExec.exe /X{E0783143-EAE2-4047-A8D6-E155523C594C}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\3.0.195.25\Installer\setup.exe" --uninstall --system-level
Google Earth Plug-in-->MsiExec.exe /X{FE24D361-A3E8-11DE-88F3-005056806466}
Google Earth-->MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google SketchUp 6 Exporters-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EB459C2F-41CA-4222-B9CA-F8EBA40B8DAB}\setup.exe" -l0x40c -removeonly
Google SketchUp 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x40c -removeonly
Google SketchUp LayOut 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C12D609B-EB71-411B-82C3-9BE6D40435D7}\setup.exe" -l0x40c -removeonly
Google SketchUp Pro 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12E75B98-8463-4C1F-8DDA-F6CF31566A55}\setup.exe" -l0x40c -removeonly
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
IKEA Home Planner-->MsiExec.exe /I{A987FEC8-5616-49BD-BCA6-ACFFFE7403FE}
Java 2 Runtime Environment Standard Edition v1.3.1_03-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\JavaSoft\JRE\1.3.1_03\Uninst.isu"
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
JPEG Compression 1.0-->"C:\Program Files\JPEG Compression\unins000.exe"
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
Magic Ball 3-->"C:\Program Files\Magic Ball 3\Uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
marvell 61xx-->C:\Program Files\Marvell\61xx\uninst-61xx.exe
Marvell MRU-->C:\Program Files\Marvell\61xx\un61xxmru.exe
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Money 2000 Standard-->C:\Program Files\Microsoft Money\setup\setup.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB973874)-->"C:\WINDOWS\ie8updates\KB973874-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Nero 7 Demo-->MsiExec.exe /I{C985153C-3801-EB63-1432-088E71801036}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x40c -removeonly
Search Guard Plus (My Tattoons)-->C:\Program Files\Search Guard Plus\uninstalSGP.exe
Search Guard Plus Updater (My Tattoons)-->C:\Program Files\Search Guard PlusU\uninstalSGPU.exe
SiSoftware Sandra Standard 2004.SP1 (BenchmarkHQ Edition)-->"C:\Program Files\SiSoftware\SiSoftware Sandra Standard 2004.SP1 (Win32 x86)\unins000.exe"
Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Suite Specific-->MsiExec.exe /I{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)-->rundll32.exe C:\PROGRA~1\DIFX\15B7F172FC21855D\DIFxAppA.dll, DIFxARPUninstallDriverPackage C:\WINDOWS\system32\DRVSTORE\grmnusb_09F3E629557EBE4D2BA1A9469BDAE635AC0807AE\grmnusb.inf
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XviD MPEG-4 Video Codec-->C:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_XviD 132 C:\WINDOWS\INF\xvid.inf

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: B-B5F0F0BC18CA4
Event Code: 7036
Message: Le service Adobe LM Service est entré dans l'état : en cours d'exécution.

Record Number: 18064
Source Name: Service Control Manager
Time Written: 20090911203951.000000+120
Event Type: Informations
User:

Computer Name: B-B5F0F0BC18CA4
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Adobe LM Service.

Record Number: 18063
Source Name: Service Control Manager
Time Written: 20090911203951.000000+120
Event Type: Informations
User: B-B5F0F0BC18CA4\BBD

Computer Name: B-B5F0F0BC18CA4
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 18062
Source Name: Tcpip
Time Written: 20090911194207.000000+120
Event Type: Avertissement
User:

Computer Name: B-B5F0F0BC18CA4
Event Code: 7034
Message: Le service ATK Keyboard Service s'est terminé de façon inattendue pour la 1ème fois.

Record Number: 18061
Source Name: Service Control Manager
Time Written: 20090911185548.000000+120
Event Type: erreur
User:

Computer Name: B-B5F0F0BC18CA4
Event Code: 7036
Message: Le service Google Software Updater est entré dans l'état : arrêté.

Record Number: 18060
Source Name: Service Control Manager
Time Written: 20090911185524.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: B-B5F0F0BC18CA4
Event Code: 4096
Message: Le service AntiVir a bien démarré!

Record Number: 341
Source Name: Avira AntiVir
Time Written: 20090527184046.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: B-B5F0F0BC18CA4
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 340
Source Name: SecurityCenter
Time Written: 20090527184041.000000+120
Event Type: Informations
User:

Computer Name: B-B5F0F0BC18CA4
Event Code: 1517
Message: Windows a sauvegardé le Registre utilisateur B-B5F0F0BC18CA4\BBD alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé.

Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

Record Number: 339
Source Name: Userenv
Time Written: 20090526231305.000000+120
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: B-B5F0F0BC18CA4
Event Code: 8
Message: Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> avec l'erreur : Cette opération s'est terminée car le délai d'attente a expiré.

Record Number: 338
Source Name: crypt32
Time Written: 20090526192356.000000+120
Event Type: erreur
User:

Computer Name: B-B5F0F0BC18CA4
Event Code: 4096
Message: Le service AntiVir a bien démarré!

Record Number: 337
Source Name: Avira AntiVir
Time Written: 20090526192334.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Adobe\AGL
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

(De mieux en mieux)

2- MALWAREBYTES'ANTI-MALWARE

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2943
Windows 5.1.2600 Service Pack 3

12/10/2009 18:51:22
mbam-log-2009-10-12 (18-51-22).txt

Type de recherche: Examen rapide
Eléments examinés: 103140
Temps écoulé: 4 minute(s), 8 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

34 réponses

Résumé de la discussion

Le ralentissement du PC s'accompagne de résultats d'analyses détaillées, incluant des rapports d'outils système et de sécurité, suite à l'exécution d'une procédure de désinfection initiale. Plusieurs éléments relevés montrent une infection potentielle ou logiciels indésirables au démarrage et dans les processus, avec des objets de navigateur et des modules d'extension agressifs, ainsi que des services et tâches planifiées suspects. Des analyses complémentaires ont été réalisées avec HijackThis, Malwarebytes et Trend Micro HouseCall, répertoriant des services, programmes et barres d'outils actifs remettant en question la propreté du poste. En tant que contexte, la configuration citée est Windows XP Professionnel SP3 avec environ 1 Go de RAM et un disque système relativement chargé, ce qui peut contribuer aux ralentissements.

Bobot (l’IA à votre service)
  1. crapoulou Modérateur
    ********A faire sur <souligne>le premier PC :</souligne>**********

    Poste un nouveau rapport RSIT pour faire le point stp.

    ********A faire sur <souligne>le deuxième PC :</souligne>**********

    Relance Hijackthis : il se situe ici :
    C:\Program Files\Trend Micro\HijackThis\Lesix.exe
    Clique sur "Do a system scan only".
    Coche ces lignes : 
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Video_deluxe_2008_PLUS\TrayServer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

    Clique ensuite sur fix checked.
    Ferme Hijackthis.

    ********A faire sur <souligne>le deuxième PC :</souligne>**********

    Mets à jour Internet Explorer en téléchargeant la version 8 (même si tu ne l’utilises pas, sinon c’est une faille de sécurité de ne pas le tenir à jour…)
    = = = =>>> En cliquant ici <<<= = = =

    ET

    Mets à jour Windows en installant le SP3 :
    http://www.microsoft.com/downloads/details.aspx?familyid=2FCDE6CE-B5FB-4488-8C50-FE22559D164E&displaylang=fr
    1. nico987
      Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3 (Team IDN) sur ton Bureau.

      Télécharge le et tu le lances, tu fais l'option 1
      1. Lesix
        Bonsoir,
        Trop rapide la réponse !!!!
        Merci Nico987
        voila le résultat

        -----------\\ ToolBar S&D 1.2.9 XP/Vista

        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
        X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2140 @ 1.60GHz )
        BIOS : BIOS Date: 07/19/07 11:46:27 Ver: 08.00.12
        USER : BBD ( Administrator )
        BOOT : Normal boot
        Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
        A:\ (USB)
        C:\ (Local Disk) - NTFS - Total:29 Go (Free:14 Go)
        D:\ (CD or DVD)
        E:\ (Local Disk) - NTFS - Total:45 Go (Free:20 Go)

        "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
        Option : [1] ( 12/10/2009|19:09 )

        -----------\\ Recherche de Fichiers / Dossiers ...

        C:\Program Files\AskSBar
        C:\Program Files\AskSBar\bar
        C:\Program Files\AskSBar\bar\1.bin
        C:\Program Files\AskSBar\bar\Cache
        C:\Program Files\AskSBar\bar\History
        C:\Program Files\AskSBar\bar\Settings
        C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
        C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
        C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
        C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
        C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
        C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
        C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
        C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
        C:\Program Files\AskSBar\bar\Cache\0033F9AA
        C:\Program Files\AskSBar\bar\Cache\0033FD82
        C:\Program Files\AskSBar\bar\Cache\0033FF37.bin
        C:\Program Files\AskSBar\bar\Cache\003400FD.bin
        C:\Program Files\AskSBar\bar\Cache\003402B2.bin
        C:\Program Files\AskSBar\bar\Cache\files.ini
        C:\Program Files\AskSBar\bar\History\search2
        C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
        C:\Program Files\GamesBar
        C:\Program Files\GamesBar\Localization-French.ini

        -----------\\ [..\Internet Explorer\Main]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
        "Start Page"="https://www.google.fr/?gws_rd=ssl"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
        "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
        "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
        "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"

        --------------------\\ Recherche d'autres infections

        --------------------\\ Cracks & Keygens ..

        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\Astalavista.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\Darkcristal.com Utilitaires au top !.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\http--esteban.p.free.fr-1dex1.html.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\KEYGEN.MS - 3DMark 2001 SE Pro Build 330.zip keygen crack instant download.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\[ Crack - s‚rials , page 1 ].url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Visual basic\Serials and Cracks - Cerials.NET - The Internet's Premiere Serials & Cracks Resource..url

        1 - "C:\ToolBar SD\TB_1.txt" - 12/10/2009|19:09 - Option : [1]

        -----------\\ Fin du rapport a 19:09:52,17

        Bon courage et encore merci pour ton aide
    2. nico987
      option 2 maintenant.
      1. Lesix
        Re-bonsoir,
        Option 2 fait :

        -----------\\ ToolBar S&D 1.2.9 XP/Vista

        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
        X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2140 @ 1.60GHz )
        BIOS : BIOS Date: 07/19/07 11:46:27 Ver: 08.00.12
        USER : BBD ( Administrator )
        BOOT : Normal boot
        Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
        A:\ (USB)
        C:\ (Local Disk) - NTFS - Total:29 Go (Free:14 Go)
        D:\ (CD or DVD)
        E:\ (Local Disk) - NTFS - Total:45 Go (Free:20 Go)

        "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
        Option : [2] ( 12/10/2009|20:08 )

        -----------\\ SUPPRESSION

        Supprime! - C:\Program Files\AskSBar\bar
        Supprime! - C:\Program Files\GamesBar\Localization-French.ini
        Supprime! - C:\Program Files\AskSBar
        Supprime! - C:\Program Files\GamesBar

        -----------\\ Recherche de Fichiers / Dossiers ...

        -----------\\ [..\Internet Explorer\Main]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
        "Start Page"="https://www.google.fr/?gws_rd=ssl"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
        "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
        "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
        "Start Page"="https://www.msn.com/fr-fr/"

        --------------------\\ Recherche d'autres infections

        --------------------\\ Cracks & Keygens ..

        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\Astalavista.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\Darkcristal.com Utilitaires au top !.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\http--esteban.p.free.fr-1dex1.html.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\KEYGEN.MS - 3DMark 2001 SE Pro Build 330.zip keygen crack instant download.url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\[ Crack - s‚rials , page 1 ].url
        C:\DOCUME~1\BBD\Favoris\6\Informatique\Visual basic\Serials and Cracks - Cerials.NET - The Internet's Premiere Serials & Cracks Resource..url

        1 - "C:\ToolBar SD\TB_1.txt" - 12/10/2009|19:09 - Option : [1]
        2 - "C:\ToolBar SD\TB_2.txt" - 12/10/2009|20:09 - Option : [2]

        -----------\\ Fin du rapport a 20:09:35,03

        Alors docteur c'est grave?????
    3. nico987
      Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau. :
      http://www.malwarebytes.org/mbam/program/mbam-setup.exe
      --> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
      --> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
      --> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
      --> Sélectionne Exécuter un examen complet.
      --> Clique sur Rechercher. L'analyse démarre.
      Poste le rapport qui s'ouvre.
      1. Lesix
        Bonsoir,

        Voila le résultat dde MBAM :

        Malwarebytes' Anti-Malware 1.41
        Version de la base de données: 2954
        Windows 5.1.2600 Service Pack 3

        13/10/2009 19:10:36
        mbam-log-2009-10-13 (19-10-36).txt

        Type de recherche: Examen complet (C:\|E:\|)
        Eléments examinés: 183829
        Temps écoulé: 34 minute(s), 32 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 0
        Valeur(s) du Registre infectée(s): 0
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 0

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Valeur(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        (Aucun élément nuisible détecté)

        On dirait que ça devient bon???

        Par contre j'ai encore essayé un scan online avec BITDEFENDER : toujours le même message d'erreur
        "This web site is not autorized ....."
        et scan impossible.

        Encore merci de votre aide.
    6. Lesix
      Bonsoir,
      Un petit rapport :

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by BBD at 2009-10-14 19:25:31
      Microsoft Windows XP Professionnel Service Pack 3
      System drive C: has 15 GB (49%) free of 30 GB
      Total RAM: 1023 MB (45% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 19:25:36, on 14/10/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir Desktop\sched.exe
      C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Google\Update\GoogleUpdate.exe
      C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
      C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
      C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
      C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
      C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\Program Files\BboxUpdate\BTLiveUpdate.exe
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
      C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Logitech\SetPoint\SetPoint.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Documents and Settings\BBD\Bureau\RSIT.exe
      C:\Program Files\trend micro\BBD.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - Default URLSearchHook is missing
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
      O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
      O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
      O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
      O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
      O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
      O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
      O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.06\is\PhysX_9.09.0203_SystemSoftware.exe"
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
      O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
      O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
      O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
      O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - https://intranet.colas.com/dana-cached/setup/JuniperSetupSP1.cab
      O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
      O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
      O23 - Service: Service Google Update (gupdate1c9f809cb3b95e6) (gupdate1c9f809cb3b95e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
      O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
      O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      1. nico987
        Tu branches toutes tes clés usb, disque dur externe susbetiles d'être infecté.

        Télécharge usbfix : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

        Tu le lances (brancher la clé, avant) et tu fais f puis enter. Puis 1 puis enter.

        tuto ici : https://www.malekal.com/usbfix-supprimer-virus-usb/
        1. Lesix
          Re-bonsoir,
          et merci encore pour la patience dont vous faites preuve avec mon problème ci-joint le rapport de UsbFix.

          ############################## | UsbFix V6.042 |

          User : BBD (Administrateurs) # B-B5F0F0BC18CA4
          Update on 14/10/2009 by Chiquitine29, C_XX & Chimay8
          Start at: 20:00:21 | 14/10/2009
          Website : http://pagesperso-orange.fr/NosTools/index.html

          Intel(R) Pentium(R) Dual CPU E2140 @ 1.60GHz
          Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
          Internet Explorer 8.0.6001.18702
          Windows Firewall Status : Enabled
          AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

          A:\ -> Lecteur de disquettes 3 ½ pouces
          C:\ -> Disque fixe local # 29,29 Go (14,33 Go free) # NTFS
          D:\ -> Disque CD-ROM
          E:\ -> Disque fixe local # 45,23 Go (20,99 Go free) [Données] # NTFS
          F:\ -> Disque amovible # 7,52 Go (5,39 Go free) [CORSAIR] # FAT32

          ############################## | Processus actifs |

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Avira\AntiVir Desktop\sched.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Avira\AntiVir Desktop\avguard.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\Program Files\Google\Update\GoogleUpdate.exe
          C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
          C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
          C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\RTHDCPL.EXE
          C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
          C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\WINDOWS\system32\wbem\wmiapsrv.exe
          C:\Program Files\BboxUpdate\BTLiveUpdate.exe
          C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
          C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\WINDOWS\System32\alg.exe
          C:\Program Files\Logitech\SetPoint\SetPoint.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\WINDOWS\system32\wbem\wmiprvse.exe

          ################## | Fichiers # Dossiers infectieux |

          F:\autorun.inf
          F:\adober.exe
          F:\RavMonLog

          ################## | Registre # Clés Run infectieuses |

          [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"

          ################## | Registre # Mountpoints2 |

          HKCU\..\..\Explorer\MountPoints2\{1c8e5d83-9c46-11dd-b2e5-4d6564696130}
          Shell\Auto\command =F:\AdobeR.exe e
          Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

          ################## | ! Fin du rapport # UsbFix V6.042 ! |

          Maintenant que ça me revient mon antivirus m'avait à plusieurs reprise signalé un virus sur cette clé mais comme j'avais tout éffacé et re-formaté la clé, je pensais le probléme réglé.
          J'ai un 2eme PC qui n'est pas connecté sur internet mais avec lequel j'échange des données au moyen de cette clé.
          Question : Ce 2 eme PC a-t-il pu être infecté??

          Pour le scan en ligne BITDEFENDER ça progresse toujours (67023 Fichiers sur 77832) je vous tiens au, cournant.
      2. nico987
        option 2 maintenant, le pc va redémarrer, le bureau va disparaître, ne touche à rien laisse l'outil travailler.
        1. Lesix
          Pendant l'usbFix Le fichier Adober.exe a été signalé par mon anti-virus (choix : Supprimer)
          j'ai envoyé comme demandé le fichier à la fin
          De mémoire ce fichier AdobeR.exe ainsi que msvcr.dll se trouvait à plusieurs reprises dans ma clé sans que je puisse me l'expliquer.

          Et maintenant .... en supposant que ce PC soit désinfécté, je me fais du soucis après la lecture (rapide) Du site de MALEKAL.
          Faut-il désinfecter tout le reste de mon matériel :
          - mon 2 eme PC
          - 1 carte mémoire PHoto SD 512 Mo
          - 1 2eme Carte Mémoire SD de 2 Go (et qui est maintenant dans mon GPS)

          Que dois-je Faire? en plus le scan en ligne de BITDEFENDER s'est planté avant la fin !?!
      3. nico987
        as-tu le rapport usbfix ? et oui si tu fais passer la clé sur l'autre ordi, il a pu être infecté.
        On va faire un pc à la fois.
        On finit celui là mais je pense que c'est bon.
        Poste le rapport de suppression de usbfix.
        1. Lesix
          Salut,
          Voici le rapport usbfix :

          ############################## | UsbFix V6.042 |

          User : BBD (Administrateurs) # B-B5F0F0BC18CA4
          Update on 14/10/2009 by Chiquitine29, C_XX & Chimay8
          Start at: 20:37:33 | 14/10/2009
          Website : http://pagesperso-orange.fr/NosTools/index.html

          Intel(R) Pentium(R) Dual CPU E2140 @ 1.60GHz
          Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
          Internet Explorer 8.0.6001.18702
          Windows Firewall Status : Enabled
          AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

          A:\ -> Lecteur de disquettes 3 ½ pouces
          C:\ -> Disque fixe local # 29,29 Go (14,29 Go free) # NTFS
          D:\ -> Disque CD-ROM
          E:\ -> Disque fixe local # 45,23 Go (20,99 Go free) [Données] # NTFS
          F:\ -> Disque amovible # 7,52 Go (5,39 Go free) [CORSAIR] # FAT32

          ############################## | Processus actifs |

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
          C:\WINDOWS\system32\logonui.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Avira\AntiVir Desktop\sched.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Avira\AntiVir Desktop\avguard.exe
          C:\WINDOWS\ATKKBService.exe
          C:\Program Files\Google\Update\GoogleUpdate.exe
          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          C:\Program Files\Google\Update\GoogleUpdate.exe
          C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
          C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe
          C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          C:\WINDOWS\system32\wbem\wmiapsrv.exe
          C:\WINDOWS\System32\alg.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe

          ################## | Fichiers # Dossiers infectieux |

          F:\autorun.inf -> fichier appelé : "F:\AdobeR.exe e" ( Absent ! )
          Supprimé ! F:\autorun.inf
          Supprimé ! F:\adober.exe
          Supprimé ! F:\RavMonLog

          ################## | Registre # Clés Run infectieuses |

          Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"

          ################## | Registre # Mountpoints2 |

          ################## | Listing des fichiers présent |

          [15/02/2008 20:26|--a------|0] C:\AUTOEXEC.BAT
          [11/10/2009 01:10|--ahs----|292] C:\boot.ini
          [28/08/2001 14:00|-rahs----|4952] C:\Bootfont.bin
          [03/08/2004 23:00|-r-hs----|263488] C:\cmldr
          [15/02/2008 20:26|--a------|0] C:\CONFIG.SYS
          [14/08/2009 22:56|--a------|184] C:\drwtsn32.log
          [17/02/2008 01:13|--a------|185] C:\install_comp.txt
          [15/02/2008 20:26|-rahs----|0] C:\IO.SYS
          [11/10/2009 00:54|--a------|3798] C:\liste.txt
          [15/02/2008 20:26|-rahs----|0] C:\MSDOS.SYS
          [03/08/2004 22:38|-rahs----|47564] C:\NTDETECT.COM
          [12/09/2009 13:14|-rahs----|252240] C:\ntldr
          [?|?|?] C:\pagefile.sys
          [02/09/2009 23:18|--ah-----|232] C:\sqmdata00.sqm
          [02/09/2009 23:19|--ah-----|232] C:\sqmdata01.sqm
          [02/09/2009 23:20|--ah-----|232] C:\sqmdata02.sqm
          [02/09/2009 23:20|--ah-----|232] C:\sqmdata03.sqm
          [12/10/2009 03:23|--ah-----|232] C:\sqmdata04.sqm
          [15/07/2009 10:22|--ah-----|232] C:\sqmdata05.sqm
          [15/07/2009 20:11|--ah-----|232] C:\sqmdata06.sqm
          [13/08/2009 12:59|--ah-----|232] C:\sqmdata07.sqm
          [16/08/2009 13:54|--ah-----|232] C:\sqmdata08.sqm
          [16/08/2009 14:31|--ah-----|232] C:\sqmdata09.sqm
          [17/08/2009 09:36|--ah-----|232] C:\sqmdata10.sqm
          [18/08/2009 09:26|--ah-----|232] C:\sqmdata11.sqm
          [18/08/2009 12:53|--ah-----|232] C:\sqmdata12.sqm
          [19/08/2009 09:06|--ah-----|232] C:\sqmdata13.sqm
          [19/08/2009 09:18|--ah-----|232] C:\sqmdata14.sqm
          [19/08/2009 15:27|--ah-----|268] C:\sqmdata15.sqm
          [19/08/2009 22:32|--ah-----|232] C:\sqmdata16.sqm
          [20/08/2009 14:04|--ah-----|232] C:\sqmdata17.sqm
          [21/08/2009 13:02|--ah-----|232] C:\sqmdata18.sqm
          [21/08/2009 23:11|--ah-----|232] C:\sqmdata19.sqm
          [02/09/2009 23:19|--ah-----|244] C:\sqmnoopt00.sqm
          [02/09/2009 23:20|--ah-----|244] C:\sqmnoopt01.sqm
          [02/09/2009 23:20|--ah-----|244] C:\sqmnoopt02.sqm
          [12/10/2009 03:23|--ah-----|244] C:\sqmnoopt03.sqm
          [15/07/2009 10:22|--ah-----|244] C:\sqmnoopt04.sqm
          [15/07/2009 20:11|--ah-----|244] C:\sqmnoopt05.sqm
          [13/08/2009 12:59|--ah-----|244] C:\sqmnoopt06.sqm
          [16/08/2009 13:54|--ah-----|244] C:\sqmnoopt07.sqm
          [16/08/2009 14:31|--ah-----|244] C:\sqmnoopt08.sqm
          [17/08/2009 09:36|--ah-----|244] C:\sqmnoopt09.sqm
          [18/08/2009 09:26|--ah-----|244] C:\sqmnoopt10.sqm
          [18/08/2009 12:53|--ah-----|244] C:\sqmnoopt11.sqm
          [19/08/2009 09:06|--ah-----|244] C:\sqmnoopt12.sqm
          [19/08/2009 09:18|--ah-----|244] C:\sqmnoopt13.sqm
          [19/08/2009 15:27|--ah-----|244] C:\sqmnoopt14.sqm
          [19/08/2009 22:32|--ah-----|244] C:\sqmnoopt15.sqm
          [20/08/2009 14:04|--ah-----|244] C:\sqmnoopt16.sqm
          [21/08/2009 13:02|--ah-----|244] C:\sqmnoopt17.sqm
          [21/08/2009 23:11|--ah-----|244] C:\sqmnoopt18.sqm
          [02/09/2009 23:18|--ah-----|244] C:\sqmnoopt19.sqm
          [12/10/2009 20:09|--a------|2511] C:\TB.txt
          [14/10/2009 20:46|--a------|5350] C:\UsbFix.txt
          [26/09/2009 16:08|--a------|9502720] E:\Money3.mny
          [26/09/2009 16:08|-ra------|9505422] E:\Money6 Sauvegarde.mbf
          [29/02/2004 17:44|--a------|52576] E:\orange.bmp
          [21/06/2009 03:49|--a------|179] E:\Raccourci vers Disque amovible (F).lnk
          [08/09/2009 19:12|--a------|983080] F:\KeyUpdateTool_enu.exe
          [04/10/2009 18:27|--a------|3137120] F:\EasyDVDShrink.exe
          [29/09/2009 22:28|--a------|104857600] F:\gparted-live-cd_gparted_live_cd_0.4.6.1_francais_18746.iso
          [05/10/2009 18:16|---hs----|348160] F:\msvcr71.dll

          ################## | Vaccination |

          # C:\autorun.inf -> Folder created by UsbFix.
          # E:\autorun.inf -> Folder created by UsbFix.
          # F:\autorun.inf -> Folder created by UsbFix.

          ################## | Upload |

          Veuillez envoyer le fichier : C:\DOCUME~1\BBD\Bureau\UsbFix_Upload_Me_B-B5F0F0BC18CA4.zip : https://www.androidworld.fr/
          Merci pour votre contribution .

          surtout merci à nico987 pour son aide.
      4. nico987
        ça va mieux l'ordi, il marche plus vite ou pas ?

        Télécharge genproc ici : http://www.genproc.com/GenProc.exe

        Tu le lances (double clic) et tu le laisses faire, après tu réponds oui à la question et tu me postes le rapport.
        1. Lesix
          Voila un nouveau rapport "hijack"
          Le PC marche plus vite qu'avant indéniablement.

          Logfile of random's system information tool 1.06 (written by random/random)
          Run by BBD at 2009-10-15 19:12:02
          Microsoft Windows XP Professionnel Service Pack 3
          System drive C: has 15 GB (48%) free of 30 GB
          Total RAM: 1023 MB (49% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 19:12:07, on 15/10/2009
          Platform: Windows XP SP3 (WinNT 5.01.2600)
          MSIE: Internet Explorer v8.00 (8.00.6001.18702)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Avira\AntiVir Desktop\sched.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\RTHDCPL.EXE
          C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
          C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\BboxUpdate\BTLiveUpdate.exe
          C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
          C:\Program Files\Avira\AntiVir Desktop\avguard.exe
          C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\Program Files\Google\Update\GoogleUpdate.exe
          C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
          C:\Program Files\Logitech\SetPoint\SetPoint.exe
          C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
          C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\WINDOWS\system32\wbem\wmiapsrv.exe
          C:\WINDOWS\system32\NOTEPAD.EXE
          C:\Documents and Settings\BBD\Bureau\RSIT.exe
          C:\Program Files\trend micro\BBD.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - Default URLSearchHook is missing
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
          O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
          O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
          O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
          O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
          O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
          O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
          O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
          O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
          O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
          O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
          O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
          O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
          O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
          O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
          O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe
          O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
          O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
          O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
          O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
          O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.06\is\PhysX_9.09.0203_SystemSoftware.exe"
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
          O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
          O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
          O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
          O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
          O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
          O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
          O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
          O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
          O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
          O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
          O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
          O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - https://intranet.colas.com/dana-cached/setup/JuniperSetupSP1.cab
          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
          O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
          O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
          O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
          O23 - Service: Service Google Update (gupdate1c9f809cb3b95e6) (gupdate1c9f809cb3b95e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
          O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
          O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
          O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
          O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
          O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      5. nico987
        télécharge hijackthis tu l'installes le lance, tu fais do a only scan puis tu coches ces lignes :

        O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe

        O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe

        Tu cliques dur fix checked et réponds oui.

        Après c'est bon.

        Tu voudras qu'on s'occupe de ton second pc ou pas ?
        1. Lesix
          Bonsoir,
          Si ce n'était pas abuser de ta patience je souhaiterais effectivement qu'on s'occupe de l'autre PC.
          Merci.
      6. nico987
        ok c'est parti fais un scan rsit du second pc.
        1. Lesix
          C'est la cata, c'est la cata, c'est la catastrophe ....

          Pour faire le scan RSIT et récupérer les 2 fichiers que je te joins, j'ai utilisé ma clé USB, et au moment où je remet la clé sur ce PC j'ai une détéction virus de AVAST :
          "WORM/RjumpD" dans "F:\AdobeR.exe" (toujours lui)
          j'ai pris le choix "supprimer"
          J'espere que je n'ai pas ré-infecté ce PC
          Pour "ouvrir" la clé, J'ai bien fait attention à chaque fois de proceder comme il est précisé sur le site de MALEKAL, à savoir PAS DE DOUBLE-CLICK, mais un CLICK DROIT et OUVRIR.

          Voici les 2 fichiers du scan RSIT du 2 eme PC (pour la vidéo, et les "bidouilles")

          info.txt logfile of random's system information tool 1.06 2009-10-16 18:48:19

          ======Uninstall list======

          -->C:\Program Files\MAGIX\Goya_burnR_mxcdr\instslct.exe
          -->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
          -->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
          -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
          -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
          -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
          -->C:\WINDOWS\UNRecode.exe /UNINSTALL
          -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
          3DMark05-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2DF7B278-D3B6-40A4-B25C-0E7149F439EA}\setup.exe" -l0x9 -removeonly
          7-Zip 4.35 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
          Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
          Adobe Reader 7.0.5 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70500000002}
          AIDA32 v3.20-->"C:\Program Files\AIDA32 - Enterprise System Information\unins000.exe"
          Analyseur MSXML 6.0-->MsiExec.exe /I{5903C48B-E953-47B8-A651-B9222C483057}
          Application Compatibility Toolkit-->MsiExec.exe /X{B4CF72FF-4A3F-44A7-BFF2-31A8E1CC70B6}
          Application Verifier Database-->C:\WINDOWS\system32\sdbinst.exe -u "C:\WINDOWS\AppPatch\Custom\{448850f4-a5ea-4dd1-bf1b-d5fa285dc64b}.sdb"
          Assistant Publication de sites Web Microsoft 1.53-->RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie3x86.inf,WebPostUninstall
          AutoCAD 2009 - Français-->C:\Program Files\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-040C-0002-0060B0CE6BBA} /M ACAD
          Canon Camera Support Core Library-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{91F1A0D6-23AD-49FE-8D4E-379485652214} /l1036
          Canon Camera Window DS for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{91203BD3-6C3E-472F-ADBD-F60FDC7C4010}
          Canon Camera Window DVC for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{4C96958A-6562-4143-B820-FF4890D3B734}
          Canon Camera Window for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{C7281207-4AA4-425E-B57A-0E9EF8445635}
          Canon Internet Library for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{2F81FBFC-9A37-431F-9050-14B55485DF5A}
          Canon MovieEdit Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{8AF1E098-1A5C-4336-BBE2-D047ABB401ED}
          Canon PhotoRecord-->MsiExec.exe /X{0878E100-C0BB-41E8-B4C6-C486B61FDA7B}
          Canon RAW Image Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{44E24545-F317-4498-B7CD-240DE7BA8DE2}
          Canon RemoteCapture Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{28291BD5-92D2-4685-82DC-CCA925C53CCA}
          CANON USB Video Driver-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{0867A478-1095-4CF5-9B8D-4F7E5F05D5BB} /l1036 anything
          Canon Utilities PhotoStitch 3.1-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{218BBBE3-FE63-4BB2-81A8-7435575A84FA}
          Canon ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
          Crystal Reports Basic for Visual Studio 2008-->MsiExec.exe /X{AA467959-A1D6-4F45-90CD-11DC57733F32}
          Crystal Reports Basic French Language Pack for Visual Studio 2008-->MsiExec.exe /X{2516845C-017F-4036-828B-3365FF640AB6}
          DV Network Software-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{C219D284-F161-4731-AC0E-D89814ACEABE} /l1036 anything
          DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
          DVD Solution-->"C:\Program Files\Uninstall_CDS.exe"
          DVD-CLONER V6.00 Build 977-->"C:\Program Files\Dvd-cloner\unins000.exe"
          Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
          Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\instslct.exe /p
          Google SketchUp 6 Exporters-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EB459C2F-41CA-4222-B9CA-F8EBA40B8DAB}\setup.exe" -l0x40c -removeonly
          Google SketchUp 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x40c -removeonly
          Google SketchUp LayOut 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C12D609B-EB71-411B-82C3-9BE6D40435D7}\setup.exe" -l0x40c -removeonly
          Google SketchUp Pro 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12E75B98-8463-4C1F-8DDA-F6CF31566A55}\setup.exe" -l0x40c -removeonly
          Gruntz-->C:\WINDOWS\unin040c.exe -fC:\Games\Gruntz\DeIsL1.isu
          IsoBuster 2.4-->"C:\Program Files\Smart Projects\IsoBuster\Uninst\unins000.exe"
          MadOnion.com/3DMark2001 SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{91B323B5-A79C-4D23-BD6D-046C565F9BCF}\Setup.exe" -l0x9 uninstall -uninst
          MAGIX Music Manager 2007 8.1.1.102 (F)-->C:\Program Files\MAGIX\Music_Manager_2007\instslct.exe
          MAGIX Photo Manager 2007 4.2.0.85 (F)-->C:\Program Files\MAGIX\Photo_Manager_2007\instslct.exe
          MAGIX Video deluxe 2008 PLUS 7.0.2.3 (F)-->C:\Program Files\MAGIX\Video_deluxe_2008_PLUS\instslct.exe
          MAGIX Xtreme Photo Designer 6 6.0.20.0 (F)-->C:\Program Files\MAGIX\Xtreme_Foto_Designer_6\instslct.exe
          Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
          Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
          Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
          Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
          Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
          Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
          Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
          Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
          Microsoft Device Emulator version 3.0 - FRA-->MsiExec.exe /X{A5774693-2D17-3E6C-9324-97B17C5AA1E9}
          Microsoft Document Explorer 2008 Language Pack - FRA-->MsiExec.exe /X{AACA7728-BE87-3D11-8A3F-773664BFCF1B}
          Microsoft Document Explorer 2008-->C:\Program Files\Fichiers communs\Microsoft Shared\Help 9\Microsoft Document Explorer 2008\install.exe
          Microsoft Document Explorer 2008-->MsiExec.exe /X{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}
          Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
          Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
          Microsoft Office Visual Web Developer 2007-->MsiExec.exe /X{90120000-0021-0000-0000-0000000FF1CE}
          Microsoft Office Visual Web Developer MUI (French) 2007-->MsiExec.exe /X{90120000-0021-040C-0000-0000000FF1CE}
          Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)-->MsiExec.exe /I{480DBB60-F0B6-45F2-B26F-1A2E11197791}
          Microsoft SQL Server 2005 Tools Express Edition-->MsiExec.exe /I{3F59A7E0-BC01-4435-9E93-C7D7015C21DA}
          Microsoft SQL Server 2005-->"c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
          Microsoft SQL Server Compact 3.5 Design Tools FRA-->MsiExec.exe /X{043ECF7B-4724-4F7B-8A9D-BC22719E95F7}
          Microsoft SQL Server Compact 3.5 for Devices FRA-->MsiExec.exe /I{B4C6D770-DF2E-4731-8869-F89BA6670DDA}
          Microsoft SQL Server Compact 3.5 FRA-->MsiExec.exe /I{BE361597-42AC-4513-9BA6-FFAB310038FB}
          Microsoft SQL Server Database Publishing Wizard 1.2-->MsiExec.exe /X{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}
          Microsoft SQL Server Native Client-->MsiExec.exe /I{9C7E944F-4502-40B8-A0AB-66B2FA9EE829}
          Microsoft SQL Server VSS Writer-->MsiExec.exe /I{75FF1600-6330-43FA-9022-E0835BF20778}
          Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
          Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack-->C:\Program Files\Fichiers communs\Microsoft Shared\VSTO\8.0\Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack\install.exe
          Microsoft Visual Studio 2005 Tools for Office Runtime-->MsiExec.exe /X{388E4B09-3E71-4649-8921-F44A3A2954A7}
          Microsoft Visual Studio 2008 Professional Edition - Français-->C:\Program Files\Microsoft Visual Studio 9.0\Microsoft Visual Studio 2008 Professional Edition - FRA\setup.exe
          Microsoft Visual Studio 6.0 Édition Entreprise (Français)-->"C:\Program Files\Microsoft Visual Studio\Common\Setup\1036\Setup.exe"
          Microsoft Visual Studio Web Authoring Component-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISUALWEBDEVELOPER /dll OSETUP.DLL
          Microsoft VM for Java-->RunDll32 advpack.dll,LaunchINFSection java.inf,UnInstall
          Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools-->MsiExec.exe /X{6E88CC59-832E-39AF-AE17-B9017DDB12C3}
          Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries-->MsiExec.exe /X{842FAF7C-50EF-4463-9B8F-6222E1384D7D}
          Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense-->MsiExec.exe /X{64c5b887-b5ee-42b8-8596-78905a6b5f1f}
          Microsoft Windows SDK for Visual Studio 2008 Tools-->MsiExec.exe /X{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}
          Microsoft Windows SDK for Visual Studio 2008 Win32 Tools-->MsiExec.exe /X{B268E9A1-04A9-40D0-9866-846BE2B74BA7}
          Module linguistique Microsoft .NET Framework 3.5 - fra-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
          Module linguistique Microsoft Document Explorer 2008 - FRA-->C:\Program Files\Fichiers communs\Microsoft Shared\Help 9\Microsoft Document Explorer 2008 Language Pack - FRA\install.exe
          Module linguistique Visual Studio Tools pour Office System 3.0 Runtime - FRA-->C:\Program Files\Fichiers communs\Microsoft Shared\VSTO\9.0\Visual Studio Tools for the Office system 3.0 Runtime Language Pack - FRA\install.exe
          MSDN Library for Visual Studio 2008 - FRA-->MsiExec.exe /X{24F3019E-D2AB-3DAA-A02E-470352304005}
          MSDN Library pour Visual Studio 2008 - FRA-->C:\Program Files\MSDN\MSDN9.0\MSDN Library for Visual Studio 2008 - FRA\setup.exe
          Multimedia Launcher-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
          Nero 7 Demo-->MsiExec.exe /I{C985153C-3801-EB63-1432-088E71801036}
          NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
          PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
          Sigmatek Disk Reader-->MsiExec.exe /I{64D1C23F-411C-4FBA-9B37-0ABC845C239B}
          SiSoftware Sandra Standard 2004.SP1 (BenchmarkHQ Edition)-->"C:\Program Files\SiSoftware\SiSoftware Sandra Standard 2004.SP1 (Win32 x86)\unins000.exe"
          SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe"
          Sport cérébral Brain challenge-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DA9AC5A3-6625-4B3A-B9CB-51294566D0B4}\Setup.exe" -l0x40c -removeonly
          Visual Studio 2005 Tools pour Office Second Edition Runtime-->c:\Program Files\Fichiers communs\Microsoft Shared\VSTO\8.0\Microsoft Visual Studio 2005 Tools for Office Runtime\install.exe
          Visual Studio Tools for the Office system 3.0 Runtime-->C:\Program Files\Fichiers communs\Microsoft Shared\VSTO\9.0\Visual Studio Tools for the Office system 3.0 Runtime\install.exe
          Visual Studio Tools for the Office system 3.0 Runtime-->MsiExec.exe /X{8FB53850-246A-3507-8ADE-0060093FFEA6}
          Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
          Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
          Windows Mobile 5.0 SDK R2 for Pocket PC-->MsiExec.exe /I{94576E4F-703B-4038-806B-CDE9479A33AF}
          Windows Mobile 5.0 SDK R2 for Smartphone-->MsiExec.exe /I{CCFA733C-2F56-4E8C-90B4-B38807400B7A}
          Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
          XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

          ======System event log======

          Computer Name: LESIX-498F5B332
          Event Code: 7
          Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

          Record Number: 12285
          Source Name: Cdrom
          Time Written: 20090513192204.000000+120
          Event Type: erreur
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 7
          Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

          Record Number: 12284
          Source Name: Cdrom
          Time Written: 20090513192203.000000+120
          Event Type: erreur
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 7
          Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

          Record Number: 12283
          Source Name: Cdrom
          Time Written: 20090513192201.000000+120
          Event Type: erreur
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 7
          Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

          Record Number: 12282
          Source Name: Cdrom
          Time Written: 20090513192200.000000+120
          Event Type: erreur
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 7
          Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

          Record Number: 12281
          Source Name: Cdrom
          Time Written: 20090513192158.000000+120
          Event Type: erreur
          User:

          =====Application event log=====

          Computer Name: LESIX-498F5B332
          Event Code: 26048
          Message: Le fournisseur de connexions locales du serveur est prêt à accepter la connexion sur [ \\.\pipe\MSSQL$SQLEXPRESS\sql\query ].

          Record Number: 8786
          Source Name: MSSQL$SQLEXPRESS
          Time Written: 20090427200631.000000+120
          Event Type: Informations
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 26048
          Message: Le fournisseur de connexions locales du serveur est prêt à accepter la connexion sur [ \\.\pipe\SQLLocal\SQLEXPRESS ].

          Record Number: 8785
          Source Name: MSSQL$SQLEXPRESS
          Time Written: 20090427200631.000000+120
          Event Type: Informations
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 26018
          Message: Un certificat généré automatiquement a été chargé avec succès pour le chiffrement.

          Record Number: 8784
          Source Name: MSSQL$SQLEXPRESS
          Time Written: 20090427200631.000000+120
          Event Type: Informations
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 17136
          Message: Effacement de la base de données tempdb.

          Record Number: 8783
          Source Name: MSSQL$SQLEXPRESS
          Time Written: 20090427200631.000000+120
          Event Type: Informations
          User:

          Computer Name: LESIX-498F5B332
          Event Code: 17137
          Message: Démarrage de la base de données 'msdb'.

          Record Number: 8782
          Source Name: MSSQL$SQLEXPRESS
          Time Written: 20090427200631.000000+120
          Event Type: Informations
          User:

          ======Environment variables======

          "ComSpec"=%SystemRoot%\system32\cmd.exe
          "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\FICHIE~1\AUTODE~1;C:\Program Files\Smart Projects\IsoBuster;c:\Program Files\Microsoft SQL Server\90\Tools\binn\
          "windir"=%SystemRoot%
          "FP_NO_HOST_CHECK"=NO
          "OS"=Windows_NT
          "PROCESSOR_ARCHITECTURE"=x86
          "PROCESSOR_LEVEL"=15
          "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
          "PROCESSOR_REVISION"=0401
          "NUMBER_OF_PROCESSORS"=2
          "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
          "TEMP"=%SystemRoot%\TEMP
          "TMP"=%SystemRoot%\TEMP
          "VS90COMNTOOLS"=C:\Program Files\Microsoft Visual Studio 9.0\Common7\Tools\

          -----------------EOF-----------------

          Logfile of random's system information tool 1.06 (written by random/random)
          Run by Lesix at 2009-10-16 18:48:17
          Microsoft Windows XP Professionnel Service Pack 2
          System drive C: has 24 GB (37%) free of 64 GB
          Total RAM: 2047 MB (82% free)

          HijackThis download failed

          ======Registry dump======

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
          "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]
          "SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2003-05-30 585728]
          "RemoteControl"=C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [2003-12-08 32768]
          "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2004-09-30 86016]
          "RavAV"=C:\WINDOWS\AdobeR.exe [2007-10-03 3514318]
          "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
          "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-09-30 4603904]
          "nwiz"=nwiz.exe /install []
          "ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-04-17 196608]
          "TrayServer"=C:\Program Files\MAGIX\Video_deluxe_2008_PLUS\TrayServer.exe [2007-07-17 90112]

          [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
          "PowerBar"= []
          "FreeRAM XP"=C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe [2006-03-23 1591808]
          "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe [2005-10-28 94208]

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
          C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
          C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe [2004-04-17 196608]

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe [2004-04-13 69632]

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
          "dontdisplaylastusername"=0
          "legalnoticecaption"=
          "legalnoticetext"=
          "shutdownwithoutlogon"=1
          "undockwithoutlogon"=1

          [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
          "NoDriveTypeAutoRun"=255
          "NoInstrumentation"=1

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
          "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
          "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
          shell\Auto\command - AdobeR.exe e
          shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53d8a7ae-ea13-11dd-87fb-0015f2157061}]
          shell\Auto\command - H:\AdobeR.exe e
          shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bd81bf8-e32a-11dd-87f4-0015f2157061}]
          shell\Auto\command - G:\AdobeR.exe e
          shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efe79a08-eb3a-11db-a3db-0015f2157061}]
          shell\AutoRun\command - G:\LaunchU3.exe

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd3158c8-7524-11dd-87b4-0015f2157061}]
          shell\Auto\command - G:\AdobeR.exe e
          shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

          ======File associations======

          .scr - open - C:\WINDOWS\system32\notepad.exe "%1"
          .scr - install -
          .scr - config -

          ======List of files/folders created in the last 1 months======

          2009-10-16 18:48:17 ----D---- C:\rsit
          2009-10-16 18:48:17 ----D---- C:\Program Files\trend micro

          ======List of files/folders modified in the last 1 months======

          2009-10-16 18:48:17 ----RD---- C:\Program Files
          2009-10-15 22:33:25 ----A---- C:\WINDOWS\SchedLgU.Txt
          2009-10-15 22:31:39 ----D---- C:\WINDOWS\Prefetch
          2009-10-15 20:27:57 ----A---- C:\WINDOWS\NeroDigital.ini
          2009-10-05 20:06:55 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink

          ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

          R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-19 40320]
          R1 PVR101Disk;PVR101Disk; C:\WINDOWS\system32\drivers\PVR101Disk.sys [2006-10-04 7936]
          R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
          R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-19 60800]
          R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-19 61824]
          R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-09-30 2743840]
          R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
          R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
          R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
          R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
          R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
          R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
          S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
          S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
          S2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [1996-12-12 64512]
          S3 61883;Pilote d'unité 61883; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-04 48128]
          S3 Avc;Périphérique AVC; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-04 38912]
          S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
          S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
          S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
          S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
          S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
          S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2004-08-04 51328]
          S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
          S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
          S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
          S3 s3m;s3m; C:\WINDOWS\system32\DRIVERS\s3m.sys [2001-08-17 166720]
          S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
          S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
          S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
          S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
          S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []

          ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

          R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
          R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
          R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2004-09-30 127043]
          R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
          R2 SQLWriter;Enregistreur VSS SQL Server; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
          S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
          S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2008-10-02 85096]
          S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
          S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
          S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
          S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
          S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
          S3 UPnPService;UPnPService; C:\Program Files\Fichiers communs\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
          S3 Visual Studio Analyzer RPC bridge;Visual Studio Analyzer RPC bridge; C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe [1998-06-06 34036]
          S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
          S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-11-08 3004416]
          S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]
          S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]

          -----------------EOF-----------------
          Voila en espérant que tout ne soit PAS à refaire sur le 1er PC.

          a plus
      7. crapoulou Modérateur
        Bonsoir,
        Le premier PC n'est absolument pas désinfecté :

        O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
        O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
        O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
        Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-07-10 732672]
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
        Fast Browser Search Toolbar Helper - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
        {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
        "SGPUpdater"=C:\Program Files\Search Guard PlusU\sgpUpdaters.exe [2009-05-15 67456]
        "FBSearch"=C:\Program Files\Search Guard Plus\SearchGuardPlus.exe [2009-05-04 194432]
        2. crapoulou Modérateur
          Je conseillerais à Lesix, de supprimer tout ce qui est crack, vecteur d'infection !

          C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks
          C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\Astalavista.url
          C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\Darkcristal.com Utilitaires au top !.url
          C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\http--esteban.p.free.fr-1dex1.html.url
          C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\KEYGEN.MS - 3DMark 2001 SE Pro Build 330.zip keygen crack instant download.url
          C:\DOCUME~1\BBD\Favoris\6\Informatique\Cracks\[ Crack - s‚rials , page 1 ].url
          C:\DOCUME~1\BBD\Favoris\6\Informatique\Visual basic\Serials and Cracks - Cerials.NET - The Internet's Premiere Serials & Cracks Resource..url

          *******Ensuite********

          MBAM !
          Très important dans une désinfection ! essentiel !
          1. nico987
            oui mais c'est déjà fais, as-tu lu le sujet ? J'ai fais toolbar s&d puis MBAM mais il n'a rien donné.
            1.  crapoulou Modérateur
              Autant pour moi : script ou suppression manuelle !

              Désinstallation dans la liste des programmes de ceci :
              Fast Browser Search
              Search Guard Plus
              Et suppression manuelle de :
              C:\Program Files\SGPSA
              C:\Program Files\Fast Browser Search
              C:\Program Files\Search Guard Plus

              Fixer les lignes correspondantes dans Hijackthis.
              1. nico987
                oui tu as raison, il faut les fixer, lexis relance hijackthis que je t'ai fais télécharger, tu fais do a scan only tu coches ces lignes :

                O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
                O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
                O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
                Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-07-10 732672]
                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
                Fast Browser Search Toolbar Helper - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
                {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
                "SGPUpdater"=C:\Program Files\Search Guard PlusU\sgpUpdaters.exe [2009-05-15 67456]
                "FBSearch"=C:\Program Files\Search Guard Plus\SearchGuardPlus.exe [2009-05-04 194432]

                (merci crapoulou)

                et tu fais fix checked, tu réponds oui.

                1. Lesix
                  Merci à Crapoulou pour sa contribution,

                  Je ne retrouve pas exactement les lignes correspondantes à :

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­­n\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
                  Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-07-10 732672]
                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­­n\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
                  Fast Browser Search Toolbar Helper - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
                  {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
                  "SGPUpdater"=C:\Program Files\Search Guard PlusU\sgpUpdaters.exe [2009-05-15 67456]
                  "FBSearch"=C:\Program Files\Search Guard Plus\SearchGuardPlus.exe [2009-05-04 194432]

                  en fait en faisant copier coller de la ligne :
                  02 - BHO/ Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll

                  Je retrouve :

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­­n\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
                  Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-07-10 732672]
                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­­n\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
                  Fast Browser Search Toolbar Helper - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
                  {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
                  "SGPUpdater"=C:\Program Files\Search Guard PlusU\sgpUpdaters.exe [2009-05-15 67456]
                  "FBSearch"=C:\Program Files\Search Guard Plus\SearchGuardPlus.exe [2009-05-04 194432]

                  donc si j'ai bien compris je sélectionne ces 3 lignes :

                  O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll

                  O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll

                  O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll

                  Et c'est tout?
                  Pas de fichiers ou dossiers à supprimer??

                  Merci de me confirmer.
              2. nico987
                oui supprime les.

                1. Lesix
                  C'est Supprimé.

                  mais J'ai toujours les 3 programmes suivants qui sont installés :
                  - Fast Browser search (My Tattoons)
                  - Search Guard Plus (My Tattoons)
                  - Search guard Plus updater (My Tattoons)

                  Sont-ils vraiment utiles??

                  Si l'on en a fini avec ce PC on peut passer au 2 eme PC
              3. nico987
                désinstalle les. puis va passer au second,
                1. Lesix
                  Voila c'est fait pour les 2 derniers pas de problèmes
                  par contre pour Fast Browser search il m'a fallu uitiliser un logiciel spécialisé.

                  a plus pour le 2eme PC
                2. Lesix
                  Pour le second j'ai fait de même qu'avec le premier:
                  un scan RSIT :

                  info.txt logfile of random's system information tool 1.06 2009-10-16 18:48:19

                  ======Uninstall list======

                  -->C:\Program Files\MAGIX\Goya_burnR_mxcdr\instslct.exe
                  -->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
                  -->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
                  -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
                  -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
                  -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
                  -->C:\WINDOWS\UNRecode.exe /UNINSTALL
                  -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
                  3DMark05-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2DF7B278-D3B6-40A4-B25C-0E7149F439EA}\setup.exe" -l0x9 -removeonly
                  7-Zip 4.35 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
                  Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
                  Adobe Reader 7.0.5 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70500000002}
                  AIDA32 v3.20-->"C:\Program Files\AIDA32 - Enterprise System Information\unins000.exe"
                  Analyseur MSXML 6.0-->MsiExec.exe /I{5903C48B-E953-47B8-A651-B9222C483057}
                  Application Compatibility Toolkit-->MsiExec.exe /X{B4CF72FF-4A3F-44A7-BFF2-31A8E1CC70B6}
                  Application Verifier Database-->C:\WINDOWS\system32\sdbinst.exe -u "C:\WINDOWS\AppPatch\Custom\{448850f4-a5ea-4dd1-bf1b-d5fa285dc64b}.sdb"
                  Assistant Publication de sites Web Microsoft 1.53-->RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie3x86.inf,WebPostUninstall
                  AutoCAD 2009 - Français-->C:\Program Files\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-040C-0002-0060B0CE6BBA} /M ACAD
                  Canon Camera Support Core Library-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{91F1A0D6-23AD-49FE-8D4E-379485652214} /l1036
                  Canon Camera Window DS for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{91203BD3-6C3E-472F-ADBD-F60FDC7C4010}
                  Canon Camera Window DVC for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{4C96958A-6562-4143-B820-FF4890D3B734}
                  Canon Camera Window for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{C7281207-4AA4-425E-B57A-0E9EF8445635}
                  Canon Internet Library for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{2F81FBFC-9A37-431F-9050-14B55485DF5A}
                  Canon MovieEdit Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{8AF1E098-1A5C-4336-BBE2-D047ABB401ED}
                  Canon PhotoRecord-->MsiExec.exe /X{0878E100-C0BB-41E8-B4C6-C486B61FDA7B}
                  Canon RAW Image Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{44E24545-F317-4498-B7CD-240DE7BA8DE2}
                  Canon RemoteCapture Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{28291BD5-92D2-4685-82DC-CCA925C53CCA}
                  CANON USB Video Driver-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{0867A478-1095-4CF5-9B8D-4F7E5F05D5BB} /l1036 anything
                  Canon Utilities PhotoStitch 3.1-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{218BBBE3-FE63-4BB2-81A8-7435575A84FA}
                  Canon ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
                  Crystal Reports Basic for Visual Studio 2008-->MsiExec.exe /X{AA467959-A1D6-4F45-90CD-11DC57733F32}
                  Crystal Reports Basic French Language Pack for Visual Studio 2008-->MsiExec.exe /X{2516845C-017F-4036-828B-3365FF640AB6}
                  DV Network Software-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{C219D284-F161-4731-AC0E-D89814ACEABE} /l1036 anything
                  DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
                  DVD Solution-->"C:\Program Files\Uninstall_CDS.exe"
                  DVD-CLONER V6.00 Build 977-->"C:\Program Files\Dvd-cloner\unins000.exe"
                  Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
                  Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\instslct.exe /p
                  Google SketchUp 6 Exporters-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EB459C2F-41CA-4222-B9CA-F8EBA40B8DAB}\setup.exe" -l0x40c -removeonly
                  Google SketchUp 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x40c -removeonly
                  Google SketchUp LayOut 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C12D609B-EB71-411B-82C3-9BE6D40435D7}\setup.exe" -l0x40c -removeonly
                  Google SketchUp Pro 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12E75B98-8463-4C1F-8DDA-F6CF31566A55}\setup.exe" -l0x40c -removeonly
                  Gruntz-->C:\WINDOWS\unin040c.exe -fC:\Games\Gruntz\DeIsL1.isu
                  IsoBuster 2.4-->"C:\Program Files\Smart Projects\IsoBuster\Uninst\unins000.exe"
                  MadOnion.com/3DMark2001 SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{91B323B5-A79C-4D23-BD6D-046C565F9BCF}\Setup.exe" -l0x9 uninstall -uninst
                  MAGIX Music Manager 2007 8.1.1.102 (F)-->C:\Program Files\MAGIX\Music_Manager_2007\instslct.exe
                  MAGIX Photo Manager 2007 4.2.0.85 (F)-->C:\Program Files\MAGIX\Photo_Manager_2007\instslct.exe
                  MAGIX Video deluxe 2008 PLUS 7.0.2.3 (F)-->C:\Program Files\MAGIX\Video_deluxe_2008_PLUS\instslct.exe
                  MAGIX Xtreme Photo Designer 6 6.0.20.0 (F)-->C:\Program Files\MAGIX\Xtreme_Foto_Designer_6\instslct.exe
                  Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
                  Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
                  Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
                  Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
                  Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
                  Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
                  Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
                  Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
                  Microsoft Device Emulator version 3.0 - FRA-->MsiExec.exe /X{A5774693-2D17-3E6C-9324-97B17C5AA1E9}
                  Microsoft Document Explorer 2008 Language Pack - FRA-->MsiExec.exe /X{AACA7728-BE87-3D11-8A3F-773664BFCF1B}
                  Microsoft Document Explorer 2008-->C:\Program Files\Fichiers communs\Microsoft Shared\Help 9\Microsoft Document Explorer 2008\install.exe
                  Microsoft Document Explorer 2008-->MsiExec.exe /X{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}
                  Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
                  Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
                  Microsoft Office Visual Web Developer 2007-->MsiExec.exe /X{90120000-0021-0000-0000-0000000FF1CE}
                  Microsoft Office Visual Web Developer MUI (French) 2007-->MsiExec.exe /X{90120000-0021-040C-0000-0000000FF1CE}
                  Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)-->MsiExec.exe /I{480DBB60-F0B6-45F2-B26F-1A2E11197791}
                  Microsoft SQL Server 2005 Tools Express Edition-->MsiExec.exe /I{3F59A7E0-BC01-4435-9E93-C7D7015C21DA}
                  Microsoft SQL Server 2005-->"c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
                  Microsoft SQL Server Compact 3.5 Design Tools FRA-->MsiExec.exe /X{043ECF7B-4724-4F7B-8A9D-BC22719E95F7}
                  Microsoft SQL Server Compact 3.5 for Devices FRA-->MsiExec.exe /I{B4C6D770-DF2E-4731-8869-F89BA6670DDA}
                  Microsoft SQL Server Compact 3.5 FRA-->MsiExec.exe /I{BE361597-42AC-4513-9BA6-FFAB310038FB}
                  Microsoft SQL Server Database Publishing Wizard 1.2-->MsiExec.exe /X{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}
                  Microsoft SQL Server Native Client-->MsiExec.exe /I{9C7E944F-4502-40B8-A0AB-66B2FA9EE829}
                  Microsoft SQL Server VSS Writer-->MsiExec.exe /I{75FF1600-6330-43FA-9022-E0835BF20778}
                  Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
                  Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack-->C:\Program Files\Fichiers communs\Microsoft Shared\VSTO\8.0\Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack\install.exe
                  Microsoft Visual Studio 2005 Tools for Office Runtime-->MsiExec.exe /X{388E4B09-3E71-4649-8921-F44A3A2954A7}
                  Microsoft Visual Studio 2008 Professional Edition - Français-->C:\Program Files\Microsoft Visual Studio 9.0\Microsoft Visual Studio 2008 Professional Edition - FRA\setup.exe
                  Microsoft Visual Studio 6.0 Édition Entreprise (Français)-->"C:\Program Files\Microsoft Visual Studio\Common\Setup\1036\Setup.exe"
                  Microsoft Visual Studio Web Authoring Component-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISUALWEBDEVELOPER /dll OSETUP.DLL
                  Microsoft VM for Java-->RunDll32 advpack.dll,LaunchINFSection java.inf,UnInstall
                  Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools-->MsiExec.exe /X{6E88CC59-832E-39AF-AE17-B9017DDB12C3}
                  Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries-->MsiExec.exe /X{842FAF7C-50EF-4463-9B8F-6222E1384D7D}
                  Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense-->MsiExec.exe /X{64c5b887-b5ee-42b8-8596-78905a6b5f1f}
                  Microsoft Windows SDK for Visual Studio 2008 Tools-->MsiExec.exe /X{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}
                  Microsoft Windows SDK for Visual Studio 2008 Win32 Tools-->MsiExec.exe /X{B268E9A1-04A9-40D0-9866-846BE2B74BA7}
                  Module linguistique Microsoft .NET Framework 3.5 - fra-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
                  Module linguistique Microsoft Document Explorer 2008 - FRA-->C:\Program Files\Fichiers communs\Microsoft Shared\Help 9\Microsoft Document Explorer 2008 Language Pack - FRA\install.exe
                  Module linguistique Visual Studio Tools pour Office System 3.0 Runtime - FRA-->C:\Program Files\Fichiers communs\Microsoft Shared\VSTO\9.0\Visual Studio Tools for the Office system 3.0 Runtime Language Pack - FRA\install.exe
                  MSDN Library for Visual Studio 2008 - FRA-->MsiExec.exe /X{24F3019E-D2AB-3DAA-A02E-470352304005}
                  MSDN Library pour Visual Studio 2008 - FRA-->C:\Program Files\MSDN\MSDN9.0\MSDN Library for Visual Studio 2008 - FRA\setup.exe
                  Multimedia Launcher-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
                  Nero 7 Demo-->MsiExec.exe /I{C985153C-3801-EB63-1432-088E71801036}
                  NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
                  PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
                  Sigmatek Disk Reader-->MsiExec.exe /I{64D1C23F-411C-4FBA-9B37-0ABC845C239B}
                  SiSoftware Sandra Standard 2004.SP1 (BenchmarkHQ Edition)-->"C:\Program Files\SiSoftware\SiSoftware Sandra Standard 2004.SP1 (Win32 x86)\unins000.exe"
                  SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe"
                  Sport cérébral Brain challenge-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DA9AC5A3-6625-4B3A-B9CB-51294566D0B4}\Setup.exe" -l0x40c -removeonly
                  Visual Studio 2005 Tools pour Office Second Edition Runtime-->c:\Program Files\Fichiers communs\Microsoft Shared\VSTO\8.0\Microsoft Visual Studio 2005 Tools for Office Runtime\install.exe
                  Visual Studio Tools for the Office system 3.0 Runtime-->C:\Program Files\Fichiers communs\Microsoft Shared\VSTO\9.0\Visual Studio Tools for the Office system 3.0 Runtime\install.exe
                  Visual Studio Tools for the Office system 3.0 Runtime-->MsiExec.exe /X{8FB53850-246A-3507-8ADE-0060093FFEA6}
                  Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
                  Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
                  Windows Mobile 5.0 SDK R2 for Pocket PC-->MsiExec.exe /I{94576E4F-703B-4038-806B-CDE9479A33AF}
                  Windows Mobile 5.0 SDK R2 for Smartphone-->MsiExec.exe /I{CCFA733C-2F56-4E8C-90B4-B38807400B7A}
                  Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
                  XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

                  ======System event log======

                  Computer Name: LESIX-498F5B332
                  Event Code: 7
                  Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

                  Record Number: 12285
                  Source Name: Cdrom
                  Time Written: 20090513192204.000000+120
                  Event Type: erreur
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 7
                  Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

                  Record Number: 12284
                  Source Name: Cdrom
                  Time Written: 20090513192203.000000+120
                  Event Type: erreur
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 7
                  Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

                  Record Number: 12283
                  Source Name: Cdrom
                  Time Written: 20090513192201.000000+120
                  Event Type: erreur
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 7
                  Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

                  Record Number: 12282
                  Source Name: Cdrom
                  Time Written: 20090513192200.000000+120
                  Event Type: erreur
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 7
                  Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

                  Record Number: 12281
                  Source Name: Cdrom
                  Time Written: 20090513192158.000000+120
                  Event Type: erreur
                  User:

                  =====Application event log=====

                  Computer Name: LESIX-498F5B332
                  Event Code: 26048
                  Message: Le fournisseur de connexions locales du serveur est prêt à accepter la connexion sur [ \\.\pipe\MSSQL$SQLEXPRESS\sql\query ].

                  Record Number: 8786
                  Source Name: MSSQL$SQLEXPRESS
                  Time Written: 20090427200631.000000+120
                  Event Type: Informations
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 26048
                  Message: Le fournisseur de connexions locales du serveur est prêt à accepter la connexion sur [ \\.\pipe\SQLLocal\SQLEXPRESS ].

                  Record Number: 8785
                  Source Name: MSSQL$SQLEXPRESS
                  Time Written: 20090427200631.000000+120
                  Event Type: Informations
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 26018
                  Message: Un certificat généré automatiquement a été chargé avec succès pour le chiffrement.

                  Record Number: 8784
                  Source Name: MSSQL$SQLEXPRESS
                  Time Written: 20090427200631.000000+120
                  Event Type: Informations
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 17136
                  Message: Effacement de la base de données tempdb.

                  Record Number: 8783
                  Source Name: MSSQL$SQLEXPRESS
                  Time Written: 20090427200631.000000+120
                  Event Type: Informations
                  User:

                  Computer Name: LESIX-498F5B332
                  Event Code: 17137
                  Message: Démarrage de la base de données 'msdb'.

                  Record Number: 8782
                  Source Name: MSSQL$SQLEXPRESS
                  Time Written: 20090427200631.000000+120
                  Event Type: Informations
                  User:

                  ======Environment variables======

                  "ComSpec"=%SystemRoot%\system32\cmd.exe
                  "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\FICHIE~1\AUTODE~1;C:\Program Files\Smart Projects\IsoBuster;c:\Program Files\Microsoft SQL Server\90\Tools\binn\
                  "windir"=%SystemRoot%
                  "FP_NO_HOST_CHECK"=NO
                  "OS"=Windows_NT
                  "PROCESSOR_ARCHITECTURE"=x86
                  "PROCESSOR_LEVEL"=15
                  "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
                  "PROCESSOR_REVISION"=0401
                  "NUMBER_OF_PROCESSORS"=2
                  "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
                  "TEMP"=%SystemRoot%\TEMP
                  "TMP"=%SystemRoot%\TEMP
                  "VS90COMNTOOLS"=C:\Program Files\Microsoft Visual Studio 9.0\Common7\Tools\

                  -----------------EOF-----------------

                  le 2eme Log

                  Logfile of random's system information tool 1.06 (written by random/random)
                  Run by Lesix at 2009-10-18 14:54:39
                  Microsoft Windows XP Professionnel Service Pack 2
                  System drive C: has 24 GB (38%) free of 64 GB
                  Total RAM: 2047 MB (83% free)

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 14:54:40, on 18/10/2009
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                  C:\WINDOWS\system32\nvsvc32.exe
                  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                  C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
                  C:\WINDOWS\system32\RUNDLL32.EXE
                  C:\WINDOWS\system32\rundll32.exe
                  C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
                  C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\Documents and Settings\Lesix\Bureau\RSIT.exe
                  C:\Program Files\Trend Micro\HijackThis\Lesix.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
                  O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
                  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
                  O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Video_deluxe_2008_PLUS\TrayServer.exe
                  O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
                  O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
                  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
                  O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  O23 - Service: UPnPService - Magix AG - C:\Program Files\Fichiers communs\MAGIX Shared\UPnPService\UPnPService.exe
              • 1
              • 2