Mon ordinateur est extremement lent

alex73730 -  
geoffrey5 Messages postés 14008 Statut Contributeur sécurité -
Bonjour,
voila sa faisait un bout de temps que mon ordnateur faisait un bruit d'avion , et on ma conseiller de le netoyer et d'enlever la poussiere du ventilot , c'est ce que j'ai fait , les trois premiers jours nickel , mais maintenant il est redevenue extremement long , impossible d'ouvrir une pages internet sans que cela bugue ou prenne minimum 10 minutes pour s'ouvrir ... et il recommence a faire du bruit mais seulement au demarage .. que faire aidez moi svp ...
Configuration: Windows XP Internet Explorer 7.0

13 réponses

Résumé de la discussion

Un ordinateur sous Windows XP, après nettoyage du ventilateur et dépoussiérage, devient extrêmement lent et les pages Internet mettent longtemps à s’afficher. Le rapport HijackThis détaillé montre de multiples processus actifs et diverses entrées de démarrage, ce qui suggère une infection potentielle ou un encombrement logiciel. D'autres éléments évoqués dans la discussion soulignent la nécessité d'un antivirus à jour, d'un nettoyage manuel des programmes au démarrage et d'une vérification de l'espace disque et de la RAM. En cas de persistance, la configuration Windows XP avec IE7 et environ 31 Go libres, ainsi que 767 Mo de RAM, est à considérer pour évaluer les causes et les solutions.

Bobot (l'IA à votre service)
  1. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Bonjour,

    ▶ Télécharge Random's System Information Tool (RSIT).

    ▶ Un tutoriel sera à ta disposition sur mon site web pour l'installer et l'utiliser correctement.

    ▶ Double clique sur RSIT.exe pour lancer l'outil.

    ▶ Clique sur 'Continue' à l'écran Disclaimer.

    ▶ Si l'outil Hijackthis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

    ▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.

    ( C:\RSIT\log.txt et C:\RSIT\info.txt )

    CTRL A pour sélectionner tout, CTRL C pour copier et puis CTRL V pour coller

    Comment héberger les rapports trop longs de RSIT ??
    0
    1. alex73730
       
      j'en ai que 1 :
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by christian laville at 2009-11-11 13:38:06
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 34 GB (46%) free of 74 GB
      Total RAM: 767 MB (27% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:38:15, on 11/11/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16915)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\WINDOWS\system32\SysMonitor.exe
      C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
      C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
      C:\Program Files\Acer\Acer eMode Management\AspireService.exe
      C:\Program Files\Acer\Acer eConsole\MediaSync.exe
      C:\Program Files\CyberLink\PowerCinema\PCMService.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\Orange\Systray\SystrayApp.exe
      C:\Program Files\Windows Live\Family Safety\fsui.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Search Settings\SearchSettings.exe
      C:\Program Files\Orange\Launcher\Launcher.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
      C:\Program Files\Microsoft ActiveSync\wcescomm.exe
      C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
      C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\MI3AA1~1\rapimgr.exe
      C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
      C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
      C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
      C:\Program Files\Windows Live\Family Safety\fsssvc.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\Program Files\Orange\Deskboard\deskboard.exe
      C:\Program Files\Orange\connectivity\connectivitymanager.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
      C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
      C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Windows Live\Toolbar\wltuser.exe
      C:\Documents and Settings\christian laville\Local Settings\Temporary Internet Files\Content.IE5\ODOTYDN0\RSIT[1].exe
      C:\Program Files\trend micro\christian laville.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
      R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\winlogon.exe,
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
      O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
      O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
      O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
      O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
      O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
      O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
      O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
      O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
      O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
      O4 - Global Startup: Acer Empowering Technology.lnk = ?
      O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\christian laville\Application Data\Dealio\kb127\res\DealioSearch.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
      O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O15 - Trusted Zone: https://www.orange.fr/portail
      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
      O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/zuma/oberongamesloader.cab
      O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
      O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
      O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
      O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
      O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
      O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      0
      1. alex73730 > alex73730
         
        comment faire pour avoir le deuxieme ?? tu en a besoin ??
        0
      2. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10 > alex73730
         
        Pas besoin tout de suite ;)
        0
  2. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Ok... Commence par faire ceci stp :

    Tu as des toolbars infectées installées sur ton PC => Search Setting et Dealio

    Lorsque tu télécharges des logiciels, il faut faire attention de ne pas installer les toolbars qu'ils te proposent lors de l'installation des logiciels... Il faut bien regarder et ne pas cliquer tout le temps sur Suivant sans lire ce qu'il est écrit...

    ▶ Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

    ▶ Lance l'installation du programme en exécutant le fichier téléchargé.

    Sous XP : Double-clique sur le raccourci de Toolbar-S&D.

    Sous Vista : Fais un clic droit sur ToolbarSD et sélectionne "Exécuter en tant qu'administrateur".

    ▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

    ▶ Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

    ▶ Poste le rapport généré. (C:\TB.txt)
    0
    1. alex73730
       
      le lien Toolbar-S&D (de Team IDN) ne marche pas :s
      0
      1. alex73730 > alex73730
         
        sa met sa : The bandwidth or page view limit for this site has been exceeded and the page cannot be viewed at this time. Once the site is below the limit, it will once again begin serving as normal.
        0
    2. alex73730
       
      -----------\\ ToolBar S&D 1.2.9 XP/Vista

      Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
      X86-based PC ( Multiprocessor Free : AMD Sempron(tm) Processor 3400+ )
      BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
      USER : christian laville ( Administrator )
      BOOT : Normal boot
      Antivirus : avast! antivirus 4.8.1335 [VPS 091111-0] 4.8.1335 (Activated)
      C:\ (Local Disk) - NTFS - Total:71 Go (Free:32 Go)
      D:\ (Local Disk) - FAT32 - Total:72 Go (Free:68 Go)
      E:\ (CD or DVD)
      F:\ (USB)
      G:\ (USB)
      H:\ (USB)
      I:\ (USB)

      "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
      Option : [1] ( 11/11/2009|17:12 )

      -----------\\ Recherche de Fichiers / Dossiers ...

      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\alerts.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\alerts_over.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\chevron-small.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\DealioSearch.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\deal_report.jpg
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\err_toolbar.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\global_scripts.js
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\highlight-bg.png
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\logo.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\logo_over.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\man_toolbar.css
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\man_toolbar.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\man_toolbar.js
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\scripts.js
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\scroller.js
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\search-chevron.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\separator.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\settings.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\settings_over.gif
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\res\yahoo-search.png
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\index.76.35
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\dealio-14556.log
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\dod_cache.xml
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_140_2088_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_140_3824_6.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_1516_4112_6.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2156_2856_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2308_2324_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2468_1396_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2500_3232_2.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2540_968_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2692_5728_6.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_2708_604_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_4036_2968_1.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_4036_2968_2.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_4908_5704_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_3216_5.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_3216_8.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_3740_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_4184_6.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_4184_9.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_4680_10.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_4680_11.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_5296_4.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5260_5296_7.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5324_4116_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5628_1156_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_5796_5520_3.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_6120_3024_6.html
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_6120_3924_3.html
      C:\Program Files\Dealio
      C:\Program Files\Dealio\DealioAU.exe
      C:\Program Files\Dealio\kb127
      C:\Program Files\Dealio\SearchSettingsKit.exe
      C:\Program Files\Dealio\kb127\Dealio Deskbar.exe
      C:\Program Files\Dealio\kb127\Dealio.dll
      C:\Program Files\Dealio\kb127\DealioRes409.dll
      C:\Program Files\Dealio\kb127\res
      C:\Program Files\Dealio\kb127\resDN
      C:\Program Files\Dealio\kb127\rules
      C:\Program Files\Dealio\kb127\temp
      C:\Program Files\Dealio\kb127\res\alerts.gif
      C:\Program Files\Dealio\kb127\res\alerts_over.gif
      C:\Program Files\Dealio\kb127\res\alerts_rec.gif
      C:\Program Files\Dealio\kb127\res\alerts_rec_over.gif
      C:\Program Files\Dealio\kb127\res\chevron-small.gif
      C:\Program Files\Dealio\kb127\res\DealioSearch.html
      C:\Program Files\Dealio\kb127\res\deals-leftcap.gif
      C:\Program Files\Dealio\kb127\res\deal_report.jpg
      C:\Program Files\Dealio\kb127\res\ebay_login.jpg
      C:\Program Files\Dealio\kb127\res\err_mainwindow.html
      C:\Program Files\Dealio\kb127\res\err_toolbar.html
      C:\Program Files\Dealio\kb127\res\global_scripts.js
      C:\Program Files\Dealio\kb127\res\headerbgthin.jpg
      C:\Program Files\Dealio\kb127\res\highlight-bg.png
      C:\Program Files\Dealio\kb127\res\logo.gif
      C:\Program Files\Dealio\kb127\res\logo_over.gif
      C:\Program Files\Dealio\kb127\res\man_toolbar.css
      C:\Program Files\Dealio\kb127\res\man_toolbar.html
      C:\Program Files\Dealio\kb127\res\man_toolbar.js
      C:\Program Files\Dealio\kb127\res\man_toolbarl.js
      C:\Program Files\Dealio\kb127\res\post-this-deal.gif
      C:\Program Files\Dealio\kb127\res\post-this-deal_over.gif
      C:\Program Files\Dealio\kb127\res\scripts.js
      C:\Program Files\Dealio\kb127\res\scroller.js
      C:\Program Files\Dealio\kb127\res\search-chevron.gif
      C:\Program Files\Dealio\kb127\res\search-chevron_over.gif
      C:\Program Files\Dealio\kb127\res\search_bg_blink.gif
      C:\Program Files\Dealio\kb127\res\separator.gif
      C:\Program Files\Dealio\kb127\res\settings.gif
      C:\Program Files\Dealio\kb127\res\settings_over.gif
      C:\Program Files\Dealio\kb127\res\yahoo-search.png
      C:\Program Files\Dealio\kb127\resDN\bottom.gif
      C:\Program Files\Dealio\kb127\resDN\chevron_down.gif
      C:\Program Files\Dealio\kb127\resDN\chevron_up.gif
      C:\Program Files\Dealio\kb127\resDN\close.gif
      C:\Program Files\Dealio\kb127\resDN\deskbar.css
      C:\Program Files\Dealio\kb127\resDN\deskbar.js
      C:\Program Files\Dealio\kb127\resDN\dispatch_helper.js
      C:\Program Files\Dealio\kb127\resDN\ebay_compatible.jpg
      C:\Program Files\Dealio\kb127\resDN\logo.gif
      C:\Program Files\Dealio\kb127\resDN\logo_chevron_bkg.gif
      C:\Program Files\Dealio\kb127\resDN\losing.gif
      C:\Program Files\Dealio\kb127\resDN\lost.gif
      C:\Program Files\Dealio\kb127\resDN\man_deskbar.html
      C:\Program Files\Dealio\kb127\resDN\menu_arrow.gif
      C:\Program Files\Dealio\kb127\resDN\menu_check.gif
      C:\Program Files\Dealio\kb127\resDN\no_image.gif
      C:\Program Files\Dealio\kb127\resDN\prod_img.gif
      C:\Program Files\Dealio\kb127\resDN\search_chevron.gif
      C:\Program Files\Dealio\kb127\resDN\spacer.gif
      C:\Program Files\Dealio\kb127\resDN\textfield_bkg.gif
      C:\Program Files\Dealio\kb127\resDN\top.gif
      C:\Program Files\Dealio\kb127\resDN\unknown.gif
      C:\Program Files\Dealio\kb127\resDN\winning.gif
      C:\Program Files\Dealio\kb127\resDN\won.gif
      C:\Program Files\Dealio\kb127\rules\index.76.35
      C:\Program Files\Dealio\kb127\rules\rules.1.10.76
      C:\Program Files\Dealio\kb127\rules\rules.1.109.43
      C:\Program Files\Dealio\kb127\rules\rules.1.110.43
      C:\Program Files\Dealio\kb127\rules\rules.1.12.52
      C:\Program Files\Dealio\kb127\rules\rules.1.13.58
      C:\Program Files\Dealio\kb127\rules\rules.1.130.58
      C:\Program Files\Dealio\kb127\rules\rules.1.135.50
      C:\Program Files\Dealio\kb127\rules\rules.1.153.44
      C:\Program Files\Dealio\kb127\rules\rules.1.155.43
      C:\Program Files\Dealio\kb127\rules\rules.1.156.49
      C:\Program Files\Dealio\kb127\rules\rules.1.16.60
      C:\Program Files\Dealio\kb127\rules\rules.1.161.52
      C:\Program Files\Dealio\kb127\rules\rules.1.178.66
      C:\Program Files\Dealio\kb127\rules\rules.1.184.55
      C:\Program Files\Dealio\kb127\rules\rules.1.188.52
      C:\Program Files\Dealio\kb127\rules\rules.1.189.45
      C:\Program Files\Dealio\kb127\rules\rules.1.196.43
      C:\Program Files\Dealio\kb127\rules\rules.1.198.56
      C:\Program Files\Dealio\kb127\rules\rules.1.199.43
      C:\Program Files\Dealio\kb127\rules\rules.1.200.53
      C:\Program Files\Dealio\kb127\rules\rules.1.201.43
      C:\Program Files\Dealio\kb127\rules\rules.1.202.43
      C:\Program Files\Dealio\kb127\rules\rules.1.203.71
      C:\Program Files\Dealio\kb127\rules\rules.1.205.62
      C:\Program Files\Dealio\kb127\rules\rules.1.213.71
      C:\Program Files\Dealio\kb127\rules\rules.1.214.49
      C:\Program Files\Dealio\kb127\rules\rules.1.215.43
      C:\Program Files\Dealio\kb127\rules\rules.1.216.67
      C:\Program Files\Dealio\kb127\rules\rules.1.217.67
      C:\Program Files\Dealio\kb127\rules\rules.1.218.52
      C:\Program Files\Dealio\kb127\rules\rules.1.219.43
      C:\Program Files\Dealio\kb127\rules\rules.1.220.43
      C:\Program Files\Dealio\kb127\rules\rules.1.221.57
      C:\Program Files\Dealio\kb127\rules\rules.1.222.43
      C:\Program Files\Dealio\kb127\rules\rules.1.223.68
      C:\Program Files\Dealio\kb127\rules\rules.1.226.68
      C:\Program Files\Dealio\kb127\rules\rules.1.227.43
      C:\Program Files\Dealio\kb127\rules\rules.1.228.62
      C:\Program Files\Dealio\kb127\rules\rules.1.229.76
      C:\Program Files\Dealio\kb127\rules\rules.1.23.63
      C:\Program Files\Dealio\kb127\rules\rules.1.239.43
      C:\Program Files\Dealio\kb127\rules\rules.1.24.43
      C:\Program Files\Dealio\kb127\rules\rules.1.240.43
      C:\Program Files\Dealio\kb127\rules\rules.1.241.43
      C:\Program Files\Dealio\kb127\rules\rules.1.242.43
      C:\Program Files\Dealio\kb127\rules\rules.1.243.43
      C:\Program Files\Dealio\kb127\rules\rules.1.244.63
      C:\Program Files\Dealio\kb127\rules\rules.1.245.43
      C:\Program Files\Dealio\kb127\rules\rules.1.247.43
      C:\Program Files\Dealio\kb127\rules\rules.1.248.43
      C:\Program Files\Dealio\kb127\rules\rules.1.249.43
      C:\Program Files\Dealio\kb127\rules\rules.1.250.43
      C:\Program Files\Dealio\kb127\rules\rules.1.251.43
      C:\Program Files\Dealio\kb127\rules\rules.1.252.43
      C:\Program Files\Dealio\kb127\rules\rules.1.253.43
      C:\Program Files\Dealio\kb127\rules\rules.1.254.43
      C:\Program Files\Dealio\kb127\rules\rules.1.255.43
      C:\Program Files\Dealio\kb127\rules\rules.1.256.43
      C:\Program Files\Dealio\kb127\rules\rules.1.257.43
      C:\Program Files\Dealio\kb127\rules\rules.1.279.43
      C:\Program Files\Dealio\kb127\rules\rules.1.28.58
      C:\Program Files\Dealio\kb127\rules\rules.1.282.75
      C:\Program Files\Dealio\kb127\rules\rules.1.283.43
      C:\Program Files\Dealio\kb127\rules\rules.1.284.43
      C:\Program Files\Dealio\kb127\rules\rules.1.289.67
      C:\Program Files\Dealio\kb127\rules\rules.1.290.62
      C:\Program Files\Dealio\kb127\rules\rules.1.291.61
      C:\Program Files\Dealio\kb127\rules\rules.1.296.43
      C:\Program Files\Dealio\kb127\rules\rules.1.297.43
      C:\Program Files\Dealio\kb127\rules\rules.1.304.43
      C:\Program Files\Dealio\kb127\rules\rules.1.307.43
      C:\Program Files\Dealio\kb127\rules\rules.1.308.75
      C:\Program Files\Dealio\kb127\rules\rules.1.31.47
      C:\Program Files\Dealio\kb127\rules\rules.1.310.46
      C:\Program Files\Dealio\kb127\rules\rules.1.311.43
      C:\Program Files\Dealio\kb127\rules\rules.1.315.43
      C:\Program Files\Dealio\kb127\rules\rules.1.316.43
      C:\Program Files\Dealio\kb127\rules\rules.1.317.43
      C:\Program Files\Dealio\kb127\rules\rules.1.318.43
      C:\Program Files\Dealio\kb127\rules\rules.1.319.49
      C:\Program Files\Dealio\kb127\rules\rules.1.32.48
      C:\Program Files\Dealio\kb127\rules\rules.1.334.44
      C:\Program Files\Dealio\kb127\rules\rules.1.335.60
      C:\Program Files\Dealio\kb127\rules\rules.1.336.44
      C:\Program Files\Dealio\kb127\rules\rules.1.337.44
      C:\Program Files\Dealio\kb127\rules\rules.1.338.75
      C:\Program Files\Dealio\kb127\rules\rules.1.339.47
      C:\Program Files\Dealio\kb127\rules\rules.1.34.43
      C:\Program Files\Dealio\kb127\rules\rules.1.340.47
      C:\Program Files\Dealio\kb127\rules\rules.1.341.47
      C:\Program Files\Dealio\kb127\rules\rules.1.349.50
      C:\Program Files\Dealio\kb127\rules\rules.1.35.48
      C:\Program Files\Dealio\kb127\rules\rules.1.350.50
      C:\Program Files\Dealio\kb127\rules\rules.1.351.51
      C:\Program Files\Dealio\kb127\rules\rules.1.352.54
      C:\Program Files\Dealio\kb127\rules\rules.1.353.51
      C:\Program Files\Dealio\kb127\rules\rules.1.354.51
      C:\Program Files\Dealio\kb127\rules\rules.1.357.62
      C:\Program Files\Dealio\kb127\rules\rules.1.358.52
      C:\Program Files\Dealio\kb127\rules\rules.1.359.52
      C:\Program Files\Dealio\kb127\rules\rules.1.360.53
      C:\Program Files\Dealio\kb127\rules\rules.1.361.54
      C:\Program Files\Dealio\kb127\rules\rules.1.362.68
      C:\Program Files\Dealio\kb127\rules\rules.1.363.58
      C:\Program Files\Dealio\kb127\rules\rules.1.364.54
      C:\Program Files\Dealio\kb127\rules\rules.1.365.53
      C:\Program Files\Dealio\kb127\rules\rules.1.367.56
      C:\Program Files\Dealio\kb127\rules\rules.1.368.58
      C:\Program Files\Dealio\kb127\rules\rules.1.369.55
      C:\Program Files\Dealio\kb127\rules\rules.1.370.56
      C:\Program Files\Dealio\kb127\rules\rules.1.371.56
      C:\Program Files\Dealio\kb127\rules\rules.1.372.57
      C:\Program Files\Dealio\kb127\rules\rules.1.373.55
      C:\Program Files\Dealio\kb127\rules\rules.1.375.56
      C:\Program Files\Dealio\kb127\rules\rules.1.376.57
      C:\Program Files\Dealio\kb127\rules\rules.1.377.55
      C:\Program Files\Dealio\kb127\rules\rules.1.378.65
      C:\Program Files\Dealio\kb127\rules\rules.1.384.58
      C:\Program Files\Dealio\kb127\rules\rules.1.386.71
      C:\Program Files\Dealio\kb127\rules\rules.1.387.59
      C:\Program Files\Dealio\kb127\rules\rules.1.388.59
      C:\Program Files\Dealio\kb127\rules\rules.1.389.59
      C:\Program Files\Dealio\kb127\rules\rules.1.390.60
      C:\Program Files\Dealio\kb127\rules\rules.1.391.60
      C:\Program Files\Dealio\kb127\rules\rules.1.392.60
      C:\Program Files\Dealio\kb127\rules\rules.1.393.60
      C:\Program Files\Dealio\kb127\rules\rules.1.394.60
      C:\Program Files\Dealio\kb127\rules\rules.1.396.61
      C:\Program Files\Dealio\kb127\rules\rules.1.397.61
      C:\Program Files\Dealio\kb127\rules\rules.1.398.60
      C:\Program Files\Dealio\kb127\rules\rules.1.399.60
      C:\Program Files\Dealio\kb127\rules\rules.1.403.61
      C:\Program Files\Dealio\kb127\rules\rules.1.404.63
      C:\Program Files\Dealio\kb127\rules\rules.1.405.61
      C:\Program Files\Dealio\kb127\rules\rules.1.406.61
      C:\Program Files\Dealio\kb127\rules\rules.1.407.76
      C:\Program Files\Dealio\kb127\rules\rules.1.408.63
      C:\Program Files\Dealio\kb127\rules\rules.1.409.61
      C:\Program Files\Dealio\kb127\rules\rules.1.412.62
      C:\Program Files\Dealio\kb127\rules\rules.1.413.62
      C:\Program Files\Dealio\kb127\rules\rules.1.414.62
      C:\Program Files\Dealio\kb127\rules\rules.1.415.62
      C:\Program Files\Dealio\kb127\rules\rules.1.416.62
      C:\Program Files\Dealio\kb127\rules\rules.1.417.62
      C:\Program Files\Dealio\kb127\rules\rules.1.418.62
      C:\Program Files\Dealio\kb127\rules\rules.1.419.62
      C:\Program Files\Dealio\kb127\rules\rules.1.420.62
      C:\Program Files\Dealio\kb127\rules\rules.1.421.62
      C:\Program Files\Dealio\kb127\rules\rules.1.423.63
      C:\Program Files\Dealio\kb127\rules\rules.1.424.63
      C:\Program Files\Dealio\kb127\rules\rules.1.425.63
      C:\Program Files\Dealio\kb127\rules\rules.1.426.63
      C:\Program Files\Dealio\kb127\rules\rules.1.427.63
      C:\Program Files\Dealio\kb127\rules\rules.1.428.65
      C:\Program Files\Dealio\kb127\rules\rules.1.429.63
      C:\Program Files\Dealio\kb127\rules\rules.1.430.63
      C:\Program Files\Dealio\kb127\rules\rules.1.432.65
      C:\Program Files\Dealio\kb127\rules\rules.1.433.64
      C:\Program Files\Dealio\kb127\rules\rules.1.434.65
      C:\Program Files\Dealio\kb127\rules\rules.1.435.64
      C:\Program Files\Dealio\kb127\rules\rules.1.436.76
      C:\Program Files\Dealio\kb127\rules\rules.1.437.64
      C:\Program Files\Dealio\kb127\rules\rules.1.438.71
      C:\Program Files\Dealio\kb127\rules\rules.1.439.71
      C:\Program Files\Dealio\kb127\rules\rules.1.440.75
      C:\Program Files\Dealio\kb127\rules\rules.1.442.73
      C:\Program Files\Dealio\kb127\rules\rules.1.443.73
      C:\Program Files\Dealio\kb127\rules\rules.1.444.73
      C:\Program Files\Dealio\kb127\rules\rules.1.445.68
      C:\Program Files\Dealio\kb127\rules\rules.1.446.69
      C:\Program Files\Dealio\kb127\rules\rules.1.450.67
      C:\Program Files\Dealio\kb127\rules\rules.1.451.67
      C:\Program Files\Dealio\kb127\rules\rules.1.452.68
      C:\Program Files\Dealio\kb127\rules\rules.1.453.68
      C:\Program Files\Dealio\kb127\rules\rules.1.454.69
      C:\Program Files\Dealio\kb127\rules\rules.1.456.69
      C:\Program Files\Dealio\kb127\rules\rules.1.457.75
      C:\Program Files\Dealio\kb127\rules\rules.1.458.70
      C:\Program Files\Dealio\kb127\rules\rules.1.459.70
      C:\Program Files\Dealio\kb127\rules\rules.1.460.69
      C:\Program Files\Dealio\kb127\rules\rules.1.462.74
      C:\Program Files\Dealio\kb127\rules\rules.1.463.69
      C:\Program Files\Dealio\kb127\rules\rules.1.464.70
      C:\Program Files\Dealio\kb127\rules\rules.1.465.68
      C:\Program Files\Dealio\kb127\rules\rules.1.468.70
      C:\Program Files\Dealio\kb127\rules\rules.1.469.70
      C:\Program Files\Dealio\kb127\rules\rules.1.470.70
      C:\Program Files\Dealio\kb127\rules\rules.1.471.73
      C:\Program Files\Dealio\kb127\rules\rules.1.472.70
      C:\Program Files\Dealio\kb127\rules\rules.1.478.74
      C:\Program Files\Dealio\kb127\rules\rules.1.479.73
      C:\Program Files\Dealio\kb127\rules\rules.1.480.68
      C:\Program Files\Dealio\kb127\rules\rules.1.481.71
      C:\Program Files\Dealio\kb127\rules\rules.1.482.74
      C:\Program Files\Dealio\kb127\rules\rules.1.49.67
      C:\Program Files\Dealio\kb127\rules\rules.1.50.43
      C:\Program Files\Dealio\kb127\rules\rules.1.500.71
      C:\Program Files\Dealio\kb127\rules\rules.1.501.74
      C:\Program Files\Dealio\kb127\rules\rules.1.502.71
      C:\Program Files\Dealio\kb127\rules\rules.1.51.69
      C:\Program Files\Dealio\kb127\rules\rules.1.52.72
      C:\Program Files\Dealio\kb127\rules\rules.1.520.76
      C:\Program Files\Dealio\kb127\rules\rules.1.521.76
      C:\Program Files\Dealio\kb127\rules\rules.1.522.76
      C:\Program Files\Dealio\kb127\rules\rules.1.53.51
      C:\Program Files\Dealio\kb127\rules\rules.1.531.76
      C:\Program Files\Dealio\kb127\rules\rules.1.532.75
      C:\Program Files\Dealio\kb127\rules\rules.1.534.75
      C:\Program Files\Dealio\kb127\rules\rules.1.54.47
      C:\Program Files\Dealio\kb127\rules\rules.1.55.45
      C:\Program Files\Dealio\kb127\rules\rules.1.56.69
      C:\Program Files\Dealio\kb127\rules\rules.1.57.43
      C:\Program Files\Dealio\kb127\rules\rules.1.58.47
      C:\Program Files\Dealio\kb127\rules\rules.1.593.76
      C:\Program Files\Dealio\kb127\rules\rules.1.595.76
      C:\Program Files\Dealio\kb127\rules\rules.1.63.57
      C:\Program Files\Dealio\kb127\rules\rules.1.66.47
      C:\Program Files\Dealio\kb127\rules\rules.1.70.75
      C:\Program Files\Dealio\kb127\rules\rules.1.71.43
      C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127\res
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127\temp
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127\temp\ws-14556.log
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127\temp\ws-14557.log
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127\temp\ws-14558.log
      C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127\temp\ws-14559.log
      C:\Program Files\Search Settings
      C:\Program Files\Search Settings\kb127
      C:\Program Files\Search Settings\SearchSettings.exe
      C:\Program Files\Search Settings\kb127\res
      C:\Program Files\Search Settings\kb127\SearchSettings.dll
      C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
      C:\Program Files\Search Settings\kb127\temp

      -----------\\ [..\Internet Explorer\Main]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
      "Search Page"="https://www.google.com/?gws_rd=ssl"
      "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
      "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
      "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
      "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
      "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
      "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


      --------------------\\ Recherche d'autres infections

      --------------------\\ Cracks & Keygens ..

      C:\DOCUME~1\CHRIST~1\Mes documents\Shareaza Downloads\Kate Voegele - Where the Sidewalk Cracks.mp3



      1 - "C:\ToolBar SD\TB_1.txt" - 11/11/2009|17:13 - Option : [1]

      -----------\\ Fin du rapport a 17:13:58,34
      0
  3. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Ok maintenant :

    ▶ Relance Toolbar-S&D.

    ▶ Tape sur "2" puis valide en appuyant sur "Entrée".

    /!\ Ne ferme pas la fenêtre lors de la suppression /!\

    ▶ Un rapport sera généré, poste son contenu ici.

    NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
    Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
    Tape explorer puis valide.

    Ce qu'il faut savoir sur les toolbars (barres d'outils)
    0
    1. alex73730
       
      tooblar machin truk , re bugue comme tous a l'heure , je fais comment ??
      0
  4. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Tu avais un message d'erreur quand tu voulais le télécharger tout à l'heure... Qu'est-ce que ça fait quand tu veux le lancer ??
    0
    1. alex73730
       
      c'est bon sa marche :
      Clean Navipromo version 3.7.7 commencé le 11/11/2009 à 19:05:03,50

      Outil exécuté depuis C:\Program Files\navilog1

      Mise à jour le 12.05.2009 à 18h00 par IL-MAFIOSO

      Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
      X86-based PC ( Multiprocessor Free : AMD Sempron(tm) Processor 3400+ )
      BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
      USER : christian laville ( Administrator )
      BOOT : Normal boot

      Antivirus : avast! antivirus 4.8.1335 [VPS 091111-0] 4.8.1335 (Activated)


      C:\ (Local Disk) - NTFS - Total:71 Go (Free:31 Go)
      D:\ (Local Disk) - FAT32 - Total:72 Go (Free:68 Go)
      E:\ (CD or DVD)
      F:\ (USB)
      G:\ (USB)
      H:\ (USB)
      I:\ (USB)


      Mode suppression automatique
      avec prise en charge résultats Catchme et GNS


      Nettoyage exécuté au redémarrage de l'ordinateur


      *** fsbl1.txt non trouvé ***
      (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


      *** Suppression avec sauvegardes résultats GenericNaviSearch ***

      * Suppression dans "C:\WINDOWS\System32" *


      * Suppression dans "C:\Documents and Settings\christian laville\locals~1\applic~1" *



      *** Suppression dossiers dans "C:\WINDOWS" ***


      *** Suppression dossiers dans "C:\Program Files" ***


      *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


      *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


      *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


      *** Suppression dossiers dans "C:\Documents and Settings\christian laville\applic~1" ***


      *** Suppression dossiers dans "C:\Documents and Settings\christian laville\locals~1\applic~1" ***


      *** Suppression dossiers dans "C:\Documents and Settings\christian laville\menudm~1\progra~1" ***



      *** Suppression fichiers ***


      *** Suppression fichiers temporaires ***

      Nettoyage contenu C:\WINDOWS\Temp effectué !
      Nettoyage contenu C:\Documents and Settings\christian laville\locals~1\Temp effectué !

      *** Traitement Recherche complémentaire ***
      (Recherche fichiers spécifiques)

      1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

      2)Recherche, création sauvegardes et suppression Heuristique :


      * Dans "C:\WINDOWS\system32" *


      * Dans "C:\Documents and Settings\christian laville\locals~1\applic~1" *


      *** Sauvegarde du Registre vers dossier Safebackup ***

      sauvegarde du Registre réalisée avec succès !

      *** Nettoyage Registre ***

      Nettoyage Registre Ok


      *** Certificats ***

      Certificat Egroup absent !
      Certificat Electronic-Group absent !
      Certificat Montorgueil absent !
      Certificat OOO-Favorit absent !
      Certificat Sunny-Day-Design-Ltdt absent !

      *** Recherche autres dossiers et fichiers connus ***



      *** Nettoyage terminé le 11/11/2009 à 19:11:39,00 ***
      0
      1. alex73730 > alex73730
         
        je suis desoler je me suis tromper de rapport , tien celui la c'est le bon desollerr :

        -----------\\ ToolBar S&D 1.2.9 XP/Vista

        Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
        X86-based PC ( Multiprocessor Free : AMD Sempron(tm) Processor 3400+ )
        BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
        USER : christian laville ( Administrator )
        BOOT : Normal boot
        Antivirus : avast! antivirus 4.8.1335 [VPS 091111-0] 4.8.1335 (Activated)
        C:\ (Local Disk) - NTFS - Total:71 Go (Free:32 Go)
        D:\ (Local Disk) - FAT32 - Total:72 Go (Free:68 Go)
        E:\ (CD or DVD)
        F:\ (USB)
        G:\ (USB)
        H:\ (USB)
        I:\ (USB)

        "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
        Option : [2] ( 11/11/2009|19:20 )

        -----------\\ SUPPRESSION

        Supprime! - C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio\kb127
        Supprime! - C:\Program Files\Dealio\DealioAU.exe
        Supprime! - C:\Program Files\Dealio\kb127
        Supprime! - C:\Program Files\Dealio\SearchSettingsKit.exe
        Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio
        Supprime! - C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings\kb127
        Supprime! - C:\Program Files\Search Settings\kb127
        Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
        Supprime! - C:\DOCUME~1\CHRIST~1\APPLIC~1\Dealio
        Supprime! - C:\Program Files\Dealio
        Supprime! - C:\DOCUME~1\CHRIST~1\APPLIC~1\Search Settings
        Supprime! - C:\Program Files\Search Settings

        -----------\\ Recherche de Fichiers / Dossiers ...


        -----------\\ [..\Internet Explorer\Main]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
        "Start Page"="http://search.conduit.com?SearchSource=10&ctid=CT2095689"
        "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
        "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
        "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
        "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
        "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Start Page"="https://www.msn.com/fr-fr/"


        --------------------\\ Recherche d'autres infections

        --------------------\\ Cracks & Keygens ..

        C:\DOCUME~1\CHRIST~1\Mes documents\Shareaza Downloads\Kate Voegele - Where the Sidewalk Cracks.mp3



        1 - "C:\ToolBar SD\TB_1.txt" - 11/11/2009|17:13 - Option : [1]
        2 - "C:\ToolBar SD\TB_2.txt" - 11/11/2009|19:22 - Option : [2]

        -----------\\ Fin du rapport a 19:22:58,40
        0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Bonjour,

    tu te fais aider ailleurs ??
    0
    1. alex73730
       
      non c'est un ancien logiciel que javais du utiliser jai cru que cetai tooblar mais ce n'est pas sa et apré tooblar a marché
      0
  7. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    ▶ Télécharge malwarebyte's anti-malware

    ▶ Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.

    ▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)

    ▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"

    ▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

    ▶ L'analyse peut durer un bon moment.....

    ▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

    ▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

    ▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

    * Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC...
    Faites le en cliquant sur "oui" à la question posée
    0
    1. alex73730
       
      mon ordinateur a redemarer a la fin de la suppression , et je n'est pas eu le temps de te lenvoyer comment faire pour le retrouvé ?
      0
      1. alex73730 > alex73730
         
        jen ai 3 :

        le 1er :
        Malwarebytes' Anti-Malware 1.38
        Version de la base de données: 2307
        Windows 5.1.2600 Service Pack 3

        19/06/2009 11:21:48
        mbam-log-2009-06-19 (11-21-48).txt

        Type de recherche: Examen complet (C:\|D:\|)
        Eléments examinés: 170447
        Temps écoulé: 40 minute(s), 54 second(s)

        Processus mémoire infecté(s): 1
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 2
        Valeur(s) du Registre infectée(s): 3
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 4

        Processus mémoire infecté(s):
        C:\documents and settings\christian laville\local settings\application data\omemqai.exe (Adware.Navipromo.H) -> Unloaded process successfully.

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

        Valeur(s) du Registre infectée(s):
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\omemqai (Adware.Navipromo.H) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kckwq (Trojan.Agent.H) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ameym (Trojan.Agent.H) -> Quarantined and deleted successfully.

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        c:\documents and settings\christian laville\local settings\application data\omemqai_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
        c:\documents and settings\christian laville\local settings\application data\omemqai_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
        c:\documents and settings\christian laville\local settings\application data\omemqai.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
        c:\documents and settings\christian laville\local settings\application data\omemqai.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.

        le 2em:

        Malwarebytes' Anti-Malware 1.38
        Version de la base de données: 2307
        Windows 5.1.2600 Service Pack 3

        11/11/2009 19:08:55
        mbam-log-2009-11-11 (19-08-55).txt

        Type de recherche: Examen rapide
        Eléments examinés: 29359
        Temps écoulé: 7 minute(s), 17 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 0
        Valeur(s) du Registre infectée(s): 0
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 0

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Valeur(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        (Aucun élément nuisible détecté)

        et le 3em :
        alwarebytes' Anti-Malware 1.41
        Version de la base de données: 3155
        Windows 5.1.2600 Service Pack 3

        12/11/2009 18:14:34
        mbam-log-2009-11-12 (18-14-34).txt

        Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
        Eléments examinés: 190964
        Temps écoulé: 49 minute(s), 6 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 0
        Valeur(s) du Registre infectée(s): 0
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 1

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Valeur(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        C:\Program Files\Navilog1\gnc.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
        0
  8. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Option 1 - Recherche en mode normal :

    ▶ télécharge smitfraudfix et enregistre le sur le bureau

    Sous XP : Double clique sur smitfraudfix puis exécuter

    sous vista : Clic-droit sur SmitfraudFix présent sur le bureau et choisis "Exécuter en tant qu'administrateur"

    ▶ Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

    (attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

    ▶ copier/coller le rapport dans la réponse.

    Voici un tutoriel sonore et animé en cas de problème d'utilisation

    (Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool".
    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
    Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)
    0
    1. alex73730
       
      SmitFraudFix v2.424

      Rapport fait à 20:29:37,09, 12/11/2009
      Executé à partir de C:\Documents and Settings\christian laville\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode normal

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\WINDOWS\system32\SysMonitor.exe
      C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
      C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
      C:\Program Files\Acer\Acer eMode Management\AspireService.exe
      C:\Program Files\Acer\Acer eConsole\MediaSync.exe
      C:\Program Files\CyberLink\PowerCinema\PCMService.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\Orange\Systray\SystrayApp.exe
      C:\Program Files\Windows Live\Family Safety\fsui.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Orange\Launcher\Launcher.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\Microsoft ActiveSync\wcescomm.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
      C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
      C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\LimeWire\LimeWire.exe
      C:\PROGRA~1\MI3AA1~1\rapimgr.exe
      C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
      C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
      C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
      C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
      C:\Program Files\Windows Live\Family Safety\fsssvc.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
      C:\Program Files\Orange\Deskboard\deskboard.exe
      C:\Program Files\Orange\connectivity\connectivitymanager.exe
      C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
      C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Windows Live\Toolbar\wltuser.exe
      C:\Documents and Settings\christian laville\Bureau\SmitfraudFix\Policies.exe
      C:\WINDOWS\system32\cmd.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts


      »»»»»»»»»»»»»»»»»»»»»»»» C:\


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\christian laville


      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\christian laville\Application Data


      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\Favoris


      »»»»»»»»»»»»»»»»»»»»»»»» Bureau


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Ma page d'accueil"


      »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      o4Patch
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri



      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      IEDFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri



      »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      Agent.OMZ.Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      VACFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      404Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll


      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""


      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\DOCUME~1\\CHRIST~1\\LOCALS~1\\Temp\\winlogon.exe,"

      »»»»»»»»»»»»»»»»»»»»»»»» RK

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "System"=""




      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: Generic Marvell Yukon Chipset based Ethernet Controller - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 192.168.1.1

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


      »»»»»»»»»»»»»»»»»»»»»»»» Fin
      0
  9. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Option 2 - Nettoyage en mode sans échec :

    Prends bien notes de ce qu'il faut faire car tu n'auras pas accès à internet en mode sans échec !!

    redémarre le PC en mode sans échec

    ▶ Relance smitfraudfix

    ▶ Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

    ▶ A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

    Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

    ▶ Enregistre le rapport sur ton bureau

    ▶ Redémarrer en mode normal et poster le rapport.

    ensuite refais un nouveau rapport RSIT stp
    0
    1. alex73
       
      desoler je vien de rentré de weekend alor voici le rappor en mode sans echec :
      SmitFraudFix v2.424

      Rapport fait à 18:48:11,17, 17/11/2009
      Executé à partir de C:\Documents and Settings\christian laville\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode sans echec

      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


      »»»»»»»»»»»»»»»»»»»»»»»» hosts


      127.0.0.1 localhost
      127.0.0.1 007guard.com
      127.0.0.1 www.007guard.com
      127.0.0.1 008i.com
      127.0.0.1 008k.com
      127.0.0.1 www.008k.com
      127.0.0.1 00hq.com
      127.0.0.1 www.00hq.com
      127.0.0.1 010402.com
      127.0.0.1 032439.com
      ...

      »»»»»»»»»»»»»»»»»»»»»»»» VACFix

      VACFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

      S!Ri's WS2Fix: LSP not Found.
      »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

      GenericRenosFix by S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

      IEDFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri



      »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

      Agent.OMZ.Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

      404Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» RK


      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


      »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      "System"=""


      »»»»»»»»»»»»»»»»»»»»»»»» RK.2



      »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

      Nettoyage terminé.

      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll


      »»»»»»»»»»»»»»»»»»»»»»»» Fin

      et celui d'aprés RIST :
      Malwarebytes' Anti-Malware 1.41
      Version de la base de données: 3155
      Windows 5.1.2600 Service Pack 3

      17/11/2009 20:35:30
      mbam-log-2009-11-17 (20-35-30).txt

      Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
      Eléments examinés: 190990
      Temps écoulé: 1 hour(s), 37 minute(s), 8 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 0
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 1

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\System Volume Information\_restore{27929864-1714-4615-A18A-05D85FEEEFEA}\RP714\A0222107.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
      0
    2. alex73730
       
      desoler je vien de rentré de weekend alor voici le rappor en mode sans echec :
      SmitFraudFix v2.424

      Rapport fait à 18:48:11,17, 17/11/2009
      Executé à partir de C:\Documents and Settings\christian laville\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode sans echec

      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


      »»»»»»»»»»»»»»»»»»»»»»»» hosts


      127.0.0.1 localhost
      127.0.0.1 007guard.com
      127.0.0.1 www.007guard.com
      127.0.0.1 008i.com
      127.0.0.1 008k.com
      127.0.0.1 www.008k.com
      127.0.0.1 00hq.com
      127.0.0.1 www.00hq.com
      127.0.0.1 010402.com
      127.0.0.1 032439.com
      ...

      »»»»»»»»»»»»»»»»»»»»»»»» VACFix

      VACFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

      S!Ri's WS2Fix: LSP not Found.
      »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

      GenericRenosFix by S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

      IEDFix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri



      »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

      Agent.OMZ.Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

      404Fix
      Credits: Malware Analysis & Diagnostic
      Code: S!Ri


      »»»»»»»»»»»»»»»»»»»»»»»» RK


      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{962A8036-E3B8-4506-8CFD-BA7D21E87A1E}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


      »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      "System"=""


      »»»»»»»»»»»»»»»»»»»»»»»» RK.2



      »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

      Nettoyage terminé.

      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll


      »»»»»»»»»»»»»»»»»»»»»»»» Fin

      et celui d'aprés RIST :
      Malwarebytes' Anti-Malware 1.41
      Version de la base de données: 3155
      Windows 5.1.2600 Service Pack 3

      17/11/2009 20:35:30
      mbam-log-2009-11-17 (20-35-30).txt

      Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
      Eléments examinés: 190990
      Temps écoulé: 1 hour(s), 37 minute(s), 8 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 0
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 1

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\System Volume Information\_restore{27929864-1714-4615-A18A-05D85FEEEFEA}\RP714\A0222107.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
      0
  10. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Bonsoir,

    refais un nouveau rapport RSIT stp
    0
    1. alex73730
       
      comment je le refais ?? avec qu'elle logiciel ??
      0
      1. alex73730 > alex73730
         
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 13:58:18, on 18/11/2009
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16915)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
        C:\WINDOWS\system32\SysMonitor.exe
        C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
        C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
        C:\Program Files\Acer\Acer eMode Management\AspireService.exe
        C:\Program Files\Acer\Acer eConsole\MediaSync.exe
        C:\Program Files\CyberLink\PowerCinema\PCMService.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\Orange\Systray\SystrayApp.exe
        C:\Program Files\Windows Live\Family Safety\fsui.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\Program Files\Microsoft ActiveSync\wcescomm.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
        C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        C:\Program Files\Orange\Launcher\Launcher.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\Program Files\LimeWire\LimeWire.exe
        C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
        C:\PROGRA~1\MI3AA1~1\rapimgr.exe
        C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
        C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
        C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
        C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
        C:\Program Files\Windows Live\Family Safety\fsssvc.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        C:\Program Files\Java\jre6\bin\jqs.exe
        c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        C:\Program Files\Orange\Deskboard\deskboard.exe
        C:\Program Files\Orange\connectivity\connectivitymanager.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
        C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
        C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Program Files\Windows Live\Toolbar\wltuser.exe
        C:\Program Files\Windows Live\Contacts\wlcomm.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\winlogon.exe,
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
        O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
        O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
        O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
        O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
        O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
        O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
        O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
        O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
        O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
        O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
        O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
        O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
        O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
        O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
        O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
        O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
        O4 - Global Startup: Acer Empowering Technology.lnk = ?
        O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
        O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O15 - Trusted Zone: https://www.orange.fr/portail
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
        O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/zuma/oberongamesloader.cab
        O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
        O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        0
  11. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Bonjour,

    refais un nouveau rapport RSIT stp

    C'était pourtant bien précisé :)
    0
    1. alex73730
       
      je sais qu'il faut en refaire un , mais je ne sais pas comment en faire un
      alor stp pourrait tu me dire comment faire .....................
      0
  12. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Il te suffit de double-cliquer sur le raccourci RSIT situé sur ton bureau et de cliquer sur Continue

    Tu patiente un peu jusqu'à ce que le rapport apparaisse puis tu fais un copié/collé du rapport dans ta prochaine réponse ;)

    https://www.androidworld.fr/
    0
    1. alex73730
       
      je n'ai pas se dossier dans mon bureau ...
      0
    2. alex73730
       
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by christian laville at 2009-11-18 17:50:49
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 31 GB (42%) free of 74 GB
      Total RAM: 767 MB (31% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 17:50:57, on 18/11/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16915)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\WINDOWS\system32\SysMonitor.exe
      C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
      C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
      C:\Program Files\Acer\Acer eMode Management\AspireService.exe
      C:\Program Files\Acer\Acer eConsole\MediaSync.exe
      C:\Program Files\CyberLink\PowerCinema\PCMService.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\Orange\Systray\SystrayApp.exe
      C:\Program Files\Windows Live\Family Safety\fsui.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\Microsoft ActiveSync\wcescomm.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
      C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
      C:\Program Files\Orange\Launcher\Launcher.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\LimeWire\LimeWire.exe
      C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
      C:\PROGRA~1\MI3AA1~1\rapimgr.exe
      C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
      C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
      C:\Program Files\Windows Live\Family Safety\fsssvc.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\Orange\Deskboard\deskboard.exe
      C:\Program Files\Orange\connectivity\connectivitymanager.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
      C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
      C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Windows Live\Toolbar\wltuser.exe
      C:\Documents and Settings\christian laville\Local Settings\Temporary Internet Files\Content.IE5\X2OQL86L\RSIT[1].exe
      C:\Program Files\trend micro\christian laville.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\winlogon.exe,
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
      O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
      O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
      O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
      O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
      O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
      O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
      O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
      O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
      O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
      O4 - Global Startup: Acer Empowering Technology.lnk = ?
      O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O15 - Trusted Zone: https://www.orange.fr/portail
      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
      O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/zuma/oberongamesloader.cab
      O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
      O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
      O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
      O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
      O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
      O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      0
      1. alex73730 > alex73730
         
        Logfile of random's system information tool 1.06 (written by random/random)
        Run by christian laville at 2009-11-18 17:50:49
        Microsoft Windows XP Édition familiale Service Pack 3
        System drive C: has 31 GB (42%) free of 74 GB
        Total RAM: 767 MB (31% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 17:50:57, on 18/11/2009
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16915)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
        C:\WINDOWS\system32\SysMonitor.exe
        C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
        C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
        C:\Program Files\Acer\Acer eMode Management\AspireService.exe
        C:\Program Files\Acer\Acer eConsole\MediaSync.exe
        C:\Program Files\CyberLink\PowerCinema\PCMService.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\Orange\Systray\SystrayApp.exe
        C:\Program Files\Windows Live\Family Safety\fsui.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\Program Files\Microsoft ActiveSync\wcescomm.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
        C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        C:\Program Files\Orange\Launcher\Launcher.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\Program Files\LimeWire\LimeWire.exe
        C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
        C:\PROGRA~1\MI3AA1~1\rapimgr.exe
        C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
        C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
        C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
        C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
        C:\Program Files\Windows Live\Family Safety\fsssvc.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        C:\Program Files\Java\jre6\bin\jqs.exe
        c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        C:\Program Files\Orange\Deskboard\deskboard.exe
        C:\Program Files\Orange\connectivity\connectivitymanager.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
        C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
        C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Program Files\Windows Live\Contacts\wlcomm.exe
        C:\WINDOWS\system32\HPZipm12.exe
        C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Windows Live\Toolbar\wltuser.exe
        C:\Documents and Settings\christian laville\Local Settings\Temporary Internet Files\Content.IE5\X2OQL86L\RSIT[1].exe
        C:\Program Files\trend micro\christian laville.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\winlogon.exe,
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
        O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
        O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
        O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
        O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
        O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
        O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
        O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
        O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
        O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
        O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
        O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
        O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
        O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
        O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
        O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
        O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
        O4 - Global Startup: Acer Empowering Technology.lnk = ?
        O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
        O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O15 - Trusted Zone: https://www.orange.fr/portail
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
        O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/zuma/oberongamesloader.cab
        O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
        O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

        End of file - 14903 bytes

        ======Scheduled tasks folder======

        C:\WINDOWS\tasks\AppleSoftwareUpdate.job
        C:\WINDOWS\tasks\Norton Security Scan for christian laville.job

        ======Registry dump======

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
        AcroIEHlprObj Class - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
        Windows Live Family Safety Browser Helper Class - C:\Program Files\Windows Live\Family Safety\fssbho.dll [2009-02-06 61808]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
        Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-01-28 1554256]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
        Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
        Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
        Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\WINDOWS\system32\eDStoolbar.dll [2006-03-08 106496]
        {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-07-11 7626752]
        "nwiz"=nwiz.exe /install []
        "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-06-01 16208384]
        "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
        "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
        "ntiMUI"=c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe [2005-05-11 45056]
        "RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]
        "IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-05 208952]
        "IMEKRMIG6.1"=C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE [2004-08-05 44032]
        "MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-05 59392]
        "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-05 455168]
        "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-05 455168]
        "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-07-11 86016]
        "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]
        "Acer Empowering Technology Monitor"=C:\WINDOWS\system32\SysMonitor.exe [2006-04-18 49152]
        "eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2006-03-17 345088]
        "eRecoveryService"=C:\Acer\Empowering Technology\eRecovery\eRAgent.exe [2006-06-01 413696]
        "AspireService"=C:\Program Files\Acer\Acer eMode Management\AspireService.exe [2006-08-11 110592]
        "MediaSync"=C:\Program Files\Acer\Acer eConsole\MediaSync.exe [2006-07-06 425984]
        "PCMService"=C:\Program Files\CyberLink\PowerCinema\PCMService.exe [2006-07-26 143360]
        "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-05-11 49152]
        "ORAHSSSessionManager"=C:\Program Files\Orange\SessionManager\SessionManager.exe [2007-09-25 102400]
        "SystrayORAHSS"=C:\Program Files\Orange\Systray\SystrayApp.exe [2007-09-25 94208]
        "fssui"=C:\Program Files\Windows Live\Family Safety\fsui.exe [2009-02-06 454000]
        "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
        "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
        "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-03-12 342312]
        "au"=C:\Program Files\Dealio\DealioAU.exe []
        "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

        [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
        "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-01-28 2097488]
        "H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]

        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
        Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
        Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

        C:\Documents and Settings\christian laville\Menu Démarrer\Programmes\Démarrage
        LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe
        Outil de notification Live Search.lnk - C:\Documents and Settings\christian laville\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
        C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
        WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-08-24 133120]

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
        "dontdisplaylastusername"=0
        "legalnoticecaption"=
        "legalnoticetext"=
        "shutdownwithoutlogon"=1
        "undockwithoutlogon"=1

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
        "HonorAutoRunSetting"=

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
        "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\Program Files\Acer\Acer eConsole\MediaSync.exe"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe:LocalSubNet:Enabled:Media Synchoronizer"
        "C:\Program Files\Acer\Acer eConsole\eConsole.exe"="C:\Program Files\Acer\Acer eConsole\eConsole.exe:LocalSubNet:Enabled:eConsole"
        "C:\Program Files\Acer\Acer eConsole\MediaServerService.exe"="C:\Program Files\Acer\Acer eConsole\MediaServerService.exe:LocalSubNet:Enabled:Acer Media Server"
        "C:\Program Files\CyberLink\PowerCinema\PowerCinema.exe"="C:\Program Files\CyberLink\PowerCinema\PowerCinema.exe:*:Enabled:CyberLink PowerCinema"
        "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program"
        "C:\StubInstaller.exe"="C:\StubInstaller.exe:*:Disabled:LimeWire swarmed installer"
        "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
        "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Disabled:eMule"
        "E:\Grand Prix 3\GP3.ICD"="E:\Grand Prix 3\GP3.ICD:*:Enabled:GP3"
        "C:\Program Files\Microprose\Grand Prix 3\GP3.ICD"="C:\Program Files\Microprose\Grand Prix 3\GP3.ICD:*:Disabled:GP3"
        "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
        "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
        "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
        "C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\winlogon.exe"="C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\winlogon.exe:*:Enabled:Streams Drivers"
        "C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Disabled:BitComet - a BitTorrent Client"
        "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
        "C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"="C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
        "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
        "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
        "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
        "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
        "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
        "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
        "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
        "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
        "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
        "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
        "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
        "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

        ======List of files/folders created in the last 1 months======

        2009-11-17 18:45:03 ----A---- C:\WINDOWS\ntbtlog.txt
        2009-11-12 20:29:47 ----A---- C:\WINDOWS\system32\tmp.txt
        2009-11-12 20:29:37 ----A---- C:\rapport.txt
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\WS2Fix.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\VCCLSID.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\VACFix.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\swxcacls.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\swsc.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\SrchSTS.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\o4Patch.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\IEDFix.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\dumphive.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\Agent.OMZ.Fix.exe
        2009-11-12 20:29:19 ----A---- C:\WINDOWS\system32\404Fix.exe
        2009-11-12 20:29:18 ----A---- C:\WINDOWS\system32\swreg.exe
        2009-11-12 20:29:18 ----A---- C:\WINDOWS\system32\Process.exe
        2009-11-11 19:05:03 ----A---- C:\cleannavi.txt
        2009-11-11 18:46:03 ----D---- C:\Program Files\Windows Live Safety Center
        2009-11-11 18:25:58 ----D---- C:\WINDOWS\Zuma's Revenge
        2009-11-11 18:25:57 ----D---- C:\Program Files\Zuma's Revenge
        2009-11-11 18:25:47 ----A---- C:\WINDOWS\Zuma's Revenge Setup Log.txt
        2009-11-11 17:45:32 ----D---- C:\Documents and Settings\All Users\Application Data\PopCap Games
        2009-11-11 17:45:19 ----D---- C:\Program Files\PopCap Games
        2009-11-11 17:12:42 ----A---- C:\TB.txt
        2009-11-11 17:12:18 ----D---- C:\ToolBar SD
        2009-11-11 14:38:51 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
        2009-11-11 13:00:34 ----D---- C:\Program Files\trend micro
        2009-11-11 13:00:32 ----D---- C:\rsit

        ======List of files/folders modified in the last 1 months======

        2009-11-18 17:50:57 ----D---- C:\WINDOWS\Prefetch
        2009-11-18 17:27:44 ----D---- C:\WINDOWS\temp
        2009-11-18 17:27:30 ----AD---- C:\WINDOWS\system32
        2009-11-18 13:51:05 ----A---- C:\WINDOWS\win.ini
        2009-11-18 13:14:38 ----AD---- C:\WINDOWS
        2009-11-17 20:53:09 ----A---- C:\WINDOWS\SchedLgU.Txt
        2009-11-12 20:39:13 ----D---- C:\WINDOWS\system32\CatRoot2
        2009-11-12 17:23:07 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
        2009-11-12 17:23:02 ----AD---- C:\WINDOWS\system32\drivers
        2009-11-11 19:21:54 ----RD---- C:\Program Files
        2009-11-11 19:11:39 ----D---- C:\Program Files\Navilog1
        2009-11-11 18:47:17 ----HD---- C:\WINDOWS\inf
        2009-11-11 18:15:05 ----D---- C:\Program Files\LimeWire
        2009-11-11 14:41:59 ----SHD---- C:\WINDOWS\Installer
        2009-11-11 14:41:59 ----D---- C:\Config.Msi
        2009-11-11 14:38:54 ----RSHDC---- C:\WINDOWS\system32\dllcache
        2009-11-11 13:33:59 ----HD---- C:\WINDOWS\$hf_mig$
        2009-11-09 20:20:07 ----D---- C:\Program Files\Fichiers communs
        2009-11-09 20:19:27 ----D---- C:\Documents and Settings\christian laville\Application Data\Shareaza
        2009-11-09 19:40:59 ----D---- C:\SIERRA
        2009-11-09 19:40:58 ----AC---- C:\WINDOWS\wininit.ini
        2009-11-09 19:38:21 ----D---- C:\Program Files\eMule
        2009-11-06 18:03:43 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
        2009-11-05 18:36:22 ----A---- C:\WINDOWS\system32\MRT.exe
        2009-11-04 08:42:27 ----D---- C:\WINDOWS\Help
        2009-11-03 20:01:20 ----A---- C:\WINDOWS\imsins.BAK
        2009-11-03 20:01:04 ----D---- C:\WINDOWS\ie7updates
        2009-11-01 18:46:34 ----D---- C:\Program Files\Microsoft Games
        2009-10-25 20:54:02 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
        2009-10-23 05:47:40 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 089 USB WMC Data Modem #2.txt
        2009-10-21 05:07:57 ----A---- C:\WINDOWS\system32\mshtml.dll

        ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

        R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
        R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
        R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
        R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
        R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
        R2 Atmuni;Gestionnaire d'appel ATM; C:\WINDOWS\system32\DRIVERS\atmuni.sys [2004-08-05 352256]
        R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2008-12-08 55136]
        R2 Rawwan;Pilote réseau étendu RAW; C:\WINDOWS\system32\DRIVERS\rawwan.sys [2004-08-05 34432]
        R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
        R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
        R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
        R3 AtmElan;Réseau émulant ATM; C:\WINDOWS\system32\DRIVERS\atmlane.sys [2008-04-13 55808]
        R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-01-15 23848]
        R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
        R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
        R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
        R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-10-21 21568]
        R3 int15.sys;int15.sys; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys []
        R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-05 4284928]
        R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
        R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2006-08-07 6144]
        R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-07-11 3934592]
        R3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
        R3 psdfilter;psdfilter; \??\C:\WINDOWS\system32\Drivers\psdfilter.sys []
        R3 psdvdisk;psdvdisk; \??\C:\WINDOWS\system32\Drivers\psdvdisk.sys []
        R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
        R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
        R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
        R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
        R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
        R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
        R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
        R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-06-29 244864]
        R3 ZDPSp50;ZDPSp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\ZDPSp50.sys [2004-10-25 17664]
        S1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-18 43520]
        S3 AtmLane;Émulation réseau ATM; C:\WINDOWS\system32\DRIVERS\atmlane.sys [2008-04-13 55808]
        S3 catchme;catchme; \??\C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys []
        S3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
        S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-05 12288]
        S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
        S3 se57bus;Sony Ericsson Device 087 driver (WDM); C:\WINDOWS\system32\DRIVERS\se57bus.sys [2006-11-30 61536]
        S3 se57mdfl;Sony Ericsson Device 087 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se57mdfl.sys [2006-11-30 9360]
        S3 se57mdm;Sony Ericsson Device 087 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se57mdm.sys [2006-11-30 97088]
        S3 se57mgmt;Sony Ericsson Device 087 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\se57mgmt.sys [2006-11-30 88624]
        S3 se57nd5;Sony Ericsson Device 087 USB Ethernet Emulation SEMC57 (NDIS); C:\WINDOWS\system32\DRIVERS\se57nd5.sys [2006-11-30 18704]
        S3 se57obex;Sony Ericsson Device 087 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se57obex.sys [2006-11-30 86432]
        S3 se57unic;Sony Ericsson Device 087 USB Ethernet Emulation SEMC57 (WDM); C:\WINDOWS\system32\DRIVERS\se57unic.sys [2006-11-30 90800]
        S3 se59bus;Sony Ericsson Device 089 driver (WDM); C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 61536]
        S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 9360]
        S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 97088]
        S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\se59mgmt.sys [2006-09-05 88624]
        S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS); C:\WINDOWS\system32\DRIVERS\se59nd5.sys [2006-09-05 18704]
        S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 86432]
        S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM); C:\WINDOWS\system32\DRIVERS\se59unic.sys [2006-09-05 90800]
        S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023k.sys [2002-08-12 11136]
        S3 usb_rndisx;Carte ISDN USB; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
        S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-05 36864]
        S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS); C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-10-28 402432]
        S3 ZD1211U(ZyDAS);ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS); C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-10-04 280064]
        S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

        ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

        R2 Acer Media Server;Acer Media Server; C:\Program Files\Acer\Acer eConsole\MediaServerService.exe [2006-07-06 438272]
        R2 AcerMemUsageCheckService;Memory Check Service; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [2006-05-11 28672]
        R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
        R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
        R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
        R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
        R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe [2006-07-26 266338]
        R2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe [2006-07-26 114784]
        R2 CyberLink Media Library Service;CyberLink Media Library Service; C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe [2006-07-26 1073152]
        R2 fsssvc;Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
        R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2007-09-25 65536]
        R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-08-08 153376]
        R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2006-02-17 73728]
        R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-07-11 155715]
        R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]
        R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
        R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
        R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
        R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-03-12 656168]
        S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
        S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
        S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
        S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
        S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
        S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
        S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
        S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

        -----------------EOF-----------------
        0
      2. alex73730 > alex73730
         
        c'est encore pas sa ?????????????????????????????????
        0
  13. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Oui c'est bien ça ;)

    vas supprimer le dossier Dealio qui se trouve dans tes programmes :

    C:\Program Files\Dealio

    Ensuite :

    ▶ Télécharge Combofix de sUBs

    ▶ et enregistre le sur le Bureau.

    ▶ désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)

    Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

    https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    Je te conseille d'installer la console de récupération !!

    ensuite envois le rapport stp
    0
    1. alex73730
       
      je n'arrive pas a trouver le fichier dalileo ... comment fair e,??
      0
  14. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Bonjour,

    ce n'est pas un fichier, c'est un dossier... Il ne se trouve pas dans le dossier Program Files ??

    Sinon passe à la suite ;)
    0