Virus bloque avast, spyboot, site antivirus..

Bonjour Chiquitine, c'est toi qui a réalisé ce programme ??


voici le rapport, merci


############################## | FindyKill V5.017 |

# User : Romano (Administrateurs) # ROMANO-33016F5A
# Update on 01/11/2009 by Chiquitine29
# Start at: 21:07:10 | 12/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Processeur Intel Pentium III Xeon
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 298,09 Go (267,9 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 298,09 Go (280,06 Go free) # NTFS

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Controls\VolumeIndicator.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ExtraFilm Designer BE FR\EFUploadSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
c:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\system32 |

Présent ! C:\WINDOWS\system32\srosa2.sys
Présent ! C:\WINDOWS\system32\wfsintwq.sys

################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Romano\Application Data |

Présent ! C:\Documents and Settings\Romano\Application Data\drivers
Présent ! C:\Documents and Settings\Romano\Application Data\drivers\downld
################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\SYSTEM\CurrentControlSet\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet001\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet003\Services\srosa]
Présent ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
Présent ! [HKCU\Software\bisoft]
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\bisoft]
Présent ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"
Présent ! [HKLM\software\microsoft\security center] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"
Présent ! [HKLM\software\microsoft\security center] "FirewallOverride"
Présent ! [HKLM\software\microsoft\security center] "UpdatesDisableNotify"

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | Cracks / Keygens / Serials |

"E:\Nouveau dossier\Mes documents\Azureus Downloads\CloneDVD 2.9.2.2 - Final\Keygen.exe"
06/09/2009 12:16 |Size 427008 |Crc32 aad01957 |Md5 9eaa368a051ff8c8861424791785a63b

"E:\Nouveau dossier\Mes documents\Azureus Downloads\WinRAR 3.9b1 + Crack\WinRAR.exe"
19/07/2009 13:19 |Size 1032192 |Crc32 c812b27d |Md5 08b58417ebf9a33104e259cbef8c633c

"E:\Nouveau dossier\Mes documents\Azureus Downloads\WinRAR 3.9b1 + Crack\wrar39b1.exe"
19/07/2009 13:19 |Size 1356503 |Crc32 5e217a74 |Md5 9707017cf513ab1913083d30f6fbf1ba


################## | ! Fin du rapport # FindyKill V5.017 ! |

voici le info.txt

info.txt logfile of random's system information tool 1.06 2009-11-12 12:09:39

======Uninstall list======

-->C:\Program Files\Conexant\SmartAudio\SETUP.EXE -U -ISmartAudio -SM=SMAUDIO.EXE,1801
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Adobe Color EU Extra Settings CS4-->MsiExec.exe /I{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}
Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
Adobe Color NA Recommended Settings CS4-->MsiExec.exe /I{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}
Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
Adobe Creative Suite 4 Design Premium-->C:\Program Files\Fichiers communs\Adobe\Installers\55230b0b70661df0f212e88f0b655f7\Setup.exe --uninstall=1
Adobe Creative Suite 4 Design Premium-->MsiExec.exe /I{A2881E09-38DB-4F79-9135-00FDA01768A7}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Dreamweaver CS4-->MsiExec.exe /I{30C8AA56-4088-426F-91D1-0EDFD3A25678}
Adobe Dynamiclink Support-->MsiExec.exe /I{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Flash CS4 Extension - Flash Lite STI fr-->MsiExec.exe /I{BD423B54-8668-44B6-8610-D24514445E88}
Adobe Flash CS4 STI-fr-->MsiExec.exe /I{48F9998C-3BA0-42D3-82E6-5882441EB8CE}
Adobe Flash CS4-->MsiExec.exe /I{F6E99614-F042-4459-82B7-8B38B2601356}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 ActiveX-->MsiExec.exe /X{3A6829EF-0791-4FDD-9382-C690DD0821B9}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
Adobe Illustrator CS4-->MsiExec.exe /I{87532CAB-7932-4F84-8937-823337622807}
Adobe InDesign CS4 Application Feature Set Files (Roman)-->MsiExec.exe /I{2BAF2B96-7560-48B4-87D4-10178DDBE217}
Adobe InDesign CS4 Common Base Files-->MsiExec.exe /I{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}
Adobe InDesign CS4 Icon Handler-->MsiExec.exe /I{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}
Adobe InDesign CS4-->MsiExec.exe /I{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}
Adobe Linguistics CS4-->MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67}
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS4 Support-->MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}
Adobe Photoshop CS4-->MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{A128921B-D03F-4BFB-8141-C365AA48D660}
Adobe SGM CS4-->MsiExec.exe /I{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}
Adobe SING CS4-->MsiExec.exe /I{4A52555C-032A-4083-BDD9-6A85ABFB39A8}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
AdobeColorCommonSetCMYK-->MsiExec.exe /I{68243FF8-83CA-466B-B2B8-9F99DA5479C4}
AdobeColorCommonSetRGB-->MsiExec.exe /I{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}
ALPS Touch Pad Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}\setup.exe" UNINSTALL
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft Software Suite-->C:\Program Files\InstallShield Installation Information\{497A1721-088F-41EF-8876-B43C9DA5528B}\Setup.exe -runfromtemp -l0x040c -removeonly
Assist TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\Setup.exe" -l0x40c
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
Camera Assistant Software for Toshiba-->C:\Program Files\InstallShield Installation Information\{37C866E4-AA67-4725-9E95-A39968DD7960}\setup.exe -runfromtemp -l0x040c
Catalyst Control Center - Branding-->MsiExec.exe /I{69E5255D-9D43-4CFF-8984-843ABD7753B7}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_AUDIO_HDA\UIU32a.exe -U -ITE1HER5a.INF
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
Corel Paint Shop Pro Photo X2-->MsiExec.exe /X{64E72FB1-2343-4977-B4A8-262CD53D0BD3}
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
ExtraFilm Designer BE FR-->C:\Program Files\ExtraFilm Designer BE FR\Uninstall.exe
FileZilla Client 3.3.0-rc1-->C:\Program Files\FileZilla FTP Client\uninstall.exe
Gestion d'énergie TOSHIBA-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\TOSHIBA\Power Saver\Uninst.isu" -c"C:\WINDOWS\system32\TPSDel.dll"
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_HERMOSA_HSF\UIU32m.exe -U -ITE1HER5m.INF
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Color LaserJet 3600-->"C:\Program Files\Hewlett-Packard\Install Engines\HP Color LaserJet 3600\setup.exe" /x
HP Color LaserJet 3600-->msiexec /x{EED52BB5-3A22-42F2-9B76-BB743F6739B7}
HP Customer Participation Program 11.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat -forcereboot
HP Image Zone 4.7-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Imaging Device Functions 11.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart C6300 All-In-One Driver Software 11.0 Rel .4-->C:\Program Files\HP\Digital Imaging\{C8732DC3-1736-44b2-B741-2D636DE58605}\setup\hpzscr01.exe -datfile hposcr31.dat -onestop
HP Photosmart Essential 3.0-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat -forcereboot
HP PSC & OfficeJet 4.7-->"C:\Program Files\HP\Digital Imaging\{5469D537-9B44-4c78-BF2D-5F9807564F74}\setup\hpzscr01.exe" -datfile hposcr05.dat
HP Smart Web Printing-->C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpzscr01.exe -datfile hpqbud15.dat
HP Solution Center 11.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat -forcereboot
HP Update-->MsiExec.exe /X{D063F201-FAC4-4D5C-B10B-615058ADE5A7}
InterVideo WinDVD for TOSHIBA-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
Jasc Animation Shop 3-->MsiExec.exe /I{174D5678-D941-433C-BD23-58A5C7B0D36D}
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF}
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
K-Lite Codec Pack 5.4.0 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Manuels TOSHIBA-->C:\Program Files\InstallShield Installation Information\{5B0202A8-CC6B-4443-AD73-FE9DF1FC1622}\setup.exe -runfromtemp -l0x040c -removeonly
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Expression Studio 2-->"C:\Program Files\Microsoft Expression\ExpressionStudio 2\Setup\XSetup.exe" -x -AppLangId:1036 "-manifest:ExpressionStudioManifest.cab" "-source:C:\Program Files\Microsoft Expression\ExpressionStudio 2\Setup\;e:\213d256062f0fa4cca57\Setup\;e:\213d256062f0fa4cca57\Setup"
Microsoft Expression Studio 2-->MsiExec.exe /X{AFADB5F7-5CA7-4F2F-A232-D7B756D907AB}
Microsoft Expression Web 2 MUI (French)-->MsiExec.exe /X{90120000-0045-040C-0000-0000000FF1CE}
Microsoft Expression Web 2-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall XWEB /dll XSETUP.DLL
Microsoft Expression Web 2-->MsiExec.exe /X{90120000-0045-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB975364)-->"C:\WINDOWS\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB960763)-->"C:\WINDOWS\$NtUninstallKB960763$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Module linguistique Microsoft .NET Framework 3.5 - fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
Mozilla Firefox (3.0.15)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x040c -removeonly
O2Micro Flash Memory Card Reader Driver (x86)-->MsiExec.exe /X{156E98D0-1AEC-4013-A41A-94A1A01BFD68}
Outil de diagnostic PC TOSHIBA-->C:\Program Files\InstallShield Installation Information\{2C38F661-26B7-445D-B87D-B53FE2D3BD42}\setup.exe -runfromtemp -l0x040c
OxiMailing-->MsiExec.exe /X{8A8BF0AF-068E-4599-ABB2-39AEA2C43619}
OxiSms-->MsiExec.exe /I{4315A3B7-9A2D-4228-9705-550C483A06A4}
PDF Settings CS4-->MsiExec.exe /I{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
Pixel Bender Toolkit-->MsiExec.exe /I{43509E18-076E-40FE-AF38-CA5ED400A5A9}
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\Setup.exe" -l0x40c
Sarbacane 3-->C:\Program Files\Goto software\Sarbacane 3\uninst.exe
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Shop for HP Supplies-->C:\Program Files\HP\Digital Imaging\HPSSupply\hpzscr01.exe -datfile hpqbud16.dat
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
TOSHIBA ConfigFree-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe" -l0x40c UNINSTALL
Toshiba Controls Utility-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{0C0A2D69-7F51-4B77-B64E-AB405AC446BE} /l1036
TOSHIBA Direct Disc Writer-->MsiExec.exe /X{400830CA-F056-4BBE-80A3-9DF9CA4FB889}
TOSHIBA Disc Creator-->MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0}
Toshiba Hotkey Utility-->c:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{5691A25E-C05B-4E0F-87DA-E80869F756C2} /l1036
Toshiba Online Product Information-->C:\Program Files\InstallShield Installation Information\{2290A680-4083-410A-ADCC-7092C67FC052}\setup.exe -runfromtemp -l0x040c -removeonly
TOSHIBA SD Memory Utilities-->MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
Toshiba Touchpad Utility-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{576420A5-E1F0-4C09-A07C-F689082E666F} /l1036
Toshiba Utility-->c:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{C852C0FF-CDF5-43F9-A75E-CB99410FF602} /l1036
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Expression Web 2 (KB957827)-->msiexec /package {90120000-0045-0000-0000-0000000FF1CE} /uninstall {DCA28998-1FE8-4CEA-818D-027D8B15F119}
Update for Outlook 2007 Junk Email Filter (KB974810)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C05FBAD5-A211-4E86-BB51-7E07B80C9233}
Utilitaire de zoom TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64212898-097F-4F3F-AECA-6D34A7EF82DF}\setup.exe" -l0x40c -removeonly
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 091112-0]

======System event log======

Computer Name: ROMANO-33016F5A
Event Code: 5005
Message:
Record Number: 871
Source Name: NETw5x32
Time Written: 20091030163547.000000+060
Event Type: Informations
User:

Computer Name: ROMANO-33016F5A
Event Code: 5005
Message:
Record Number: 870
Source Name: NETw5x32
Time Written: 20091030163545.000000+060
Event Type: Informations
User:

Computer Name: ROMANO-33016F5A
Event Code: 5005
Message:
Record Number: 869
Source Name: NETw5x32
Time Written: 20091030163543.000000+060
Event Type: Informations
User:

Computer Name: ROMANO-33016F5A
Event Code: 5005
Message:
Record Number: 868
Source Name: NETw5x32
Time Written: 20091030163541.000000+060
Event Type: Informations
User:

Computer Name: ROMANO-33016F5A
Event Code: 5005
Message:
Record Number: 867
Source Name: NETw5x32
Time Written: 20091030163539.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: ROMANO-33016F5A
Event Code: 1004
Message: Échec de détection du produit '{90120000-001F-040C-0000-0000000FF1CE}', fonctionnalité 'SpellingAndGrammarFiles_1036', composant '{87E0AB82-3287-11D4-8C35-0000F8040C5E}. La ressource 'C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3FR.LEX' n'existe pas

Record Number: 1267
Source Name: MsiInstaller
Time Written: 20091104085642.000000+060
Event Type: Avertissement
User: ROMANO-33016F5A\Romano

Computer Name: ROMANO-33016F5A
Event Code: 1004
Message: Échec de détection du produit '{90120000-001F-040C-0000-0000000FF1CE}', fonctionnalité 'SpellingAndGrammarFiles_1036', composant '{87E0AB82-3287-11D4-8C35-0000F8040C5E}. La ressource 'C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3FR.LEX' n'existe pas

Record Number: 1266
Source Name: MsiInstaller
Time Written: 20091104085642.000000+060
Event Type: Avertissement
User: ROMANO-33016F5A\Romano

Computer Name: ROMANO-33016F5A
Event Code: 1004
Message: Échec de détection du produit '{90120000-001F-040C-0000-0000000FF1CE}', fonctionnalité 'SpellingAndGrammarFiles_1036', composant '{87E0AB82-3287-11D4-8C35-0000F8040C5E}. La ressource 'C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3FR.LEX' n'existe pas

Record Number: 1265
Source Name: MsiInstaller
Time Written: 20091104085642.000000+060
Event Type: Avertissement
User: ROMANO-33016F5A\Romano

Computer Name: ROMANO-33016F5A
Event Code: 1004
Message: Échec de détection du produit '{90120000-001F-040C-0000-0000000FF1CE}', fonctionnalité 'SpellingAndGrammarFiles_1036', composant '{87E0AB82-3287-11D4-8C35-0000F8040C5E}. La ressource 'C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3FR.LEX' n'existe pas

Record Number: 1264
Source Name: MsiInstaller
Time Written: 20091104085642.000000+060
Event Type: Avertissement
User: ROMANO-33016F5A\Romano

Computer Name: ROMANO-33016F5A
Event Code: 1004
Message: Échec de détection du produit '{90120000-001F-040C-0000-0000000FF1CE}', fonctionnalité 'SpellingAndGrammarFiles_1036', composant '{87E0AB82-3287-11D4-8C35-0000F8040C5E}. La ressource 'C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3FR.LEX' n'existe pas

Record Number: 1263
Source Name: MsiInstaller
Time Written: 20091104085634.000000+060
Event Type: Avertissement
User: ROMANO-33016F5A\Romano

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=170a
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_06\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_06\lib\ext\QTJava.zip

-----------------EOF-----------------



et voici le log.txt
Logfile of random's system information tool 1.06 (written by random/random)
Run by Romano at 2009-11-12 12:09:33
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 274 GB (90%) free of 305 GB
Total RAM: 3037 MB (68% free)


======Scheduled tasks folder======

C:\WINDOWS\tasks\Rappel d'enregistrement 3.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{B0DE7534-2EA2-4C44-8F78-24439B72E602}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2008-03-27 322880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-10 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2008-03-27 501056]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"=C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [2007-09-28 75136]
"NDSTray.exe"=NDSTray.exe []
"Toshiba Hotkey Utility"=c:\Program Files\Toshiba\Windows Utilities\Hotkey.exe [2008-05-09 1773568]
"TPSMain"=C:\WINDOWS\system32\TPSMain.exe [2005-08-03 266240]
"DDWMon"=C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe [2007-04-26 495616]
"topi"=C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [2007-07-10 581632]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2007-12-15 184320]
"Toshiba Controls Utility"=C:\Program Files\TOSHIBA\Controls\VolumeIndicator.exe [2008-02-01 77824]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"Corel File Shell Monitor"=C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [2008-08-18 16712]
"AdobeCS4ServiceManager"=C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2008-03-25 49152]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-03-13 81920]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]
"ArcSoft Connection Service"=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe [2007-10-11 31232]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2004-08-13 774144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [2008-04-29 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe [2007-05-11 143360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-04-07 126976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
WgaLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 240128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Documents and Settings\Romano\Local Settings\Temp\7zS29AC\Setup\HPZnet01.exe"="C:\Documents and Settings\Romano\Local Settings\Temp\7zS29AC\Setup\HPZnet01.exe:*:Enabled:Install Consumer Experience Network Plug in"
"C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"D:\setup\HPZnui01.exe"="D:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe"
"C:\Program Files\Goto software\Sarbacane 3\Sarbacane 3.exe"="C:\Program Files\Goto software\Sarbacane 3\Sarbacane 3.exe:*:Enabled:Sarbacane 3"
"C:\Program Files\eMule\eMule.exe"="C:\Program Files\eMule\eMule.exe:*:Enabled:eMule Plus"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\setup\HPZnui01.exe"="D:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe"

======File associations======

.js - open - "C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe","%1"

======List of files/folders created in the last 1 months======

2009-11-12 12:09:33 ----D---- C:\rsit
2009-11-12 12:09:33 ----D---- C:\Program Files\trend micro
2009-11-12 10:01:39 ----D---- C:\WINDOWS\BDOSCAN8
2009-11-12 10:01:35 ----D---- C:\WINDOWS\LastGood
2009-11-12 09:57:48 ----D---- C:\SDFix
2009-11-12 09:48:52 ----A---- C:\WINDOWS\system32\ban_list.txt
2009-11-12 09:48:38 ----HD---- C:\Documents and Settings\Romano\Application Data\m
2009-11-12 09:41:17 ----HD---- C:\Documents and Settings\Romano\Application Data\drivers
2009-11-12 09:40:53 ----D---- C:\Documents and Settings\Romano\Application Data\Help
2009-11-12 09:40:34 ----D---- C:\Documents and Settings\Romano\Application Data\Jasc
2009-11-12 09:39:52 ----D---- C:\Program Files\Jasc Software Inc
2009-11-12 08:50:20 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-11-10 08:46:44 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-11-09 23:46:28 ----D---- C:\Program Files\Microsoft Expression
2009-11-09 23:38:18 ----D---- C:\Program Files\Common Files
2009-11-09 23:38:03 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-11-09 23:33:49 ----D---- C:\Program Files\VS Revo Group
2009-11-09 20:43:06 ----D---- C:\Documents and Settings\Romano\Application Data\ExtraFilm
2009-11-09 20:42:03 ----D---- C:\Documents and Settings\All Users\Application Data\ExtraFilm
2009-11-09 20:41:58 ----D---- C:\Program Files\ExtraFilm Designer BE FR
2009-11-08 14:30:26 ----D---- C:\Documents and Settings\Romano\Application Data\ArcSoft
2009-11-08 14:29:54 ----A---- C:\WINDOWS\system32\unicows.dll
2009-11-08 14:29:53 ----D---- C:\Program Files\Fichiers communs\ArcSoft
2009-11-08 14:29:24 ----D---- C:\WINDOWS\system32\MediaImpression Slideshow
2009-11-08 14:29:17 ----D---- C:\Program Files\ArcSoft
2009-11-08 12:45:10 ----D---- C:\Documents and Settings\Romano\Application Data\Apple Computer
2009-11-08 12:39:30 ----D---- C:\Program Files\QuickTime
2009-11-08 12:39:29 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-11-08 12:39:15 ----D---- C:\Program Files\Fichiers communs\Apple
2009-11-08 12:39:08 ----D---- C:\Program Files\Apple Software Update
2009-11-08 12:39:08 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-11-08 12:21:25 ----D---- C:\Documents and Settings\Romano\Application Data\Media Player Classic
2009-11-05 12:24:27 ----D---- C:\WINDOWS\system32\NtmsData
2009-11-05 12:15:51 ----D---- C:\WINDOWS\system32\LogFiles
2009-11-05 11:53:25 ----A---- C:\WINDOWS\hpntwksetup.ini
2009-11-04 11:22:56 ----A---- C:\WINDOWS\hpclj3600g.ini
2009-11-04 11:17:01 ----A---- C:\WINDOWS\hpclj3600m.ini
2009-11-04 11:16:35 ----D---- C:\Program Files\Fichiers communs\SWF Studio
2009-11-04 08:46:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960763$
2009-11-02 10:08:47 ----D---- C:\WINDOWS\system32\appmgmt
2009-11-01 23:30:07 ----D---- C:\Documents and Settings\All Users\Application Data\WEBREG
2009-11-01 23:28:33 ----D---- C:\Documents and Settings\Romano\Application Data\HP
2009-11-01 23:21:05 ----A---- C:\WINDOWS\system32\hpz3l692.dll
2009-11-01 23:21:04 ----RA---- C:\WINDOWS\system32\hpzids01.dll
2009-11-01 23:20:24 ----RA---- C:\WINDOWS\system32\hppldcoi.dll
2009-11-01 23:20:24 ----RA---- C:\WINDOWS\system32\hposwia_p01d.dll
2009-11-01 23:20:24 ----RA---- C:\WINDOWS\system32\hpost_p01d.dll
2009-11-01 23:20:24 ----RA---- C:\WINDOWS\system32\hposc_p01a.dll
2009-11-01 23:20:24 ----RA---- C:\WINDOWS\system32\difxapi.dll
2009-11-01 23:15:12 ----D---- C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2009-11-01 23:15:12 ----D---- C:\Documents and Settings\All Users\Application Data\HP
2009-11-01 23:14:40 ----D---- C:\Program Files\Hewlett-Packard
2009-11-01 23:14:12 ----D---- C:\Program Files\Fichiers communs\HP
2009-11-01 23:12:20 ----HD---- C:\Config.Msi
2009-10-29 23:19:30 ----D---- C:\Documents and Settings\All Users\Application Data\Azureus
2009-10-29 23:19:27 ----D---- C:\Documents and Settings\Romano\Application Data\Azureus
2009-10-29 23:19:11 ----D---- C:\Program Files\Vuze
2009-10-29 22:56:23 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2009-10-29 22:50:06 ----D---- C:\Documents and Settings\All Users\Application Data\ALM
2009-10-29 22:41:05 ----D---- C:\Program Files\Fichiers communs\Macrovision Shared
2009-10-29 22:00:15 ----D---- C:\Documents and Settings\Romano\Application Data\Corel
2009-10-29 21:58:58 ----D---- C:\Program Files\Fichiers communs\Protexis
2009-10-29 21:58:58 ----D---- C:\Program Files\Fichiers communs\Corel
2009-10-29 21:58:58 ----D---- C:\Documents and Settings\All Users\Application Data\Corel
2009-10-29 21:56:29 ----D---- C:\Program Files\Corel
2009-10-29 21:47:04 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-10-29 21:47:00 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-10-29 21:37:25 ----D---- C:\Program Files\MSECache
2009-10-29 14:23:02 ----D---- C:\Documents and Settings\Romano\Application Data\FileZilla
2009-10-29 14:22:57 ----D---- C:\Program Files\FileZilla FTP Client
2009-10-29 14:08:59 ----D---- C:\Documents and Settings\Romano\Application Data\Macromedia
2009-10-29 14:07:42 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-10-29 14:07:26 ----D---- C:\Program Files\Oxemis
2009-10-29 14:07:26 ----D---- C:\Documents and Settings\Romano\Application Data\Oxemis
2009-10-29 11:34:42 ----D---- C:\Documents and Settings\Romano\Application Data\GOTO Software
2009-10-29 11:34:12 ----D---- C:\Program Files\Goto software
2009-10-29 10:55:05 ----D---- C:\Program Files\Fichiers communs\Hewlett-Packard
2009-10-29 10:54:53 ----A---- C:\WINDOWS\system32\hpzlnt12.dll
2009-10-29 10:54:28 ----A---- C:\WINDOWS\system32\AddPort.ini
2009-10-29 10:54:27 ----A---- C:\WINDOWS\system32\hpzjsn01.dll
2009-10-29 10:54:27 ----A---- C:\WINDOWS\system32\hpzjfw01.dll
2009-10-29 10:54:27 ----A---- C:\WINDOWS\system32\hptcpmon.ini
2009-10-29 10:53:46 ----D---- C:\TEMP
2009-10-29 10:53:34 ----A---- C:\WINDOWS\system32\HPZipm12.exe
2009-10-29 10:53:34 ----A---- C:\WINDOWS\system32\HPZinw12.exe
2009-10-29 10:53:33 ----A---- C:\WINDOWS\IsUninst.exe
2009-10-29 10:53:26 ----D---- C:\Program Files\HP
2009-10-29 10:51:44 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-10-28 13:50:05 ----A---- C:\WINDOWS\system32\hpovst08.dll
2009-10-28 13:50:05 ----A---- C:\WINDOWS\system32\hpotscl.dll
2009-10-28 13:50:05 ----A---- C:\WINDOWS\system32\hpgwiamd.dll
2009-10-28 13:50:01 ----A---- C:\WINDOWS\system32\hpzcon12.dll
2009-10-28 13:50:01 ----A---- C:\WINDOWS\system32\hpzcoi12.dll
2009-10-28 13:49:02 ----D---- C:\Program Files\WinRAR
2009-10-28 13:48:44 ----D---- C:\Documents and Settings\Romano\Application Data\WinRAR
2009-10-28 13:42:31 ----A---- C:\WINDOWS\system32\pdfcmnnt.dll
2009-10-28 13:42:29 ----D---- C:\Program Files\PDFCreator
2009-10-28 13:42:29 ----A---- C:\WINDOWS\system32\VB6FR.DLL
2009-10-28 13:42:29 ----A---- C:\WINDOWS\system32\MSMPIDE.DLL
2009-10-28 13:42:29 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL
2009-10-28 13:42:29 ----A---- C:\WINDOWS\system32\MSCC2FR.DLL
2009-10-28 13:21:20 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-10-28 13:21:20 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-10-28 13:06:53 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-10-28 13:06:53 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-28 13:05:43 ----A---- C:\WINDOWS\system32\unrar.dll
2009-10-28 13:05:43 ----A---- C:\WINDOWS\avisplitter.ini
2009-10-28 13:05:42 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-10-28 13:05:42 ----A---- C:\WINDOWS\system32\xvidcore.dll
2009-10-28 13:05:41 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2009-10-28 13:05:41 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-10-28 13:05:40 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-10-28 13:05:39 ----D---- C:\Program Files\K-Lite Codec Pack
2009-10-28 13:03:14 ----D---- C:\Program Files\CDBurnerXP
2009-10-28 12:59:32 ----D---- C:\Documents and Settings\Romano\Application Data\Mozilla
2009-10-28 12:59:24 ----D---- C:\Program Files\Mozilla Firefox
2009-10-28 12:55:05 ----D---- C:\Program Files\Adobe
2009-10-28 12:50:34 ----D---- C:\Program Files\CCleaner
2009-10-28 12:45:27 ----D---- C:\Documents and Settings\Romano\Application Data\Adobe
2009-10-28 12:45:12 ----SHD---- C:\RECYCLER
2009-10-27 19:38:15 ----D---- C:\WINDOWS\system32\XPSViewer
2009-10-27 19:38:12 ----D---- C:\Program Files\MSBuild
2009-10-27 19:38:10 ----D---- C:\WINDOWS\system32\en-US
2009-10-27 19:38:05 ----D---- C:\Program Files\Reference Assemblies
2009-10-27 19:37:51 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-10-27 19:37:51 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-10-27 19:37:51 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-10-27 19:37:51 ----D---- C:\450666bf349e813343f885164d1a
2009-10-27 19:35:03 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-10-27 19:27:19 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-10-27 19:27:16 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-10-27 19:27:13 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-10-27 19:27:10 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-10-27 19:27:07 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-10-27 19:27:04 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-10-27 19:27:00 ----HDC---- C:\WINDOWS\$NtUninstallKB974455$
2009-10-27 19:26:58 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-10-27 19:26:55 ----HDC---- C:\WINDOWS\$NtUninstallKB923723$
2009-10-27 19:26:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-10-27 19:26:11 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-10-27 19:26:08 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-10-27 19:26:05 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-10-27 19:25:47 ----D---- C:\WINDOWS\ie8updates
2009-10-27 19:25:33 ----D---- C:\WINDOWS\WBEM
2009-10-27 19:25:19 ----HDC---- C:\WINDOWS\ie8
2009-10-27 19:24:47 ----A---- C:\WINDOWS\system32\MRT.exe
2009-10-27 18:33:22 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-10-27 18:33:20 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-10-27 18:33:17 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-10-27 18:33:14 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-10-27 18:33:12 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-10-27 18:33:08 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-10-27 18:33:05 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-10-27 18:33:01 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-10-27 18:32:57 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-10-27 18:32:54 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-10-27 18:32:51 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-10-27 18:32:48 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-10-27 18:32:45 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-10-27 18:32:42 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-10-27 18:32:39 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-10-27 18:32:37 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-10-27 18:32:34 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-10-27 18:32:20 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-10-27 18:32:17 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-10-27 18:32:14 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-10-27 18:32:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-10-27 18:32:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-10-27 18:32:01 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-10-27 18:31:55 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-10-27 18:31:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-10-27 18:31:49 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-10-27 18:31:46 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-10-27 18:31:18 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-10-27 18:31:16 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-10-27 18:31:11 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-10-27 18:31:07 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-10-27 18:31:04 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-10-27 18:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-10-27 18:30:59 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-10-27 18:30:56 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-10-27 18:30:53 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-10-27 18:30:50 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-10-27 18:30:42 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-10-27 18:30:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-10-27 18:30:37 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-10-27 18:30:34 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-10-27 18:30:30 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-10-27 17:52:48 ----D---- C:\WINDOWS\system32\PreInstall
2009-10-27 17:52:47 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-10-27 17:52:47 ----HD---- C:\WINDOWS\$hf_mig$
2009-10-27 17:43:54 ----A---- C:\WINDOWS\system32\aswBoot.exe
2009-10-27 17:43:53 ----D---- C:\Program Files\Alwil Software
2009-10-27 17:42:03 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-10-27 17:35:56 ----D---- C:\Documents and Settings\Romano\Application Data\ATI
2009-10-27 17:35:56 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2009-10-27 17:35:44 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-10-27 17:33:52 ----D---- C:\Program Files\ATI Technologies
2009-10-27 17:32:56 ----A---- C:\WINDOWS\system32\RAPI.DLL
2009-10-27 17:32:56 ----A---- C:\WINDOWS\system32\MSVCRTD.DLL
2009-10-27 17:32:56 ----A---- C:\WINDOWS\system32\MFC42D.DLL
2009-10-27 17:32:56 ----A---- C:\WINDOWS\system32\CEUTIL.DLL
2009-10-27 17:32:36 ----D---- C:\Program Files\Camera Assistant Software for Toshiba
2009-10-27 17:31:44 ----D---- C:\Program Files\Apoint2K
2009-10-27 17:31:44 ----A---- C:\WINDOWS\system32\Vxdif.dll
2009-10-27 17:31:21 ----ASH---- C:\Documents and Settings\Romano\Application Data\desktop.ini
2009-10-27 17:31:20 ----D---- C:\Documents and Settings\Romano\Application Data\InstallShield
2009-10-27 17:31:20 ----D---- C:\Documents and Settings\Romano\Application Data\Identities
2009-10-27 17:31:19 ----SD---- C:\Documents and Settings\Romano\Application Data\Microsoft
2009-10-27 17:31:19 ----D---- C:\Documents and Settings\Romano\Application Data\toshiba
2009-10-27 17:31:19 ----D---- C:\Documents and Settings\Romano\Application Data\TMP
2009-10-27 17:31:19 ----D---- C:\Documents and Settings\Romano\Application Data\Sun

======List of files/folders modified in the last 1 months======

2009-11-12 12:09:33 ----RD---- C:\Program Files
2009-11-12 11:49:27 ----AD---- C:\WINDOWS\system32
2009-11-12 11:29:25 ----SHD---- C:\WINDOWS\Installer
2009-11-12 10:20:18 ----D---- C:\WINDOWS\Temp
2009-11-12 10:01:42 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-11-12 10:01:40 ----D---- C:\WINDOWS
2009-11-12 10:01:39 ----HD---

Bon le scan malawarebytes s'est terminé et il a trouvé plus de 20 fichiers infectés.
Il m'a tout supprimer après le redémarrage.

Maintenant j'arrive à retourner sur les sites d'avast etc.. par contre quand j'essaye de lancer avast il marque : blabla... n'est pas une application win32 valide.

Est ce que je désinstalle et réinstalle avast ?


Le findykill met une plombe à faire son scan, j'ai du laisser tombé il tournait depuis près d'une heure. Je le relance maintenant que le scan malawarebytes est fini


Pour info voici le log malawarebytes :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3153
Windows 5.1.2600 Service Pack 3

12/11/2009 14:43:27
mbam-log-2009-11-12 (14-43-27).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 233573
Temps écoulé: 59 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 21

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\srosa (Worm.Bagle) -> Delete on reboot.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\drvsyskit (Worm.Bagle) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\german.exe (Worm.Bagle) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Worm.Bagle) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\Romano\Application Data\hidires (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\Romano\Application Data\m (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Romano\Application Data\hidires\flec003.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\Romano\Application Data\m\flec006.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\CMM\Combo-Fix.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\SDFix\dummy.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\SDFix\apps\dummy.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP22\A0002613.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0010740.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0010741.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0010742.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011741.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011742.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011758.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011759.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011761.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011762.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011768.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011782.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B69FE3E1-0481-42F0-A81B-C06A2E0F5668}\RP80\A0011783.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mdelk.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wintems.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\Romano\Application Data\drivers\winupgro.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Bonjour, désolé du retard mais je n'avais pas acces à mon pc
j'ai laissé tourné findykill toute la soirée et la nuit avant d'avoir le rapport, est ce normal ?
quoi qu'il en soit, voici le rapport :


merci pour votre aide

############################## | FindyKill V5.017 |

# User : Romano (Administrateurs) # ROMANO-33016F5A
# Update on 01/11/2009 by Chiquitine29
# Start at: 21:07:10 | 12/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Processeur Intel Pentium III Xeon
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 298,09 Go (267,9 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 298,09 Go (280,06 Go free) # NTFS

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Controls\VolumeIndicator.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ExtraFilm Designer BE FR\EFUploadSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
c:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\system32 |

Présent ! C:\WINDOWS\system32\srosa2.sys
Présent ! C:\WINDOWS\system32\wfsintwq.sys

################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Romano\Application Data |

Présent ! C:\Documents and Settings\Romano\Application Data\drivers
Présent ! C:\Documents and Settings\Romano\Application Data\drivers\downld
################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\SYSTEM\CurrentControlSet\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet001\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet003\Services\srosa]
Présent ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
Présent ! [HKCU\Software\bisoft]
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
Présent ! [HKU\S-1-5-21-1920790252-2407709649-997412304-1005\Software\bisoft]
Présent ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"
Présent ! [HKLM\software\microsoft\security center] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"
Présent ! [HKLM\software\microsoft\security center] "FirewallOverride"
Présent ! [HKLM\software\microsoft\security center] "UpdatesDisableNotify"

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | Cracks / Keygens / Serials |

"E:\Nouveau dossier\Mes documents\Azureus Downloads\CloneDVD 2.9.2.2 - Final\Keygen.exe"
06/09/2009 12:16 |Size 427008 |Crc32 aad01957 |Md5 9eaa368a051ff8c8861424791785a63b

"E:\Nouveau dossier\Mes documents\Azureus Downloads\WinRAR 3.9b1 + Crack\WinRAR.exe"
19/07/2009 13:19 |Size 1032192 |Crc32 c812b27d |Md5 08b58417ebf9a33104e259cbef8c633c

"E:\Nouveau dossier\Mes documents\Azureus Downloads\WinRAR 3.9b1 + Crack\wrar39b1.exe"
19/07/2009 13:19 |Size 1356503 |Crc32 5e217a74 |Md5 9707017cf513ab1913083d30f6fbf1ba


################## | ! Fin du rapport # FindyKill V5.017 ! |

Bonjour,

j'ai effectué la suppression avec findykill et il supprimé pas mal de choses.
Seulement le bureau n'est pas réapparu même après la manipulation que vous m'avez dictée, j'ai du redémarrer et je ne trouve pas le rapport, ni sur la racine de C: ni en effectuant une recherche...

Mais j'ai pu réinstaller avast et spyboot... ca semble donc réglé, mais je voudrais en être sur...

Que dois je faire ?

J'ai fait deux fois le test et il trouve deux fois le même malware "Worm.Bagle"
Il dit le supprimer mais apparemment il réapparait à chaque scan.
Que faire maintenant ?

Voici le rapport


Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3168
Windows 5.1.2600 Service Pack 3

15/11/2009 11:56:18
mbam-log-2009-11-15 (11-56-18).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 236019
Temps écoulé: 1 hour(s), 4 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\Romano\Application Data\drivers\downld (Worm.Bagle) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Bonjour,

voici le rapport.

Alors je suis clean ou pas ? lol

Merci d'avance


ComboFix 09-11-16.05 - Romano 16/11/2009 8:57..2 - FAT32x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3037.2415 [GMT 1:00]
Lancé depuis: c:\documents and settings\Romano\Bureau\CMM.exe
AV: avast! antivirus 4.8.1356 [VPS 091115-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Romano\Application Data\drivers\downld
c:\documents and settings\Romano\Mes documents\DeletedKey02.reg

----- BITS: Il y a peut-être des sites infectés -----

hxxp://designer.extrafilm.be
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-16 au 2009-11-16 ))))))))))))))))))))))))))))))))))))
.

2009-11-15 16:25 . 2009-11-16 07:42 -------- d-----w- c:\program files\epson
2009-11-14 00:11 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-14 00:11 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-14 00:11 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-14 00:11 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-14 00:11 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-14 00:11 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-14 00:11 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-14 00:11 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-14 00:11 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-14 00:01 . 2009-11-16 08:02 -------- d--h--w- c:\documents and settings\Romano\Application Data\drivers
2009-11-12 13:07 . 2009-11-14 00:05 -------- d-----w- C:\FindyKill
2009-11-12 12:43 . 2009-03-07 20:23 30136 ----a-w- c:\windows\system32\drivers\rspSanity32.sys
2009-11-12 12:43 . 2009-11-12 12:43 -------- d-----w- c:\program files\SanityCheck
2009-11-12 12:42 . 2009-11-12 12:42 -------- d-----w- c:\documents and settings\Romano\Application Data\Malwarebytes
2009-11-12 12:42 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-12 12:42 . 2009-11-12 12:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-12 12:42 . 2009-11-12 12:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-12 12:42 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-12 11:39 . 2009-11-12 13:06 -------- d-----w- c:\program files\FindyKill
2009-11-12 11:09 . 2009-11-12 11:09 -------- d-----w- C:\rsit
2009-11-12 11:09 . 2009-11-12 11:09 -------- d-----w- c:\program files\trend micro
2009-11-12 09:01 . 2009-11-12 10:37 -------- d-----w- c:\windows\BDOSCAN8
2009-11-12 08:57 . 2009-11-12 11:47 -------- d-----w- C:\SDFix
2009-11-12 08:40 . 2009-11-12 08:40 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\Help
2009-11-12 08:40 . 2009-11-12 08:40 -------- d-----w- c:\documents and settings\Romano\Application Data\Jasc
2009-11-12 08:39 . 2009-11-12 08:40 -------- d-----w- c:\program files\Jasc Software Inc
2009-11-10 07:46 . 2009-11-10 07:46 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-10 07:46 . 2009-11-10 07:46 152576 ----a-w- c:\documents and settings\Romano\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-09 22:46 . 2009-11-09 22:48 -------- d-----w- c:\program files\Microsoft Expression
2009-11-09 22:38 . 2009-11-09 22:38 -------- d-----w- c:\program files\Common Files
2009-11-09 22:38 . 2009-11-09 22:38 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-11-09 22:33 . 2009-11-10 08:00 -------- d-----w- c:\program files\VS Revo Group
2009-11-09 19:43 . 2009-11-09 19:43 -------- d-----w- c:\documents and settings\Romano\Application Data\ExtraFilm
2009-11-09 19:42 . 2009-11-09 19:42 -------- d-----w- c:\documents and settings\All Users\Application Data\ExtraFilm
2009-11-09 19:41 . 2009-11-09 19:42 -------- d-----w- c:\program files\ExtraFilm Designer BE FR
2009-11-08 13:31 . 2009-11-08 13:31 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\ArcSoft
2009-11-08 13:30 . 2009-11-08 13:30 -------- d-----w- c:\documents and settings\Romano\Application Data\ArcSoft
2009-11-08 13:29 . 2005-04-27 15:36 245408 ----a-w- c:\windows\system32\unicows.dll
2009-11-08 13:29 . 2005-02-23 13:58 11776 ----a-w- c:\windows\system32\drivers\afc.sys
2009-11-08 13:29 . 2009-11-08 13:30 -------- d-----w- c:\program files\Fichiers communs\ArcSoft
2009-11-08 13:29 . 2007-03-07 15:05 126976 ----a-w- c:\windows\system32\MediaImpression Slideshow.scr
2009-11-08 13:29 . 2009-11-08 13:29 -------- d-----w- c:\windows\system32\MediaImpression Slideshow
2009-11-08 13:29 . 2009-11-08 13:29 -------- d-----w- c:\program files\ArcSoft
2009-11-08 11:45 . 2009-11-08 11:45 -------- d-----w- c:\documents and settings\Romano\Application Data\Apple Computer
2009-11-08 11:39 . 2009-11-08 11:39 -------- d-----w- c:\program files\QuickTime
2009-11-08 11:39 . 2009-11-08 11:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-08 11:39 . 2009-11-08 11:39 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-11-08 11:39 . 2009-11-08 11:39 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\Apple
2009-11-08 11:39 . 2009-11-08 11:39 -------- d-----w- c:\program files\Apple Software Update
2009-11-08 11:39 . 2009-11-08 11:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-11-08 11:38 . 2009-11-08 11:38 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\Apple Computer
2009-11-08 11:21 . 2009-11-08 11:21 -------- d-----w- c:\documents and settings\Romano\Application Data\Media Player Classic
2009-11-05 11:24 . 2009-11-05 11:24 -------- d-----w- c:\windows\system32\NtmsData
2009-11-05 11:15 . 2009-11-05 11:15 -------- d-----w- c:\windows\system32\LogFiles
2009-11-04 10:16 . 2009-11-04 10:16 -------- d-----w- c:\program files\Fichiers communs\SWF Studio
2009-11-02 08:37 . 2009-11-02 08:37 1925024 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2009-11-01 22:30 . 2009-11-01 22:30 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG
2009-11-01 22:28 . 2009-11-01 22:28 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\HP
2009-11-01 22:28 . 2009-11-01 22:39 -------- d-----w- c:\documents and settings\Romano\Application Data\HP
2009-11-01 22:21 . 2008-06-06 19:49 118272 ----a-w- c:\windows\system32\hpz3l692.dll
2009-11-01 22:21 . 2008-04-08 05:39 271704 ----a-r- c:\windows\system32\hpzids01.dll
2009-11-01 22:20 . 2008-04-16 04:05 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2009-11-01 22:20 . 2008-04-16 04:05 309760 ----a-r- c:\windows\system32\difxapi.dll
2009-11-01 22:20 . 2008-04-08 05:39 974848 ----a-r- c:\windows\system32\hpost_p01d.dll
2009-11-01 22:20 . 2008-04-08 05:39 729088 ----a-r- c:\windows\system32\hposwia_p01d.dll
2009-11-01 22:20 . 2008-02-28 10:08 303104 ----a-r- c:\windows\system32\hposc_p01a.dll
2009-11-01 22:15 . 2009-11-01 22:16 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-11-01 22:15 . 2009-11-01 22:15 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-11-01 22:14 . 2009-11-04 10:24 -------- d-----w- c:\program files\Hewlett-Packard
2009-11-01 22:14 . 2009-11-01 22:14 -------- d-----w- c:\program files\Fichiers communs\HP
2009-11-01 22:12 . 2008-04-13 10:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-11-01 22:12 . 2008-04-13 10:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-11-01 22:09 . 2009-11-14 10:19 188802 ----a-w- c:\windows\hpoins31.dat
2009-11-01 22:09 . 2008-06-17 09:23 1691 ------w- c:\windows\hpomdl31.dat
2009-10-29 23:01 . 2009-11-09 23:05 2709288 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-29 22:19 . 2009-10-29 22:19 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-29 22:19 . 2009-10-29 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2009-10-29 22:19 . 2009-11-15 10:19 -------- d-----w- c:\documents and settings\Romano\Application Data\Azureus
2009-10-29 22:19 . 2009-10-29 22:19 -------- d-----w- c:\program files\Vuze
2009-10-29 21:56 . 2009-11-02 10:12 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-29 21:50 . 2009-10-29 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\ALM
2009-10-29 21:41 . 2009-10-29 21:41 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared
2009-10-29 21:08 . 2009-11-13 08:37 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\Corel
2009-10-29 21:01 . 2009-11-13 08:37 2828 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-10-29 21:01 . 2009-10-29 21:01 8 --sh--r- c:\documents and settings\All Users\Application Data\AE4186BFB7.sys
2009-10-29 21:00 . 2009-10-29 21:01 -------- d-----w- c:\documents and settings\Romano\Application Data\Corel
2009-10-29 20:58 . 2009-10-29 21:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Corel
2009-10-29 20:58 . 2009-10-29 20:59 -------- d-----w- c:\program files\Fichiers communs\Corel
2009-10-29 20:58 . 2009-10-29 20:58 -------- d-----w- c:\program files\Fichiers communs\Protexis
2009-10-29 20:56 . 2009-10-29 20:58 -------- d-----w- c:\program files\Corel
2009-10-29 20:47 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-10-29 20:37 . 2009-10-29 20:37 -------- d-----w- c:\program files\MSECache
2009-10-29 15:49 . 2009-10-29 15:49 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-10-29 14:11 . 2008-04-13 10:45 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-10-29 13:44 . 2009-10-29 13:44 -------- d-----w- c:\documents and settings\Romano\Local Settings\Application Data\Downloaded Installations
2009-10-29 13:23 . 2009-11-12 16:19 -------- d-----w- c:\documents and settings\Romano\Application Data\FileZilla
2009-10-29 13:22 . 2009-11-09 14:30 -------- d-----w- c:\program files\FileZilla FTP Client
2009-10-29 13:07 . 2009-11-02 08:47 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-10-29 13:07 . 2009-10-29 13:07 405504 ----a-r- c:\documents and settings\Romano\Application Data\Microsoft\Installer\{8A8BF0AF-068E-4599-ABB2-39AEA2C43619}\NewShortcut11_3B22D4BCB10947C4BF71D92AB7CF5B8D.exe
2009-10-29 13:07 . 2009-10-29 13:07 405504 ----a-r- c:\documents and settings\Romano\Application Data\Microsoft\Installer\{8A8BF0AF-068E-4599-ABB2-39AEA2C43619}\NewShortcut1_D15A914C0E0C4E2E86A0CE7B7ECB03F5.exe
2009-10-29 13:07 . 2009-10-29 13:07 405504 ----a-r- c:\documents and settings\Romano\Application Data\Microsoft\Installer\{8A8BF0AF-068E-4599-ABB2-39AEA2C43619}\ARPPRODUCTICON.exe
2009-10-29 13:07 . 2009-10-29 13:45 -------- d-----w- c:\program files\Oxemis
2009-10-29 13:07 . 2009-10-29 13:07 -------- d-----w- c:\documents and settings\Romano\Application Data\Oxemis
2009-10-29 10:34 . 2009-10-29 10:34 -------- d-----w- c:\documents and settings\Romano\Application Data\GOTO Software
2009-10-29 10:34 . 2009-10-29 10:34 -------- d-----w- c:\program files\Goto software
2009-10-29 09:55 . 2009-10-29 09:55 -------- d-----w- c:\program files\Fichiers communs\Hewlett-Packard
2009-10-29 09:54 . 2004-12-16 01:24 139345 ----a-w- c:\windows\system32\hpzlnt12.dll
2009-10-29 09:54 . 2001-08-23 16:20 6912 -c--a-w- c:\windows\system32\dllcache\serscan.sys
2009-10-29 09:54 . 2001-08-23 16:20 6912 ----a-w- c:\windows\system32\drivers\serscan.sys
2009-10-29 09:54 . 2004-09-09 18:46 28672 ----a-w- c:\windows\system32\hpzjfw01.dll
2009-10-29 09:54 . 2004-09-08 23:06 98304 ----a-w- c:\windows\system32\hpzjsn01.dll
2009-10-29 09:53 . 2009-10-29 09:55 -------- d-----w- C:\TEMP
2009-10-29 09:53 . 2004-09-29 11:14 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2009-10-29 09:53 . 2004-09-29 11:08 61440 ----a-w- c:\windows\system32\HPZinw12.exe
2009-10-29 09:53 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2009-10-29 09:53 . 2009-11-12 14:22 -------- d-----w- c:\program files\HP
2009-10-29 09:51 . 2009-10-29 09:51 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-10-29 09:51 . 2009-10-29 09:51 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-10-28 12:50 . 2009-10-29 09:55 68964 ----a-w- c:\windows\hpoins05.dat
2009-10-28 12:50 . 2004-12-16 01:24 19696 ------w- c:\windows\hpomdl05.dat
2009-10-28 12:50 . 2004-12-16 01:24 581632 ----a-w- c:\windows\system32\hpotscl.dll
2009-10-28 12:50 . 2004-12-16 01:24 278528 ----a-w- c:\windows\system32\hpgwiamd.dll
2009-10-28 12:50 . 2004-12-16 01:24 229376 ----a-w- c:\windows\system32\hpovst08.dll
2009-10-28 12:50 . 2004-12-16 01:24 196608 ----a-w- c:\windows\system32\hpzcoi12.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-16 07:46 . 2008-07-16 11:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-10 07:46 . 2008-07-16 11:12 -------- d-----w- c:\program files\Java
2009-11-09 22:43 . 2008-07-16 10:35 102120 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-08 13:29 . 2008-07-16 11:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-05 11:15 . 2008-07-16 10:21 86272 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-05 11:15 . 2008-07-16 10:21 513284 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-29 21:54 . 2008-07-16 11:49 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-10-28 01:19 . 2008-07-16 10:29 -------- d-----w- c:\program files\Services en ligne
2009-10-28 01:19 . 2008-07-16 10:30 -------- d-----w- c:\program files\microsoft frontpage
2009-10-28 01:18 . 2008-07-16 11:12 -------- d-----w- c:\program files\Intel
2009-10-28 01:18 . 2008-07-16 11:26 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-10-28 01:18 . 2008-07-16 11:12 -------- d-----w- c:\program files\Fichiers communs\Java
2009-10-28 01:18 . 2008-07-16 11:24 -------- d-----w- c:\program files\CONEXANT
2009-10-28 01:16 . 2009-10-27 16:31 -------- d-----w- c:\documents and settings\Romano\Application Data\toshiba
2009-10-28 01:16 . 2008-07-16 11:31 -------- d-----w- c:\documents and settings\Administrateur\Application Data\toshiba
2009-10-28 01:16 . 2008-07-16 11:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SBSI
2009-10-28 01:16 . 2009-10-27 16:31 -------- d-----w- c:\documents and settings\Romano\Application Data\TMP
2009-10-28 01:16 . 2008-07-16 11:26 -------- d-----w- c:\documents and settings\Administrateur\Application Data\TMP
2009-10-28 01:16 . 2009-10-27 16:31 -------- d-----w- c:\documents and settings\Romano\Application Data\InstallShield
2009-10-28 01:16 . 2008-07-16 11:27 -------- d-----w- c:\documents and settings\Administrateur\Application Data\InstallShield
2009-10-27 17:31 . 2009-10-27 16:31 129 ----a-w- c:\documents and settings\Romano\Local Settings\Application Data\fusioncache.dat
2009-10-27 16:33 . 2008-07-16 11:28 -------- d-----w- c:\program files\Toshiba
2009-10-27 16:31 . 2009-10-27 16:31 -------- d-----w- c:\program files\Apoint2K
2009-10-27 16:31 . 2009-10-27 16:31 0 --sha-r- c:\windows\system32\drivers\TOSHIBA_Satellite Pro P300_07815-BT_PSPCDE-01800.MRK
2009-09-25 05:36 . 2009-09-25 05:36 81920 ------w- c:\windows\system32\ieencode.dll
2009-09-11 14:18 . 2008-07-16 10:21 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2008-07-16 10:21 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2008-07-16 10:21 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2008-07-16 10:21 247326 ----a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-08-13 774144]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2008-05-09 1773568]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"Toshiba Controls Utility"="c:\program files\TOSHIBA\Controls\VolumeIndicator.exe" [2008-02-01 77824]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-18 16712]
"AdobeCS4ServiceManager"="c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-10-11 31232]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"NDSTray.exe"="NDSTray.exe" [BU]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-08-03 266240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\Goto software\\Sarbacane 3\\Sarbacane 3.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"427:UDP"= 427:UDP:SLP_Port(427)
"9100:UDP"= 9100:UDP:UDP 427
"34893:TCP"= 34893:TCP:emule

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/11/2009 1:11 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/11/2009 1:11 20560]
R2 EFUploadSrv;ExtraFilm upload service;c:\program files\ExtraFilm Designer BE FR\EFUploadSrv.exe [9/07/2009 13:27 1716224]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26/03/2007 11:22 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19/02/2007 11:15 134016]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDAud.sys [16/07/2008 11:45 732160]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [16/07/2008 12:27 51160]
R3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys [29/05/2007 9:01 6912]
S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [12/11/2009 13:43 30136]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2009-10-27 c:\windows\Tasks\Rappel d'enregistrement 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-07-16 12:00]

2009-11-16 c:\windows\Tasks\User_Feed_Synchronization-{B0DE7534-2EA2-4C44-8F78-24439B72E602}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.be/intl/fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\Romano\Application Data\Mozilla\Firefox\Profiles\kix0put9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/intl/fr/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-16 09:03
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(952)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-11-16 09:04
ComboFix-quarantined-files.txt 2009-11-16 08:04

Avant-CF: 287.221.313.536 octets libres
Après-CF: 287.205.810.176 octets libres

- - End Of File - - 305EEC56553E23EC305C156227E5036E