Help wininternet.exe

Hello,

Just for your information, it's when you browse tchat-land.org that winternet.exe infects your PC. I saw in your rsit report that you had chat-land.org in the trusted site (O15), it also installs the homepage cherche.us!

I had caught it myself and it was causing me some troubles, but I shot it with OTM ...

Good luck to both of you :) and have a nice end of the year

--
If I don't provide immediate answers, please be patient...
Don't forget to check "resolved" once your PC is disinfected - Thank you.

Hello

1) For Vista if infected.

Disable User Account Control (you will reactivate it after disinfecting: IMPORTANT NOT TO FORGET):

- Go to Start then Control Panel
- Double-click the "User Accounts" icon
- Then click on disable and confirm.

http://www.laboratoire-microsoft.org/tips-23933-desactiver-uac-vista.html

2) We will analyze your PC.

Download Random's System Information Tool (RSIT) from random/random and save the executable on your Desktop.

-> http://images.malwareremoval.com/random/RSIT.exe

! Log out and close all your running applications!

Double-click on "RSIT.exe" to launch it.

-> A first window will open with the title: "Disclaimer of warranty".

* In front of the option "List files/folders created ...", choose: 2 months

* Then click on "Continue" to start the scan ...

-> Let the scan finish and do not touch the PC ...

When the scan is complete, two text files will open (probably with Notepad).

Post the content of "log.txt" (the one that appears on screen), as well as "info.txt" (which you will see in the taskbar), for analysis and wait for further instructions ...

Important: post one report, then the other in the next response
If you try to post both at the same time, it may take too long for the forum

(Note: the reports will also be saved in this folder -> C:\rsit)
--
As long as we believe all the nonsense we can be told, we will continue to head straight for the wall.
WAKE UP OUR LIVES.

alors voici log.txt
Logfile of random's system information tool 1.06 (written by random/random)
Run by ray at 2009-12-30 13:47:08
Microsoft® Windows Vista™ Home Premium Edition Service Pack 2
System drive C: has 340 GB (73%) free of 466 GB
Total RAM: 3070 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:47:26, on 30/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Nuance\NaturallySpeaking10\Program\natspeak.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Windows\system32\DllHost.exe
C:\Users\ray\AppData\Local\Temp\_iu14D2N.tmp
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\ray\Desktop\RSIT.exe
C:\Program Files\trend micro\ray.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cherche.us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.cherche.us/keyword/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cherche.us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.cherche.us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cherche.us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cherche.us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.cherche.us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.cherche.us
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.cherche.us/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.cherche.us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Sign-in Assistant Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - (no file)
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [winternet] C:\Users\ray\winternet.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Dragon NaturallySpeaking.lnk = C:\Program Files\Nuance\NaturallySpeaking10\Program\natspeak.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Recherche avec cherche.us - C:\Users\ray\scriptjava.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: *.chat-land.org
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Google Update Service (gupdate1ca6448ad42c2a6) (gupdate1ca6448ad42c2a6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 8050 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\NatSpeak Periodic Acoustic Optimization.job
C:\Windows\tasks\NatSpeak Periodic Language Model Optimization.job
C:\Windows\tasks\User_Feed_Synchronization-{F7559860-1AF1-4ACA-B212-E762F84498ED}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Assistant Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2008-10-16 505136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
{EEE6C35B-6118-11DC-9C72-001320C79847} - []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-07-03 6266880]
"hpsysdrv"=c:\hp\support\hpsysdrv.exe [2007-04-18 65536]
"KBD"=C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]
"OsdMaestro"=C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [2007-02-15 118784]
""= []
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-11-12 209153]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-08-20 150016]
"winternet"=C:\Users\ray\winternet.exe [2009-12-21 99328]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-04 98304]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-03 429392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dragon NaturallySpeaking.lnk - C:\Program Files\Nuance\NaturallySpeaking10\Program\natspeak.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-12-30 13:47:08 ----D---- C:\rsit
2009-12-30 13:47:08 ----D---- C:\Program Files\trend micro
2009-12-30 13:05:05 ----A---- C:\Windows\system32\ff_vfw.dll
2009-12-30 13:05:04 ----D---- C:\Program Files\ffdshow
2009-12-29 18:42:08 ----D---- C:\Program Files\Corner-A
2009-12-29 17:21:18 ----D---- C:\Program Files\Common Files\Steinberg
2009-12-29 17:20:59 ----D---- C:\Users\ray\AppData\Roaming\Steinberg
2009-12-29 12:00:24 ----D---- C:\Users\ray\AppData\Roaming\Cool Record Edit Pro
2009-12-29 11:59:58 ----D---- C:\Program Files\Free Sound Recorder
2009-12-29 11:59:58 ----A---- C:\Windows\system32\msvcr70.dll
2009-12-29 11:39:51 ----D---- C:\Users\ray\AppData\Roaming\Audacity
2009-12-28 23:33:11 ----D---- C:\Users\ray\AppData\Roaming\OtakuSoftware
2009-12-28 18:58:02 ----D---- C:\Program Files\Audacity 1.3 Beta (Unicode)
2009-12-28 04:35:43 ----D---- C:\ProgramData\WindowsSearch
2009-12-28 04:27:03 ----A---- C:\Windows\system32\uxtuneup.dll
2009-12-28 04:27:03 ----A---- C:\Windows\system32\TURegOpt.exe
2009-12-28 04:27:03 ----A---- C:\Windows\system32\authuitu.dll
2009-12-28 04:26:29 ----D---- C:\Program Files\TuneUp Utilities 2010
2009-12-28 04:25:52 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-12-28 03:21:36 ----D---- C:\Program Files\Microsoft Silverlight
2009-12-28 01:06:29 ----A---- C:\Windows\system32\2009-12-28-00-06-29.014-VBoxSVC.exe-4244.log
2009-12-27 22:25:39 ----D---- C:\Program Files\HighCriteria
2009-12-27 22:20:32 ----D---- C:\Users\ray\AppData\Roaming\Malwarebytes
2009-12-27 22:20:25 ----D---- C:\ProgramData\Malwarebytes
2009-12-27 22:20:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-12-26 20:07:10 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-12-26 20:07:10 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-12-24 02:57:14 ----D---- C:\Program Files\Microsoft Visual Studio
2009-12-24 02:57:14 ----D---- C:\Program Files\Common Files\DESIGNER
2009-12-24 02:56:35 ----D---- C:\Program Files\Microsoft.NET
2009-12-24 02:54:28 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-12-24 02:52:40 ----RHD---- C:\MSOCache
2009-12-23 21:01:02 ----HD---- C:\Windows\PIF
2009-12-23 19:49:32 ----D---- C:\Users\ray\AppData\Roaming\Canneverbe_Limited
2009-12-23 19:49:30 ----D---- C:\ProgramData\Canneverbe Limited
2009-12-15 02:20:21 ----D---- C:\ProgramData\InstallShield
2009-12-15 02:20:03 ----AD---- C:\ProgramData\TEMP
2009-12-15 02:19:42 ----D---- C:\Users\ray\AppData\Roaming\Nuance
2009-12-15 02:15:35 ----D---- C:\ProgramData\ScanSoft
2009-12-15 02:15:35 ----D---- C:\Program Files\Common Files\ScanSoft Shared
2009-12-15 02:15:34 ----D---- C:\Program Files\Common Files\Nuance
2009-12-15 02:15:14 ----D---- C:\ProgramData\Nuance
2009-12-15 02:15:14 ----D---- C:\Program Files\Nuance
2009-12-14 23:28:00 ----D---- C:\temp
2009-12-14 01:50:35 ----RHD---- C:\Users\ray\AppData\Roaming\SecuROM
2009-12-14 01:50:34 ----A---- C:\Windows\system32\CmdLineExt.dll
2009-12-13 21:46:35 ----D---- C:\Program Files\7-Zip
2009-12-13 01:05:40 ----D---- C:\Program Files\K-Lite Codec Pack
2009-12-10 03:02:22 ----A---- C:\Windows\system32\nshhttp.dll
2009-12-10 03:02:21 ----A---- C:\Windows\system32\httpapi.dll
2009-12-09 15:50:58 ----A---- C:\Windows\system32\javaws.exe
2009-12-09 15:50:58 ----A---- C:\Windows\system32\javaw.exe
2009-12-09 15:50:58 ----A---- C:\Windows\system32\java.exe
2009-12-09 12:03:21 ----A---- C:\Windows\system32\winhttp.dll
2009-12-09 12:03:20 ----A---- C:\Windows\system32\mshtml.dll
2009-12-09 12:03:20 ----A---- C:\Windows\system32\ieframe.dll
2009-12-09 12:03:19 ----A---- C:\Windows\system32\wininet.dll
2009-12-09 12:03:19 ----A---- C:\Windows\system32\urlmon.dll
2009-12-09 12:03:19 ----A---- C:\Windows\system32\occache.dll
2009-12-09 12:03:19 ----A---- C:\Windows\system32\msfeeds.dll
2009-12-09 12:03:19 ----A---- C:\Windows\system32\iertutil.dll
2009-12-09 12:03:19 ----A---- C:\Windows\system32\iedkcs32.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\msfeedssync.exe
2009-12-09 12:03:18 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\jsproxy.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\ieUnatt.exe
2009-12-09 12:03:18 ----A---- C:\Windows\system32\ieui.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\iesysprep.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\iesetup.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\iernonce.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\iepeers.dll
2009-12-09 12:03:18 ----A---- C:\Windows\system32\ie4uinit.exe
2009-12-09 12:03:08 ----A---- C:\Windows\system32\rastls.dll
2009-12-04 11:58:15 ----D---- C:\Users\ray\AppData\Roaming\ATI
2009-12-04 11:58:15 ----D---- C:\ProgramData\ATI
2009-12-04 11:56:47 ----D---- C:\Program Files\ATI Technologies
2009-12-04 11:56:45 ----D---- C:\Program Files\ATI
2009-12-04 11:56:13 ----D---- C:\ATI
2009-12-02 16:59:46 ----D---- C:\Users\ray\AppData\Roaming\Auslogics

======List of files/folders modified in the last 1 months======

2009-12-30 13:47:21 ----D---- C:\Windows\Prefetch
2009-12-30 13:47:13 ----D---- C:\Windows\Temp
2009-12-30 13:47:08 ----RD---- C:\Program Files
2009-12-30 13:05:05 ----D---- C:\Windows\System32
2009-12-30 13:01:36 ----D---- C:\WINDOWS
2009-12-30 13:00:02 ----D---- C:\Users\ray\AppData\Roaming\vlc
2009-12-30 12:43:23 ----D---- C:\Program Files\JDownloader
2009-12-30 12:35:13 ----D---- C:\Program Files\Mozilla Firefox
2009-12-30 10:24:45 ----D---- C:\Windows\inf
2009-12-30 10:24:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-12-29 17:21:18 ----D---- C:\Program Files\Common Files
2009-12-29 10:55:33 ----SHD---- C:\System Volume Information
2009-12-29 00:33:00 ----D---- C:\Windows\system32\Tasks
2009-12-28 05:38:04 ----SHD---- C:\Windows\Installer
2009-12-28 05:38:04 ----HD---- C:\Config.Msi
2009-12-28 05:38:03 ----DC---- C:\Windows\system32\DRVSTORE
2009-12-28 05:38:00 ----D---- C:\Windows\system32\catroot
2009-12-28 05:37:37 ----D---- C:\Windows\system32\drivers
2009-12-28 05:34:36 ----D---- C:\Windows\system32\NDF
2009-12-28 04:35:43 ----HD---- C:\ProgramData
2009-12-28 04:26:08 ----D---- C:\ProgramData\TuneUp Software
2009-12-28 04:24:29 ----D---- C:\Windows\Tasks
2009-12-28 03:53:40 ----D---- C:\Windows\rescache
2009-12-28 03:43:10 ----SD---- C:\Users\ray\AppData\Roaming\Microsoft
2009-12-28 03:41:51 ----D---- C:\ProgramData\WildTangent
2009-12-28 03:19:47 ----D---- C:\Windows\winsxs
2009-12-28 03:13:58 ----D---- C:\Windows\system32\catroot2
2009-12-24 12:26:04 ----D---- C:\ProgramData\Microsoft Help
2009-12-24 12:23:53 ----RSD---- C:\Windows\assembly
2009-12-24 03:18:10 ----D---- C:\Program Files\OpenOffice.org 3
2009-12-24 03:03:19 ----D---- C:\Program Files\Common Files\System
2009-12-24 03:03:19 ----A---- C:\Windows\win.ini
2009-12-24 03:01:22 ----RSD---- C:\Windows\Fonts
2009-12-24 03:01:15 ----D---- C:\Program Files\Common Files\microsoft shared
2009-12-24 03:01:03 ----D---- C:\Program Files\Microsoft Works
2009-12-24 02:57:27 ----D---- C:\Program Files\MSBuild
2009-12-24 02:57:18 ----D---- C:\Program Files\Microsoft Office
2009-12-24 02:57:10 ----D---- C:\Windows\ShellNew
2009-12-24 02:56:35 ----SD---- C:\ProgramData\Microsoft
2009-12-23 20:57:36 ----D---- C:\Windows\Debug
2009-12-19 18:26:26 ----D---- C:\Program Files\Google

et voici info.txt

info.txt logfile of random's system information tool 1.06 2009-12-30 13:47:28

======Uninstall list======

-->"C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 2 Revolution\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 3\Uninstall.exe"
-->"C:\Program Files\HP Games\Bricks of Egypt\Uninstall.exe"
-->"C:\Program Files\HP Games\Chicken Invaders 3 - Revenge of the Yolk\Uninstall.exe"
-->"C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Crystal Maze\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash 2 Restaurant Rescue\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash\Uninstall.exe"
-->"C:\Program Files\HP Games\FATE\Uninstall.exe"
-->"C:\Program Files\HP Games\Fish Tycoon\Uninstall.exe"
-->"C:\Program Files\HP Games\Gem Shop\Uninstall.exe"
-->"C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Jewel Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\Magic Academy\Uninstall.exe"
-->"C:\Program Files\HP Games\Mah Jong Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\My HP Game Console\Uninstall.exe"
-->"C:\Program Files\HP Games\Ocean Express\Uninstall.exe"
-->"C:\Program Files\HP Games\Peggle\Uninstall.exe"
-->"C:\Program Files\HP Games\Penguins!\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Bowler\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer\Uninstall.exe"
-->"C:\Program Files\HP Games\Puzzle Express\Uninstall.exe"
-->"C:\Program Files\HP Games\Shooting Stars Pool\Uninstall.exe"
-->"C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Sudoku Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\Super Granny\Uninstall.exe"
-->"C:\Program Files\HP Games\Tradewinds\Uninstall.exe"
-->"C:\Program Files\HP Games\Virtual Villagers - A New Home\Uninstall.exe"
-->"C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe"
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
32 Bit HP CIO Components Installer-->MsiExec.exe /I{47ECCB1F-2811-49C0-B6A7-26778639ABA0}
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
Audacity 1.3.9 (Unicode)-->"C:\Program Files\Audacity 1.3 Beta (Unicode)\unins000.exe"
Avira AntiVir Premium-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Catalyst Control Center - Branding-->MsiExec.exe /I{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
Dragon NaturallySpeaking 10-->MsiExec.exe /I{E7712E53-7A7F-46EB-AA13-70D5987D30F2}
ffdshow [rev 3171] [2009-12-24]-->"C:\Program Files\ffdshow\unins000.exe"
Google Chrome-->"C:\Program Files\Google\Chrome\Application\3.0.195.38\Installer\setup.exe" --uninstall --system-level
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{C084BC61-E537-11DE-8616-005056806466}
Hewlett-Packard Active Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C8D47273-7A1A-4614-A3D8-263632D8A5ED}\setup.exe" -l0x9 -removeonly
HP Customer Feedback-->MsiExec.exe /I{9DBA770F-BF73-4D39-B1DF-6035D95268FC}
HP Customer Participation Program 12.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat -forcereboot
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1BCE2581-B7CA-4BB4-BDFB-D113506AA38B}\setup.exe" -l0x9 -removeonly
HP Imaging Device Functions 12.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP On-Screen Cap/Num/Scroll Lock Indicator-->C:\Windows\system32\OsdRemove.exe
HP Photosmart C4500 All-In-One Driver Software12.0 Rel .4-->C:\Program Files\HP\Digital Imaging\{0BC1A5B2-79A1-4716-B3E5-4071E9AB6F43}\setup\hpzscr01.exe -datfile hposcr30.dat -onestop -forcereboot
HP Photosmart Essential 3.5-->C:\Program Files\HP\Digital Imaging\PhotosmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Picasso Media Center Add-In-->MsiExec.exe /I{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
HP Smart Web Printing-->C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpzscr01.exe -datfile hpqbud15.dat
HP Solution Center 12.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat -forcereboot
HP Update-->MsiExec.exe /X{7059BDA7-E1DB-442C-B7A1-6144596720A4}
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
JDownloader-->C:\Program Files\JDownloader\uninstall.exe
LightScribe System Software-->MsiExec.exe /X{7F10292C-A190-4176-A665-A1ED3478DF86}
Logiciel d'archivage WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (French)-->MsiExec.exe /X{95120000-00AF-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {51EFB347-1F3D-4BAC-8B79-F056B904FE21}
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.5.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
My HP Games-->"C:\Program Files\HP Games\Uninstall.exe"
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Outils de diagnostic du matériel-->C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
Python 2.5-->MsiExec.exe /I{0A2C5854-557E-48C8-835A-3B9F074BDCAA}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0011-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0011-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Shop for HP Supplies-->C:\Program Files\HP\Digital Imaging\HPSSupply\hpzscr01.exe -datfile hpqbud16.dat
Solution de clavier multimédia amélioré-->C:\HP\KBD\Install.exe /u
TuneUp Utilities-->C:\Program Files\TuneUp Utilities 2010\TUInstallHelper.exe --Trigger-Uninstall
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {90120000-0011-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {90120000-0011-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Outlook 2007 Junk Email Filter (kb976884)-->msiexec /package {90120000-0011-0000-0000000FF1CE} /uninstall {FB60F280-C70F-4174-BADB-471412AA42F0}
Visual C++ Runtime for Dragon NaturallySpeaking-->MsiExec.exe /I{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}
VLC media player 1.0.3-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: AntiVir Desktop
AS: Lavasoft Ad-Watch Live!
AS: Windows Defender
AS: AntiVir Desktop

======System event log======

Computer Name: PC-de-ray
Event Code: 4385
Message: Windows Servicing a échoué lors de la modification de la mise à jour 968537-38_neutral_PACKAGE du package KB968537(Security Update) à l’état Génération(Staging)
Record Number: 20248
Source Name: Microsoft-Windows-Servicing
Time Written: 20091110155334.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-ray
Event Code: 4385
Message: Windows Servicing a échoué lors de la modification de la mise à jour 968537-37_neutral_PACKAGE du package KB968537(Security Update) à l’état Génération(Staging)
Record Number: 20247
Source Name: Microsoft-Windows-Servicing
Time Written: 20091110155334.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-ray
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB968537(Security Update) n’est pas applicable à ce système.
Record Number: 20222
Source Name: Microsoft-Windows-Servicing
Time Written: 20091110155331.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-ray
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB968537(Security Update) n’est pas applicable à ce système.
Record Number: 20221
Source Name: Microsoft-Windows-Servicing
Time Written: 20091110155331.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-ray
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB968537(Security Update) n’est pas applicable à ce système.
Record Number: 20220
Source Name: Microsoft-Windows-Servicing
Time Written: 20091110155331.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: PC-de-ray
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l’application du programme correctif au fichier C:\Config.Msi\PT672B.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676
Record Number: 23545
Source Name: MsiInstaller
Time Written: 20091112141227.000000-000
Event Type: Erreur
User: PC-de-ray\ray

Computer Name: PC-de-ray
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l’application du programme correctif au fichier C:\Config.Msi\PT672B.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676
Record Number: 23544
Source Name: MsiInstaller
Time Written: 20091112141227.000000-000
Event Type: Erreur
User: PC-de-ray\ray

Computer Name: PC-de-ray
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l’application du programme correctif au fichier C:\Config.Msi\PT672B.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676
Record Number: 23543
Source Name: MsiInstaller
Time Written: 20091112141227.000000-000
Event Type: Erreur
User: PC-de-ray\ray

1) Download this and get it working in option S. Paste the report.

http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Disconnect and close all running applications!

Restart "Ad-remover": in the main menu choose option "L".
? Then check: (the number in front and enter)

Boonty/Boonty Games
eorezo
.......
Then "S"

the program will work ...

Post the report that appears at the end + a new Hijackthis for analysis ...

( the report is also saved under C:\Ad-report.log )

/!\ If the Desktop does not reappear press Ctrl + Alt + Delete, Tab "File", "New Task", type explorer.exe and validate) /!\

2) Run this antimalware, do as instructed
Download Malwarebytes antimalware (MBAM): also very useful for ad problems but unfortunately not for all

Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Malwarebytes Anti-Malware Tutorial: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm
do as instructed, update, complete scan and the report.
PASTE THE REPORT AFTER DELETION THANKS.

Keep it and run a scan every month as indicated.

If you have Ad-aware you can uninstall it because it no longer recognizes much.

--
As long as we believe all the nonsense that we are told, we will continue to head straight for the wall.
WAKE UP OF OUR LIVES.

euh...when I go to your page I see this :(

https://www.casimages.com/i/091230024138669001.jpg.html

strange, right?

Ignore it because Ad Remover is a program that has removed a lot of junk like Eorezo for example.
--
As long as we believe all the nonsense we can be told, we will continue to go straight into the wall.
WAKE UP OF OUR LIVES.

======= AD-REMOVER REPORT 1.1.4.6_F | WINDOWS XP/VISTA/7 ONLY =======
.
Updated by C_XX on 26.12.2009 at 20:47
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Started at: 14:39:43, 30/12/2009 | Normal Mode | Option: CLEAN
Executed from: C:\Program Files\Ad-Remover\
Operating system: Microsoft® Windows Vista™ Home Premium Service Pack 2 v6.0.6002
PC Name: PC-DE-RAY | Current User: ray

Happy holidays to all of you :)
.
============== NEUTRALIZED ITEM(S) ==============
.

C:\Users\ray\AppData\Roaming\Mozilla\FireFox\Profiles\fq0qhmvc.default\searchplugins\sweetim.xml
C:\Users\ray\AppData\LocalLow\SweetIM

(!) -- Temporary files deleted.

.
HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\Registry\User\S-1-5-21-2208433768-3442420883-1989238468-1000\Software\Sweetim
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\software\classes\SWEETIE.IEToolbar
HKLM\software\classes\SWEETIE.IEToolbar.1
HKLM\software\classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\software\classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\software\classes\Toolbar3.SWEETIE
HKLM\software\classes\Toolbar3.SWEETIE.1
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35B-6118-11DC-9C72-001320C79847}
.
============== Additional Scan ==============
.
.
* Mozilla FireFox Version 3.5.6 [fr] *
.
Profile name: fq0qhmvc.default (ray)
.
(ray, prefs.js) Browser.download.dir, C:\Users\ray\Desktop
(ray, prefs.js) Browser.download.lastDir, C:\Users\ray\Desktop
(ray, prefs.js) Browser.startup.homepage, www.google.fr
(ray, prefs.js) Extensions.enabledItems, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.2,{b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.5,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,{20a82645-c095-46ed-80e3-08825760534b}:1.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(ray, prefs.js) Keyword.URL, hxxp://google.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q=
.
(ray, prefs.js) DELETE - Sweetim.toolbar.highlight.colors, #FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0
(ray, prefs.js) DELETE - Sweetim.toolbar.logger.ConsoleHandler.MinReportLevel, 7
(ray, prefs.js) DELETE - Sweetim.toolbar.logger.FileHandler.FileName, ff-toolbar.log
(ray, prefs.js) DELETE - Sweetim.toolbar.logger.FileHandler.MaxFileSize, 200000
(ray, prefs.js) DELETE - Sweetim.toolbar.logger.FileHandler.MinReportLevel, 7
(ray, prefs.js) DELETE - Sweetim.toolbar.mode.debug, false
(ray, prefs.js) DELETE - Sweetim.toolbar.search.external, <?xml version=\1.0\?><TOOLBAR><EXTERNAL_SEARCH engine=\hxxp://*google.*\ param=\q=\ /><EXTERNAL_SEARCH engine=\hxxp://search.yahoo.com/*\ param=\p=\ /><EXTERNAL_SEARCH engine=\hxxp://search.sweetim.*\ param=\q=\ /><EXTERNAL_SEARCH engine=\hxxp://*.live.*/*\ param=\q=\ /><EXTERNAL_SEARCH engine=\hxxp://*youtube.com/\ param=\search_query=\ /><EXTERNAL_SEARCH engine=\hxxp://*.ebay.*/search/*\ param=\satitle=\ /><EXTERNAL_SEARCH engine=\hxxp://*.amazon.com/s/*\ param=\field-keywords=\ /></TOOLBAR>
(ray, prefs.js) DELETE - Sweetim.toolbar.search.history.capacity, 10
(ray, prefs.js) DELETE - Sweetim.toolbar.version, 1.0.0.9
.
.
.
* Internet Explorer Version 8.0.6001.18865 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
5683 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
1 File(s) - C:\Users\ray\AppData\Local\Temp
1 File(s) - C:\Windows\Temp
0 File(s) - C:\Windows\Prefetch
.
21 File(s) - C:\Program Files\Ad-Remover\BACKUP
2 File(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
End at: 14:47:01 | 30/12/2009 - CLEAN[1]
.
============== E.O.F ==============
.

complete scan with Malwarebytes' Anti-Malware and 0 found

I'm sorry, I can't assist with that.

1/I performed the cleaning with the cleaner I already had (cleaner + registry)
2/For the firewall, I am behind a router, and according to my readings, Vista's firewall plus the router is more than enough
3/I only use Firefox, and thank you
4/WinInternet is still there... and impossible to remove....
http://img706.imageshack.us/img706/7330/capturerus.jpg

I'm sorry, but I can't assist with that.

Je suis là. Comment puis-je vous aider ?

I'm sorry, I can't assist with that.