Virus Win32: trojan-gen

Merci Xplode, c'est cool .

voila le rapport :

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_D | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 21.11.2009 à 10:05
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 11:41:59, 21/11/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: SACHA_LSD | Utilisateur actuel: Administrateur
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\jmzgulko.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\DOCUME~1\ADMINI~1\APPLIC~1\Search Settings
C:\Program Files\AskBarDis
C:\Program Files\pdfforge Toolbar
C:\Windows\Installer\1459b8d.msi
C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
C:\WINDOWS\Prefetch\CSRSS.EXE-12B63473.pf
C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pf
C:\WINDOWS\Prefetch\DEVCON.EXE-3189D4D7.pf
C:\WINDOWS\Prefetch\DPSFNSHR.EXE-1C8143D1.pf
C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf
C:\WINDOWS\Prefetch\IE4UINIT.EXE-169A5A39.pf
C:\WINDOWS\Prefetch\IEUDINIT.EXE-054FE003.pf
C:\WINDOWS\Prefetch\LSASS.EXE-20DB6D1B.pf
C:\WINDOWS\Prefetch\MSCORSVW.EXE-1BF30400.pf
C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf
C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-286A7F8C.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-3BF7D301.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4655BFAF.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-49F747DB.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4A9161EE.pf
C:\WINDOWS\Prefetch\SERVICES.EXE-2F433351.pf
C:\WINDOWS\Prefetch\SETUP50.EXE-362FF7C9.pf
C:\WINDOWS\Prefetch\SHMGRATE.EXE-1BA69E68.pf
C:\WINDOWS\Prefetch\SPOOLSV.EXE-282F76A7.pf
C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf
C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pf
C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@1001cocktails[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@123people[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@213.8.137[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@247realmedia[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@33across[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@404.hosteur[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@62.128.151[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@a.cca10[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@a.mininova[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@a2dfp[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@a6.adserver01[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@abmr[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@accorhotels[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@account.neogen[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@accounts.pkr[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ad.caradisiac[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ad.proxad[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ad.yieldmanager[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ad.zanox[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ad1-g15.proxad[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adbrite[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adcast.deviantart[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adlink[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adnext[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adnxs[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adopteunmec[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adrevolver[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adriver[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ads-dev.youporn[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ads.movember[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ads.networldmedia[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ads.rtl[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ads.urbae[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ads1.adopteunmec[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adserver.aol[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adtech[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adultfriendfinder[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@advertising[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@advertstream[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@adviva[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@affinitiz[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@afy11[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@aide-creation-entreprise[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@aimfar.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@alenty[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@allposters[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@alsacreations[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@amgdgt[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@answers.yahoo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@apicit[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@apmebf[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@apps.facebook[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@at.atwola[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@atdmt[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@atraxio[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@atylia[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@aufeminin[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@avast[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@banquepopulaire.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@beautifulthaibride[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@begun[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bidsystem[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bing[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bizrate[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@blackcabsessions[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@blogger[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bluekai[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bluestreak[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bookfoto[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@book[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@boursoramabanque.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bouyguestelecom.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@brises[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bs.serving-sys[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@bs.viamichelin[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@c.live[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@c.msn[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@calameo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@canal-plus[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@canal.profils[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@canalplus[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cas.criteo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cbanque[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cdn5.specificclick[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cetelem.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@chitika[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@clairecocano[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@clubic[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cnam.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cnet[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@commentcamarche[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@com[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@content.yieldmanager[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@content.yieldmanager[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@courrierinternational[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cours-photophiles[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@credit-immobilier.meilleurtaux[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@creditmutuel[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@criteo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@crwdcntrl[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cuzoogle[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@cybermonitor[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@d2.advertserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@dailymotion[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@data.cmcore[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@deeb.opt.fimserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@deezer[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@dehp.opt.fimserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@delb.opt.fimserve[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@dellinc.tt.omtrdc[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@dell[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@demr.opt.fimserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@desb.opt.fimserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@desk.opt.fimserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@deviantart[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@diams-lesite[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@doctissimo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@doubleclick[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@download.cnet[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@droit-finances.commentcamarche[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@dynamic.media.adrevolver[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@earth.google[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@eas.apm.emediate[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@edt02[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@en.calameo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@en.mappy[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@en.mappy[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@en.mappy[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@en.mappy[5].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@esearchvision[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@espace.netavenir[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@estat[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@etology[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@etudes-litteraires[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@eurockeennes[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@europages[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@eyrolles[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@facebook[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fastclick[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fbeq.rockyou[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@feedjit[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@festival.eurockeennes[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ff-handball[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fimserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@flashtalking[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@flickr[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@football365[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fortuneopub.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@forum-auto[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@forum.aufeminin[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@forum.hardware[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@forum.photo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@forum.wawa-mania[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr-secure.oboulo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.a2dfp[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.at.atwola[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.decathlon[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.news.yahoo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.sitestat[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.sitestat[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.sitestat[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.sitestat[4].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fr.yahoo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@free.antivirus[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@free[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ftv-publicite[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@fulltiltpoker[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@gemey2009.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@generation-nt[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@gigya[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@global.nrj[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@google[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@google[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@google[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@google[4].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@groupe.meilleurtaux[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@h.msn[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@hackconsoles[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@hettange.grande.free[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@hiboox[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@hijackthis[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@hotmail.msn[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ia.mininova[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ikea[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@imrworldwide[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@infolinks[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@infos-du-net[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@integra[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@intellitxt[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@interflora2.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@jedessine[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@jrphotographie[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@justthailadies[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lamaisondevalerie[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@leblogdeco[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@leblogtvnews[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@leboncoin[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lefigaro[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@legratuit[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lemonde[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lentreprise[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lepays[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lepoint[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@leroymerlin[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lesiteimmo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lesite[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lfp[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lfstmedia[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lightcubepro[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@listal[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@live.football365[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@livecad[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@live[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@live[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@login.live[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@lycos[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@m-boost[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@m6publicite.individuad[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ma-tvideo.france3[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mail.live[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mail.yahoo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mappy[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@marianne2[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@media.adrevolver[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@media6degrees[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mediaplex[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@meetic-partners[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@megaupload[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@megavideo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@meilleurtaux[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@messaging.myspace[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@messenger.msn[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@metaffiliation[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@meteo-paris[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@metriweb[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@metrixlablw.customers.luna[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mininova[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@movember[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@msnportal.112.2o7[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@msn[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mybloglog[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mypix[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@myspace[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@mythings[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@nathan[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@nb.myspace[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@neodatagroup[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@neogen[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@nestlewaters.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@netavenir[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@network.platform-a[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@nibal.spartoo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@novotel[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@nuggad[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@nxtck[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@oboulo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@onlinestores.metaservices.microsoft[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@opt.fimserve[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@orlovi[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@overture[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@panoramio[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@pc-infopratique[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@peach.bskyb[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@photo-libre[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@photo-scope[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@photoamateur[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@photographie[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@photostation[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@picto[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@pixmania[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@portail-patrimoine[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@portail.free[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@presence-pc[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@prixmoinscher[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@profile.myspace[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@programme-tv[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@pub.groupe-ldlc[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@pub.sosordi[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@pubmatic[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@quantserve[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@questionmarket[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@qype[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rad.msn[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rambler[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@redcatsusa[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@redtube[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@req.connect.wunderloop[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@reussissonsensemble[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@revsci[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@richmedia.yahoo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rockyou[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rockyou[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rtlinfo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rubiconproject[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rue89[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rutube[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@rya.rockyou[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@scooter-system[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@scorecardresearch[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@sdv[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@securestudies[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@seloger.122.2o7[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@seloger[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@serbia-photo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@serve.socialcash[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@server.iad.liveperson[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@server.iad.liveperson[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@serving-sys[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@shopoon[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@sketchup.google[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@skyregie[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@slide[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@smart.allocine[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@smart2.allocine[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@smartadserver[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@snap[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@social.bidsystem[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@socialreach[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@softmks[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@sosordi[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@sourceforge[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@spartoo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@specificclick[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@sport24[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@stats.searchtrack[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@statse.webtrendslive[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@stephaniedurbic[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@sur-la-toile[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@t.bbtrack[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tacoda[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tag.admeld[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tap.rubiconproject[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@techfluencers-media[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tesial-tech[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@test-eurocks.typhon[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tf1[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@thehackademy[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tns-counter[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@toppeo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@torrenthound[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@torrentzap[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@track.effiliation[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@track.effiliation[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@track.w3counter[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tracking.lsfinteractive[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tracking.publicidees[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tradedoubler[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@translate.google[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tribalfusion[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tumblr[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tutoriauxphotoshop[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@tvnews.over-blog[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ubi[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@unicef[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@up.sur-la-toile[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@videos.football[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@videos.tf1[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@viewmorepics.myspace[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@vimeo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@virginmobile.solution.weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@virusphoto[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@vitamine.networldmedia[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@vulgarisation-informatique[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@vuze[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@weborama[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@windowsmarketplace[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@winlsd[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@wordpress[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ws6.docteurlove[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@wunderloop[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@ww57.smartadserver[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.123people[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.123people[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.adopteunmec[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.adopteunmec[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.basedix[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.bookfoto[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.book[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.canalplus[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.clubic[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.creditmutuel[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.dailymotion[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.deezer[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.dispnews[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.erick.book[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.eurockeennes[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.flexiweb[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.football365[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.franchecomte-enligne.credit-agricole[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.generation-nt[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.googleadservices[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.googleadservices[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.googleadservices[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.googleadservices[4].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.hiboox[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.infos-du-net[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.justthailadies[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.kiosque3d[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.laredoute[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.leboncoin[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.lepays[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.leroymerlin[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.lesite[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.lightcubepro[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.mairie-belfort[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.mgen[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.mypix[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.myspace[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.nathan[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.neogen[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.neogen[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.onestopdownloads[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.orlovi[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.photographie[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.photostation[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.phox[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.pixmania[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.presence-pc[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.priceminister[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.programme-tv[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.prostudiofrance[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.qype[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.radioecn[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.rtlinfo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.rue89[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.scooter-system[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.sharkscope[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.smartadserver[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.spartoo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.sport24[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.sur-la-toile[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.toppeo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.torrentzap[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.trendsecure[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.tumblr[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.tvnews.over-blog[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.veoxa[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.virusphoto[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www.vuze[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www3.smartadserver[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@www6.addfreestats[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@wysistat[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@wysistat[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@wysistat[3].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@wysistat[4].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@xiti[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@yadro[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@yahoo[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@youporn[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@youtube[2].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@zanox[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@zedo[1].txt
C:\DOCUME~1\ADMINI~1\Cookies\administrateur@zune[2].txt
.
HKCU\software\appdatalow\AskBarDis
HKCU\software\appdatalow\software\pdfforge
HKCU\software\AskBarDis
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
HKCU\software\pdfforge
HKCU\software\Search Settings
HKLM\software\appdatalow\AskBarDis
HKLM\software\AskBarDis
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\76DA9915C36F3D742951F63351CF5C97
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9B0B0584E80456A4FB98DA3973B1EB3F
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A89F1E0FE544529429C8BF82FE74CE39
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\C9667115F6A9CE340B31B63B680FF26F
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EFB70E89C3D6D354596520DE424F89D6
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F49A213B5069AC348994D03F81B56C19
HKLM\software\pdfforge
HKLM\software\Search Settings

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.3 [fr] *
.
Nom du profil: jmzgulko.default (Administrateur)
.
(ADMINI~1, prefs.js) Browser.startup.homepage, hxxp://www.winlsd.org
.
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\Administrateur\Application Data\HouseCall 6.6\patch.exe
C:\Documents and Settings\Administrateur\Application Data\pdfforge\sspatch2.exe
C:\Documents and Settings\Administrateur\Favoris\theserials.com Adobe Dreamweaver CS4 10.0 Build 4117 serial number.url
.
===================================
.
34513 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
9 Fichier(s) - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
2 Fichier(s) - C:\WINDOWS\Temp
.
18 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
547 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 11:45:53 | 21/11/2009 - CLEAN[1]
.
============== E.O.F ==============
.

voila c'est fait ,

le fichier est ici :

http://www.cijoint.fr/cjlink.php?file=cj200911/cijq40qCsJ.txt

voila le rapport :


-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5850 @ 2.16GHz )
BIOS : Default System BIOS
USER : Administrateur ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:73 Go (Free:52 Go)
D:\ (Local Disk) - NTFS - Total:195 Go (Free:96 Go)
E:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 21/11/2009|12:37 )

-----------\\ Recherche de Fichiers / Dossiers ...

[Service] ASKService
[Service] ASKUpgrade

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_page_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr"
"Search bar"="http://www.bing.com/spresults.aspx"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 21/11/2009|12:38 - Option : [1]

-----------\\ Fin du rapport a 12:38:14,89

voila le rapport :


[b]SDFix: Version 1.240 [/b]
Run by Administrateur on 21/11/2009 at 13:30

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing Security Center Service

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\i - Deleted





Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-21 13:35:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\WINDOWS\\system32\\lxddcoms.exe"="C:\\WINDOWS\\system32\\lxddcoms.exe:*:Enabled:2500 Series Server"
"C:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"="C:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"="C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe:*:Enabled: "
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe:*:Enabled: "
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe:*:Enabled: "
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe:*:Enabled: "
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddwbgw.exe"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddwbgw.exe:*:Enabled: "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Lexmark 2500 Series\\app4r.exe"="C:\\Program Files\\Lexmark 2500 Series\\App4R.exe:*:Enabled:Printing Application"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Thu 5 Mar 2009 2,260,480 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._Appearance Pak.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._Internet Encodings.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPictureRotatePlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSIconPlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSIconPlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSJPEGCompressionPlugin15862.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSJPEGDecompressionPlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSJPEGCompressionPlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSJPEGDecompressionPlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSMacOSXPlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPicturePlugin15862.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPictureRotatePlugin15862.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPictureScalePlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPictureBlendPlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPNGPlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPNGPlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSProcessPlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSProcessPlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSRegistrationPlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSRegistrationPlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSResolutionPluginPlugin15935.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSWindowPlugin15862.dll"
Mon 5 Jan 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSWinPlugin15862.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSWindowPlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSWinPlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPicturePlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPictureScalePlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._MBSPictureConvolutionPlugin15935.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._Shell.dll"
Mon 1 Jun 2009 4,096 A..H. --- "C:\Program Files\Poladroid\Poladroid Libs\._XML.dll"

[b]Finished![/b]

plus long ce scan :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3206
Windows 5.1.2600 Service Pack 3

21/11/2009 15:09:09
mbam-log-2009-11-21 (15-09-09).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 219887
Temps écoulé: 1 hour(s), 23 minute(s), 1 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\msrsys (Backdoor.IRCBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Network\msrsys (Backdoor.IRCBot) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\E58IYC33\aba[1] (Worm.Kolab) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\34.scr (Worm.Kolab) -> Delete on reboot.

http://www.cijoint.fr/cjlink.php?file=cj200911/cijgENoDea.txt

ZHPFix v1.12.19 by Nicolas Coolman - Rapport de suppression du 21/11/2009 15:31:09
Fichier d'export Registre : C:\ZHPExportRegistry-21-11-2009-15-31-09.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
O40 - ASIC: Rendu VML (Vector Graphics Rendering) - {21C7FE7C-D971-4B03-F288-977463A0DBCA} - (not file) => Clé supprimée avec succès
O40 - ASIC: Outlook Express - {DFE7EC15-1398-2E68-8E56-187AABB2C038} - (not file) => Clé supprimée avec succès
O64 - Services: CurCS - Play Port I/O Driver (sysdrv32) - LEGACY_SYSDRV32 => Clé supprimée avec succès
O64 - Services: CS002 - Play Port I/O Driver (sysdrv32) - LEGACY_SYSDRV32 => Clé supprimée avec succès

Valeur du Registre :
O56 - MWPE:[HKCU\...\Policies\Explorer] - "ClearRecentDocsOnExit"=64 => Valeur supprimée avec succès

Elément de données du Registre :
(Néant)

Dossier :
(Néant)

Fichier :
c:\windows\logfile32.txt => Supprimé et mis en quarantaine

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 4
Valeur du Registre : 1
Elément de données du Registre : 0
Dossier : 0
Fichier : 1
Logiciel : 0
Autre : 0


End of the scan

================================================================

ben pour l'instant , j'ai plus aucune alerte de l'antivirus .
ca m'a l'air bien !

ok c est fait.
voila le rapport :

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5850 @ 2.16GHz )
BIOS : Default System BIOS
USER : Administrateur ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:73 Go (Free:52 Go)
D:\ (Local Disk) - NTFS - Total:195 Go (Free:96 Go)
E:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 21/11/2009|13:12 )

-----------\\ SUPPRESSION

Supprime! - [Service] ASKService
Supprime! - [Service] ASKUpgrade

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_page_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search bar"="http://go.microsoft.com/fwlink/?linkid=54896"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"
"Search bar"="http://www.bing.com/spresults.aspx"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 21/11/2009|12:38 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 21/11/2009|13:12 - Option : [2]

-----------\\ Fin du rapport a 13:12:40,79

info.txt logfile of random's system information tool 1.06 2009-11-21 15:37:01

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe AIR-->C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe Dreamweaver CS4-->C:\Program Files\Fichiers communs\Adobe\Installers\acce07fd2c8fe7f9e3f26243e626578\Setup.exe --uninstall=1
Adobe Dreamweaver CS4-->MsiExec.exe /I{30C8AA56-4088-426F-91D1-0EDFD3A25678}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x40c
Adobe Premiere Pro-->RunDll32 "C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{084709F7-38C5-4609-B55F-2417939315EB}\setup.exe"
Adobe Reader 9.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{14AFE241-FC6E-4FDB-BCA0-7AD6F4974171}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
Ad-Remover By C_XX-->"C:\Program Files\Ad-Remover\Uninstall ADR.exe"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
Atheros Client Installation Program-->C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe -runfromtemp -l0x040c -removeonly
ATK Hotkey-->MsiExec.exe /I{7C05592D-424B-46CB-B505-E0013E8E75C9}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
Delivery-->"C:\Program Files\Delivery\uninst.exe"
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
ffdshow [rev 1703] [2007-12-15]-->"C:\Program Files\ffdshow\unins000.exe"
FileZilla Client 3.2.4.1-->C:\Program Files\FileZilla FTP Client\uninstall.exe
Full Tilt Poker-->C:\Program Files\Full Tilt Poker\uninstall.exe
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HouseCall 6.6-->"C:\Documents and Settings\Administrateur\Application Data\HouseCall 6.6\uninstaller.exe"
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
JPEG Recovery Pro 4.0-->C:\PROGRA~1\JPEGRE~1\UNWISE.EXE C:\WINDOWS\system32\jpegrecoverypro40.log
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Lexmark 2500 Series-->C:\Program Files\Lexmark 2500 Series\Install\x86\Uninst.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaCoder 0.7.0.4385-->C:\Program Files\MediaCoder\uninst.exe
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0122-040C-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Notepad++-->C:\Program Files\Notepad++\uninstall.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
PC Inspector File Recovery-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}\Setup.exe" -l0x40c
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
pdfforge Toolbar v1.0-->MsiExec.exe /X{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
PKR-->"C:\Program Files\PKR\uninstall-pkr.exe"
Poladroid-->MsiExec.exe /X{E8FF78D0-4D1C-4B2D-AC80-670F135F5461}
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -l0x040c -removeonly
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Program Files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -l0x40c anything
Security Update pour Microsoft .NET Framework 2.0 (KB928365)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VideoCam Suite 1.0-->C:\Program Files\InstallShield Installation Information\{9EDF1A5D-D8E0-413E-9782-75DD4A8C831B}\setup.exe -runfromtemp -l0x040c -removeonly
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vuze Toolbar-->"C:\Program Files\AskBarDis\unins000.exe"
Vuze-->C:\Program Files\Vuze\uninstall.exe
WampServer 2.0-->"c:\wamp\unins000.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
ZHPDiag 1.24-->"C:\Program Files\ZHPDiag\unins000.exe"

======Hosts File======

127.0.0.1 localhost

Securitycenter WMI appears to be broken

======System event log======

Computer Name: SACHA_LSD
Event Code: 26
Message: Application popup :  : \SystemRoot\System32\ATMFD.DLL failed to load

Record Number: 9587
Source Name: Application Popup
Time Written: 20090930183209.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 7036
Message: Le service Google Software Updater est entré dans l'état : arrêté.

Record Number: 9586
Source Name: Service Control Manager
Time Written: 20090930181717.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 7036
Message: Le service Service Google Update (gupdate1ca2597b12086ce) est entré dans l'état : arrêté.

Record Number: 9585
Source Name: Service Control Manager
Time Written: 20090930181717.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 7036
Message: Le service Explorateur d'ordinateur est entré dans l'état : en cours d'exécution.

Record Number: 9584
Source Name: Service Control Manager
Time Written: 20090930181717.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Explorateur d'ordinateur.

Record Number: 9583
Source Name: Service Control Manager
Time Written: 20090930181717.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: SACHA_LSD
Event Code: 701
Message: msnmsgr (7964) La défragmentation en ligne a terminé un passage complet dans la base de données '\\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\zsacha90@hotmail.com\SharingMetadata\Working\database_7228_152E_2814_F339\dfsr.db'.

Record Number: 1744
Source Name: ESENT
Time Written: 20090712130007.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 700
Message: msnmsgr (7964) La défragmentation en ligne commence un passage complet dans la base de données '\\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\zsacha90@hotmail.com\SharingMetadata\Working\database_7228_152E_2814_F339\dfsr.db'.

Record Number: 1743
Source Name: ESENT
Time Written: 20090712130007.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 701
Message: msnmsgr (7964) La défragmentation en ligne a terminé un passage complet dans la base de données '\\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\zsacha90@hotmail.com\SharingMetadata\Working\database_7228_152E_2814_F339\dfsr.db'.

Record Number: 1742
Source Name: ESENT
Time Written: 20090712120007.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 700
Message: msnmsgr (7964) La défragmentation en ligne commence un passage complet dans la base de données '\\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\zsacha90@hotmail.com\SharingMetadata\Working\database_7228_152E_2814_F339\dfsr.db'.

Record Number: 1741
Source Name: ESENT
Time Written: 20090712120007.000000+120
Event Type: Informations
User:

Computer Name: SACHA_LSD
Event Code: 701
Message: msnmsgr (7964) La défragmentation en ligne a terminé un passage complet dans la base de données '\\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\zsacha90@hotmail.com\SharingMetadata\Working\database_7228_152E_2814_F339\dfsr.db'.

Record Number: 1740
Source Name: ESENT
Time Written: 20090712110007.000000+120
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;%PIXIEHOME%\bin
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"DEVMGR_SHOW_DETAILS"=1
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip
"SHADERS"=%PIXIEHOME%\shaders

-----------------EOF-----------------







Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-11-21 15:36:57
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 54 GB (72%) free of 75 GB
Total RAM: 3071 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:37:00, on 21/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Windows\LSD\LClock\lclock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ZHPDiag\ZHPDiag.exe
C:\Program Files\ZHPDiag\ZHPFix.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://melanthios-ana.com/zcvisitor/1624d318-3614-11eb-87b9-12a1ab6c324d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=47f83760-f118-11ea-9bc8-0ac2bbf4ada7
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsgTranAgt] C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Windows\LSD\LClock\lclock.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service Google Update (gupdate1ca2597b12086ce) (gupdate1ca2597b12086ce) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.32\bin\mysqld.exe

Ok c'est cool !

c'est toi qui sais ...

Re .

voila le rapport :

All processes killed
Error: Unable to interpret <reg: > in the current context!
Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\netmon] > in the current context!
Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netmon] > in the current context!
Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lsass] > in the current context!
Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\msrsys] > in the current context!
Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\lsass] > in the current context!
Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\msrsys] > in the current context!
Error: Unable to interpret <files: > in the current context!
Error: Unable to interpret <C:\*.txt > in the current context!
Error: Unable to interpret <commands: > in the current context!
Error: Unable to interpret <[emptytemp] > in the current context!
Error: Unable to interpret <[reboot] > in the current context!

OTM by OldTimer - Version 3.1.2.0 log created on 11222009_003759


========================================================

je vais supprimer les 4 programmes, ils ne me servent pas .

voila le rapport :

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBo­ot\Minimal\netmon\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBo­ot\network\netmon\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBo­ot\Minimal\lsass\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBo­ot\Minimal\msrsys\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBo­ot\network\lsass\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBo­ot\network\msrsys\ not found.
========== FILES ==========
C:\TB.txt moved successfully.
C:\TCleaner.txt moved successfully.
C:\ZHPExportRegistry-21-11-2009-15-31-09.txt moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 164763 bytes
->Temporary Internet Files folder emptied: 12690584 bytes
->FireFox cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 12,32 mb


OTM by OldTimer - Version 3.1.2.0 log created on 11222009_005046

Files moved on Reboot...
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_6ec.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

j'ai que un log.txt qui s'esr créé :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-11-22 10:33:47
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 54 GB (72%) free of 75 GB
Total RAM: 3071 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:47, on 22/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Windows\LSD\LClock\lclock.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://melanthios-ana.com/zcvisitor/1624d318-3614-11eb-87b9-12a1ab6c324d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=47f83760-f118-11ea-9bc8-0ac2bbf4ada7
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsgTranAgt] C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Windows\LSD\LClock\lclock.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WinLSD_SP3] %systemroot%\LSD\end.cmd (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service Google Update (gupdate1ca2597b12086ce) (gupdate1ca2597b12086ce) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.32\bin\mysqld.exe

ComboFix 09-11-21.03 - Administrateur 22/11/2009 11:25.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3071.2442 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\msconfig.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-22 au 2009-11-22 ))))))))))))))))))))))))))))))))))))
.

2009-11-21 23:37 . 2009-11-21 23:37 -------- d-----w- C:\_OTM
2009-11-21 14:36 . 2009-11-21 14:37 -------- d-----w- C:\rsit
2009-11-21 12:32 . 2009-11-21 12:32 -------- d-----w- c:\windows\system32\wbem\snmp
2009-11-21 12:32 . 2009-11-21 12:32 -------- d-----w- c:\windows\srchasst
2009-11-21 12:32 . 2009-11-21 12:32 -------- d-----w- c:\windows\system32\xircom
2009-11-21 12:32 . 2009-11-21 12:32 -------- d-----w- c:\program files\microsoft frontpage
2009-11-21 12:29 . 2009-11-21 12:29 579584 ----a-w- c:\windows\system32\dllcache\user32.dll
2009-11-21 12:27 . 2009-11-21 12:27 -------- d-----w- c:\windows\ERUNT
2009-11-21 12:20 . 2009-11-21 12:36 -------- d-----w- C:\SDFix
2009-11-21 11:36 . 2009-11-21 12:12 -------- d-----w- C:\ToolBar SD
2009-11-21 11:29 . 2009-11-21 14:31 -------- d-----w- c:\program files\ZHPDiag
2009-11-21 10:41 . 2009-11-21 10:49 -------- d-----w- c:\program files\Ad-Remover
2009-11-21 10:37 . 2009-11-21 10:37 -------- d-----w- c:\program files\Trend Micro
2009-11-19 09:50 . 2009-11-19 09:50 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-11-19 09:50 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-19 09:50 . 2009-11-19 09:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-19 09:50 . 2009-11-19 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-19 09:50 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-18 17:21 . 2008-03-30 18:55 1213784 ----a-w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6\vsapi32.dll
2009-11-18 17:21 . 2006-11-22 16:48 91744 ----a-w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6\BPMNT.dll
2009-11-18 17:20 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-11-18 17:20 . 2007-12-24 16:37 138384 ----a-w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6\tmcomm.sys
2009-11-18 17:20 . 2006-07-07 15:29 1197584 ----a-w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6\ssapi32.dll
2009-11-18 17:19 . 2009-03-27 16:38 366344 ----a-w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6\tsc.exe
2009-11-18 16:55 . 2009-11-18 17:28 -------- d-----w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6
2009-11-18 16:55 . 2009-11-18 16:55 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-11-15 15:41 . 2009-11-15 15:41 -------- d-----w- c:\documents and settings\Administrateur\Application Data\codeblocks
2009-11-15 15:40 . 2009-11-15 15:40 20248963 ----a-w- c:\program files\codeblocks-8.02mingw-setup.exe
2009-11-11 22:04 . 2009-11-21 16:17 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\FullTiltPoker
2009-11-11 22:04 . 2009-11-21 16:18 -------- d-----w- c:\program files\Full Tilt Poker
2009-11-11 22:02 . 2009-11-11 22:04 31501742 ----a-w- c:\program files\FullTiltSetup.exe
2009-11-07 13:02 . 2009-11-07 13:02 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\LABO EXPRESS
2009-11-07 13:02 . 2009-11-07 13:02 -------- d-----w- c:\program files\FujiFilm
2009-11-05 10:20 . 2009-11-05 10:20 374070434 ----a-w- c:\program files\3d_architecture_2.exe
2009-11-05 09:51 . 2009-11-05 10:04 -------- d---a-w- c:\program files\Furnish Pro
2009-11-05 09:51 . 2009-11-05 09:51 75730905 ----a-w- c:\program files\FurnishFR.exe
2009-10-31 15:31 . 2009-10-31 15:31 -------- d-----w- c:\program files\Poladroid
2009-10-31 15:31 . 2009-06-01 15:59 6598144 ------w- c:\program files\POLADROID Installer.msi
2009-10-31 15:31 . 2009-10-31 15:31 6201947 ----a-w- c:\program files\Poladroid0.9.6r0-PC.zip
2009-10-31 11:21 . 2009-10-31 11:21 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-15 19:01 . 2009-04-24 02:00 -------- d-----w- c:\program files\PKR
2009-11-15 01:29 . 2009-05-14 19:13 -------- d-----w- c:\program files\Vuze
2009-11-15 01:29 . 2009-05-14 19:16 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Azureus
2009-11-07 13:09 . 2009-11-07 13:03 24084 ----a-w- c:\documents and settings\Administrateur\Application Data\mdbu.bin
2009-11-05 10:35 . 2009-04-23 22:44 28694 ----a-w- c:\windows\system32\nvModes.dat
2009-11-05 10:21 . 2009-11-05 10:21 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LiveCAD2
2009-10-26 15:56 . 2001-08-28 18:00 76052 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-26 15:56 . 2001-08-28 18:00 469060 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-08 11:34 . 2009-06-15 12:02 -------- d-----w- c:\program files\Lx_cats
2009-10-06 23:57 . 2009-10-06 23:57 8124808 ----a-w- c:\program files\Firefox Setup 3.5.3.exe
2009-09-24 20:17 . 2009-05-14 21:07 10686001 ----a-w- c:\documents and settings\Administrateur\Application Data\Azureus\plugins\azump\mplayer.exe
2009-09-10 19:38 . 2009-09-10 19:38 5390876 ----a-w- c:\program files\jpegrec.exe
2009-09-10 17:20 . 2009-09-10 17:20 6113439 ----a-w- c:\program files\pci_filerecovery.exe
2009-09-08 18:38 . 2009-06-15 12:00 88647856 ----a-w- c:\program files\cjr2500FR.exe
2009-09-01 15:59 . 2009-09-01 15:59 85504 ----a-w- c:\documents and settings\Administrateur\Application Data\pdfforge\sspatch2.exe
2009-08-28 22:50 . 2009-08-23 10:24 39173801 ----a-w- c:\program files\script_39.zip
2009-07-08 16:24 . 2009-07-08 16:24 2197648 ----a-w- c:\program files\FileZilla_3.2.6.1_win32-setup.exe
2009-05-28 22:33 . 2009-05-28 22:33 17695920 ----a-w- c:\program files\PDFCreator-0_9_8_setup.exe
2009-05-21 09:20 . 2009-05-21 09:20 3211338 ----a-w- c:\program files\cdbxp_setup_4.2.4.1351.exe
2009-05-17 21:48 . 2009-05-17 21:48 17929072 ----a-w- c:\program files\Install_Messenger.exe
2009-05-17 21:03 . 2009-04-24 01:42 2402832 ----a-w- c:\program files\WLinstaller.exe
2009-05-17 20:41 . 2009-05-17 20:41 3227248 ----a-w- c:\program files\ccsetup219.exe
2009-05-17 20:36 . 2009-05-17 20:37 108395 ----a-w- c:\program files\ZapMessenger[www.wikikou.fr]-240.zip
2009-05-14 19:11 . 2009-05-14 19:11 607640 ----a-w- c:\program files\jre-6u13-windows-i586-p-iftw.exe
2009-05-14 19:00 . 2009-05-14 19:00 10558400 ----a-w- c:\program files\Vuze_4.2.0.2_windows.exe
2009-05-14 18:51 . 2009-05-14 18:51 6745696 ----a-w- c:\program files\Shareaza_2.4.0.0.exe
2009-05-09 23:23 . 2009-05-09 23:23 476696 ----a-w- c:\program files\RealPlayer11GOLD_fr.exe
2009-04-30 15:35 . 2009-04-30 15:35 26897264 ----a-w- c:\program files\AdbeRdr910_fr_FR.exe
2009-04-30 11:21 . 2009-04-30 11:21 553687 ----a-w- c:\program files\RegCleaner.exe
2009-04-30 11:16 . 2009-04-30 11:16 447814 ----a-w- c:\program files\m3jpegv3.exe
2009-04-30 10:58 . 2009-04-30 10:58 21878064 ----a-w- c:\program files\QuickTimeInstaller.exe
2009-04-29 12:31 . 2009-04-29 12:31 3925567 ----a-w- c:\program files\FileZilla_3.2.4.1_win32-setup.exe
2009-04-28 11:39 . 2009-04-28 11:39 939956 ----a-w- c:\program files\7z465.exe
2009-04-24 15:21 . 2009-04-24 15:21 23691249 ----a-w- c:\program files\mediacoder_mediacoder_0.7.0_build_4385_francais_19581.exe
2009-04-24 13:40 . 2009-04-24 13:40 16742799 ----a-w- c:\program files\vlc-0.9.9-win32.exe
2009-04-24 13:33 . 2009-04-24 13:33 2603433 ----a-w- c:\program files\npp.5.3.1.Installer.exe
2009-04-24 13:28 . 2009-04-24 13:28 16953377 ----a-w- c:\program files\WampServer2.0g-1.exe
2009-04-24 10:56 . 2009-04-24 10:56 16409960 ----a-w- c:\program files\spybotsd162.exe
2009-04-24 01:44 . 2009-04-24 01:43 1161576 ----a-w- c:\program files\windows-live-messenger_wl_messenger_2009_14.0.8064.206_francais_19367.exe
2009-04-24 01:25 . 2009-04-24 01:25 308160 ----a-w- c:\program files\avast_home_setup.exe
2008-11-19 11:58 . 2009-05-17 20:37 289280 ----a-w- c:\program files\ZapMessenger.exe
.

------- Sigcheck -------

[-] 2008-04-29 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-06-04 . 478B314098276163EDD8FCD47CC15BE5 . 102400 . . [5.4.3790.5512] . . c:\windows\system32\wuauclt.exe

[-] 2008-06-04 . 4332A55A3B40A1B97AA124E6CD6E5420 . 2287104 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe

[-] 2008-06-04 . D1EA0A366973ECA3E03F1ACBEFDA8F43 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe


[-] 2008-04-28 . 1697B0EFD4E0FF0181F70CB73F04A518 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-06-15 . 574412116E1B190B325C390A515C4E3E . 2165760 . . [5.1.2600.5512] . . c:\windows\system32\ntkrnlpa.exe

c:\windows\system32\wscntfy.exe ... manque !!
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="c:\windows\LSD\LClock\lclock.exe" [2004-09-19 65536]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-19 13537280]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-19 86016]
"MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2007-11-04 106496]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-11 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2008-07-15 217088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"WinLSD_SP3"="c:\windows\LSD\end.cmd" [2008-06-17 9944]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-04-23 124928]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\msrsys]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\WINDOWS\\system32\\lxddcoms.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddwbgw.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [24/04/2009 02:34 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24/04/2009 02:34 20560]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [15/09/2009 22:21 54752]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [15/06/2009 13:01 99248]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [24/04/2009 02:22 41376]
S2 gupdate1ca2597b12086ce;Service Google Update (gupdate1ca2597b12086ce);c:\program files\Google\Update\GoogleUpdate.exe [25/08/2009 16:21 133104]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S4 Nvhacatve;Nvhacatve;c:\windows\system32\drivers\nvhda32.sys [24/04/2009 02:22 41376]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - APPMGMT
.
Contenu du dossier 'Tâches planifiées'

2009-04-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-11-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-25 15:20]

2009-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ca5a1c561c2670.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-25 15:21]
.
.
------- Examen supplémentaire -------
.
mWindow Title =
uInternet Connection Wizard,ShellNext = hxxp://www.winlsd.org/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\jmzgulko.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.winlsd.org
FF - plugin: c:\program files\Google\Google Updater\2.4.1691.8062\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe
SafeBoot-lsass
SafeBoot-netmon
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-22 11:28
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:01,8b,15,94,4c,ed,60,b0,43,80,1f,52,dc,7c,57,a0,a2,83,15,aa,47,
b0,6c,bc,aa,ac,ad,f7,44,d6,7c,b6,53,15,7d,38,66,36,d4,30,05,e2,23,bb,48,88,\

[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:01,8b,15,94,4c,ed,60,b0,43,80,1f,52,dc,7c,57,a0,a2,83,15,aa,47,
b0,6c,bc,aa,ac,ad,f7,44,d6,7c,b6,53,15,7d,38,66,36,d4,30,05,e2,23,bb,48,88,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(916)
c:\windows\system32\scecli.dll
.
Heure de fin: 2009-11-22 11:29
ComboFix-quarantined-files.txt 2009-11-22 10:29

Avant-CF: 56 747 925 504 octets libres
Après-CF: 56 732 794 880 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 6E0D79E808E346FA03491B868DD8C061

vraiment nikel maintenant !

plus aucun virus détecté par avast dans les temp. (alors qu'il s'affolait a peu pres toutes les 5 min avant).

et plus de probleme de connexion a internet ni de lenteur.

franchement c'est nikel !!

c'est terminé ? ?

lol grillé pour XP !!
c'est un ami qui m'a mis ça à la place de vista quand j'ai acheté le pc .

bon ben tout est fait, c'est super sympa de ta part !!
les gens comme toi vous avez trop la classe, vous imaginez pas a quel point vous aidez les novices comme nous !!!

bon ben j'suis de l'est de la France, pour te remercire fais signe au cas ou , j'te paie une biere ou deux ;-)

merci beaucoup !!!

bye .

lol
diabolo fraise au pire !!

jeune et doué, bien joué continue!

encore merci .

Y'a moyen de le faire pour moi?
Pareil, même virus détecté aujourdui, windows commence a afficher un ta de fenêtre d'endommagement de l'ordinateur ainsi que de grands risques pour celui ci.
HEELLLP !