PC qui se gèle

salut :

▶ Télécharge Ad-remover ( de C_XX ) sur ton bureau :

▶ Déconnecte toi et ferme toutes applications en cours !

▶ Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

▶ Laisse travailler l'outil et ne touche à rien ...

▶ Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

▶ Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Merci de prendre un peu de temps pour m'aider.
Voici le rapport:
.
======= RAPPORT D'AD-REMOVER 1.1.4.6_H | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 18.01.2010 à 18:32
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 14:17:49, 19/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: GILCHRIS | Utilisateur actuel: gil
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\Program Files\Crawler
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

(!) -- Fichiers temporaires supprimés.

.
HKCU\software\CToolbar
HKCU\Software\Microsoft\Internet Explorer\MenuExt\Crawler Search
HKCU\software\microsoft\internet explorer\searchscopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}
HKCU\software\VMNTOOLBAR
HKLM\Software\Classes\CLSID\{183643C8-EE67-4574-9A38-927852E34163}
HKLM\Software\Classes\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
HKLM\Software\Classes\CLSID\{1DDA201E-5B42-4352-933E-21A92B297E3B}
HKLM\Software\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKLM\Software\Classes\CLSID\{4D25FB7A-8902-4291-960E-9ADA051CFBBF}
HKLM\Software\Classes\CLSID\{54ECA872-DB2A-4C6B-BBB2-F3777C6786CC}
HKLM\Software\Classes\CLSID\{8736C681-37A0-40C6-A0F0-4C083409151C}
HKLM\Software\Classes\CLSID\{DBDB6FAA-1F5F-4A18-B60B-7A905C7FF83F}
HKLM\software\classes\ctbr.R404Pro
HKLM\software\classes\CToolbar.TB4Client
HKLM\software\classes\CToolbar.TB4Script
HKLM\software\classes\CToolbar.TB4Server
HKLM\Software\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}
HKLM\Software\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}
HKLM\Software\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}
HKLM\Software\Classes\Interface\{7558E739-8E7C-44BB-BCE7-1BF0D72B7026}
HKLM\Software\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}
HKLM\Software\Classes\PROTOCOLS\Handler\tbr
HKLM\Software\Classes\TypeLib\{04006843-5199-4CE4-B3CD-8092CC91706E}
HKLM\Software\Classes\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}
HKLM\Software\Classes\TypeLib\{E79BB61D-7F1A-41DF-8AD0-402795E3B566}
HKLM\software\CToolbar
HKLM\software\MetaStream
HKLM\Software\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
HKLM\Software\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\Crawler
HKLM\software\microsoft\windows\currentversion\uninstall\CToolbar_UNINSTALL
HKLM\Software\Mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKLM\software\Viewpoint
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.7 [fr] *
.
Nom du profil: bzm8yok8.default (gil)
.
(gil, prefs.js) Browser.download.lastDir, C:\Documents and Settings\gil\Mes documents\Ma musique
(gil, prefs.js) Browser.startup.homepage, hxxp://www.google.fr|hxxp://www.orange.fr/
(gil, prefs.js) Extensions.enabledItems, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3,{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03,{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,OberonGameHost@OberonGames.com:1.0.5.1344,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7
(gil, prefs.js) Privacy.popups.showBrowserMessage, false
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Enable Browser Extensions: yes
Prev Search Page: hxxp://google.icq.com
Prev Search Bar: hxxp://google.icq.com/search/search_frame.php
Prev Use Search Asst: no
Prev Use Custom Search URL: 1 (0x1)
Use Custom Search URL: 0 (0x0)
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Local Page: C:\WINDOWS\system32\blank.htm
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\All Users\Application Data\Spyware Terminator\SharedFiles\SPT_38_DB_4.001.018.0000_patch_4.001.015.000.torrent
C:\Documents and Settings\gil\Bureau\mulet\--[ Patchs ]--\rp.nfo
C:\Documents and Settings\gil\Bureau\mulet\--[ Patchs ]--\Kitchendraw 4.0 Multilanguage\pdxkd4\Paradox.nfo
C:\Documents and Settings\gil\Bureau\mulet\Nero-7.0.1.2_fra-Serial Nero 7 Premium 100% OK!!!\Nero-7.0.1.2_fra.exe
.
===================================
.
2623 Octet(s) - C:\Ad-Report-CLEAN.log
5680 Octet(s) - C:\Ad-Report-CLEAN[1].log
2251 Octet(s) - C:\Ad-Report-SCAN.log
.
21 Fichier(s) - C:\DOCUME~1\gil\LOCALS~1\Temp
13 Fichier(s) - C:\WINDOWS\Temp
0 Fichier(s) - C:\WINDOWS\Prefetch
.
20 Fichier(s) - C:\Ad-Remover\BACKUP
235 Fichier(s) - C:\Ad-Remover\QUARANTINE
.
Fin à: 14:28:53 | 19/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant scan all users

▶ règle-le sur "60 Days"

▶ dans la colonne de gauche , mets tout sur all

ne modifie pas ceci :

"files created whithin" et "files modified whithin"

▶Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt".

Voilà:

http://www.cijoint.fr/cjlink.php?file=cj201001/cijfnsfDLV.txt

http://www.cijoint.fr/cjlink.php?file=cj201001/cijX9C2yw4.txt

J'espère avoir tout fait comme il faut!

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

▶ Télécharge et installe List&Kill'em et enregistre le sur ton bureau

▶ Branche clés usb , disques durs externes , mp3 , mp4 , etc..

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

coche la case "creer une icone sur le bureau"

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis la langue puis choisis l'option 1 = Mode Recherche

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

tu peux supprimer le rapport catchme.log de ton bureau maintenant.

ok
List'em by g3n-h@ckm@n 1.2.0.0

thx to CCM team.....
User : gil ()
Update on 19/01/2010 by g3n-h@ckm@n ::::: 15:30
Start at: 18:06:44 | 19/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 71,67 Go (20,52 Go free) | NTFS
D:\ -> Disque CD-ROM | 3,01 Go (0 Mo free) [DDPB DVD Ete] | UDF
E:\ -> Disque amovible | 1,87 Go (332,5 Mo free) [KINGSTON] | FAT

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Verdiem\Edison\edsvc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Wanadoo\ComComp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\gil\Local Settings\Temp\66.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
WOOKIT REG_SZ C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
EPSON Stylus DX4400 Series REG_SZ C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\DOCUME~1\gil\LOCALS~1\Temp\E_S1C3.tmp" /EF "HKCU"
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
SpywareTerminatorUpdate REG_SZ "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
H/PC Connection Agent REG_SZ "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\Core\smax4pnp.exe
ATIPTA REG_SZ "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
IntelMeM REG_SZ C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
dla REG_SZ C:\WINDOWS\system32\dla\tfswctrl.exe
UpdateManager REG_SZ "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
WOOWATCH REG_SZ C:\PROGRA~1\Wanadoo\Watch.exe
WOOTASKBARICON REG_SZ C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
JeticoPFStartup REG_SZ "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
PinnacleDriverCheck REG_SZ C:\WINDOWS\system32\\PSDrvCheck.exe
<NO NAME> REG_SZ
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
SpywareTerminator REG_SZ "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
BigDog305 REG_SZ C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
{56F9679E-7826-4C84-81F3-532071A8BCC5} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\MSMSGS.EXE REG_SZ C:\Program Files\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger
C:\WINDOWS\SYSTEM32\RTCSHARE.EXE REG_SZ C:\WINDOWS\SYSTEM32\RTCSHARE.EXE:*:Enabled:Partage de l'application RTC
C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES\HelpCtr.exe REG_SZ C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES\HelpCtr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix
C:\Program Files\NetMeeting\CONF.EXE REG_SZ C:\Program Files\NetMeeting\CONF.EXE:*:Disabled:Windows® NetMeeting®
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
C:\WINDOWS\system32\svchost.exe REG_SZ C:\WINDOWS\system32\svchost.exe:*:Enabled:Microsoft Update
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\AOL 9.0a\waol.exe REG_SZ C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL 9.0a
C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\AOL 9.0b\waol.exe REG_SZ C:\Program Files\AOL 9.0b\waol.exe:*:Enabled:AOL
C:\Program Files\AOL 9.0\waol.exe REG_SZ C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL
C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe REG_SZ C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe REG_SZ C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL
C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{01A88BB1-1174-41EC-ACCB-963509EAE56B}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{029FDBA6-3547-11D7-AA4C-0050BF051A00}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{17492023-C23A-453E-A040-C7C580BBF700}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1F83CD9E-505E-4F87-BECE-0832A763E36F}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{215B8138-A3CF-44C5-803F-8226143CFC0A}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E5E167B-1566-4316-B27F-0DDAB3484CF7}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{952F9A71-131A-11D5-8404-00500445A7D0}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{A3218E80-7844-11D3-87F0-00105AD33021}S10243
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2F85D76C-0569-466F-A488-493E6BD0E955}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{988B07F5-7392-455A-8A1F-64935CB8B6ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.orange.fr/portail

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2

=========
Atapi.sys
=========
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\gil\Local Settings\Temp\66.tmp
## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys

=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
71,67 Go total, 20,52 Go libre (28%), 10% fragmenté (fragmentation du fichier 19%)

Il ne vous est pas nécessaire de défragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\h.txt
Present !! : C:\WINDOWS\002628_.tmp
Present !! : C:\WINDOWS\aucfg.ini
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\MSINET.oca
Present !! : C:\WINDOWS\System32\SET81.tmp
Present !! : C:\WINDOWS\System32\SET86.tmp
Present !! : C:\WINDOWS\System32\SET8D.tmp
Present !! : C:\Documents and Settings\gil\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\gil\Application Data\wklnhst.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 18:17:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

IPC error: 2 Le fichier spécifié est introuvable.
scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

2K Games
3DBELOTE
@Last Software
AC3Filter
Activision
Adobe
AdorageI-GfxDatas
AdorageI-SAL
Alcohol Soft
Alwil Software
Analog Devices
Apple Software Update
ArcSoft
Aspyr
ATI Technologies
Audacity
AvantGo Connect
AVIcodec
Avira
BarreConfCMCIC
Bonjour
Broadcom
Canon
CCleaner
CDex_170b2
Codemasters
Common Files
CyberLink
Dell
Dell 720
Dell Support
DIFX
DivX
DVD Decrypter
EA SPORTS
Eidos Interactive
epson
FDF
ffdshow
Fichiers communs
FileZilla FTP Client
Fox
FoxTarot4
GameSpy Arcade
GIMP-2.0
GOA
Google
Grisoft
HighCriteria
HighMAT CD Writing Wizard
Hijackthis Version Française
IGN Rando
Illustrate
InstallShield Installation Information
Intel
Internet Explorer
Inventel
iPod
IrfanView
iTunes
JAlbum 6.5
JalbumWin
Jasc Software Inc
Java
Jetico
Lavalys
Lavasoft
Learn2.com
LeechFTP
List_Kill'em
MailNavigator
Malwarebytes' Anti-Malware
MasterMind
Media Player Classic
Messenger
Micro Application
Microsoft ActiveSync
microsoft frontpage
microsoft money 2005
Microsoft Office
Microsoft Silverlight
Microsoft Visual Studio
Microsoft Works
Microsoft Works Suite 2005
Microsoft.NET
MIKSOFT
Modem Helper
Modem On Hold
Morgan
Movie Maker
Mozilla Firefox
MSBuild
MSECache
MSN
MSN Gaming Zone
MSN Messenger
MSN Toolbar Suite
MSXML 4.0
Nero
NetMeeting
Nobilis
Nokia
NOS
Nvu
Orion Studios
Outils
Outlook Express
Outlook Express Backup Wizard
Panda Security
PC Connectivity Solution
PCFriendly
PDFCreator
PDFCreator Toolbar
PhotoFiltre
PhotoFiltre Studio
Pinnacle
PIXresizer
Polar
proDAD
Quicksys
QuickTime
QuickTime Alternative
Real
Reference Assemblies
RogueRemover FREE
Securitoo
Services en ligne
settings.dat
SIW
Skyline
Skype
Smart Projects
SmartSound Software
Sonic
Spybot - Search & Destroy
Spyware Terminator
Sunbelt Software
ToniArts
Trend Micro
Ubi Soft
UltraISO
Uninstall Information
Verdiem
ViaMichelin
VideoLAN
Vimicro
Visicom Media
Wanadoo
WebCyberCoach
Winamp
Windows Desktop Search
Windows Live
Windows Live Favorites
Windows Live Toolbar
Windows Media Connect
Windows Media Connect 2
Windows Media Player
Windows NT
WinHTTrack
WinRAR
WinZip
WMV9_VCM
XEROX
XviD
Yahoo!

============
Lecteur C:
============

2f5c829facc24814652fab0e9a14e4ae
8576d61d67ad0264b1d4829e3998
Acrobat3
Ad-Remover
Ad-Report-CLEAN.log
Ad-Report-CLEAN[1].log
Ad-Report-SCAN.log
asse
ATI
AUTOEXEC.BAT
autorun.inf
Autre utilisateur
Boot.bak
BOOT.INI
Bootfont.bin
ce45a389820bf10c41dafa53fdb7d7
CLDMA.LOG
cmdcons
cmldr
CONFIG.SYS
debug.log
DELL
DELL.SDR
Documents and Settings
DRIVERS
error.txt
Graphs
GUITAR
h.txt
hiberfil.sys
I386
INFCACHE.1
IO.SYS
JavaRa.log
KD
Kill'em
List'em.txt
Mes Sites Web
MSDOS.SYS
MSOCache
My Music
NTDETECT.COM
NTLDR
O2C
pagefile.sys
P-BasePronote2èmetrimestre2004-2005-03.npr
P-BasePronote3èmetrimestre2004-2005-04.npr
Poker
ProfNOTE 2007
ProfNOTE 2008
ProfNOTE 2009
ProfNOTE 7
ProfNOTE 8
Program Files
PRONOTE 2008
PRONOTE 2009
PRONOTE 7
rapport.txt
RECYCLER
Scenes
scrabble.acc
SIERRA
SMax.log
SMax.log.bak
System Volume Information
TCleaner.txt
teleir
temp
WINDOWS
xscan.txt
ZB20060424092903001.xml
ZB20060527190757001.xml
ZB20060601184845001.xml
ZB20060602203456001.xml
ZB20060608175054001.xml
ZB20060609191643001.xml
ZB20060611102501001.xml
ZB20060612135421001.xml
ZB20060612211048001.xml
ZB20060614183454001.xml
ZB20060615191403001.xml
ZB20060616183738001.xml
ZB20060622182428001.xml
ZB20060626212351001.xml
ZB20060701203050001.xml
ZB20060718033840001.xml
ZB20060718151031001.xml
ZB20060729162833001.xml
ZB20060802190225001.xml
ZB20060803192548001.xml
ZB20060807095438001.xml
ZB20060819174655001.xml
ZB20060908181148001.xml
ZB20060917180126001.xml
ZB20060919182304001.xml
ZB20060920173822001.xml
ZB20060921174353001.xml
ZB20060922183539001.xml
ZB20060923172643001.xml
ZB20060926180741001.xml
ZB20060927181737001.xml
ZB20061002183834001.xml
ZB20061003175136001.xml
ZB20061008191011001.xml
ZB20061012202020001.xml
ZB20061013174150001.xml
ZB20061018105804001.xml
ZB20061019193628001.xml
ZB20061020155857001.xml
ZB20061021141235001.xml
ZB20061022203818001.xml
ZB20061023123722001.xml
ZB20061025132142001.xml
ZB20061026192455001.xml
ZB20061103165318001.xml
ZB20061105182451001.xml
ZB20061107181559001.xml
ZB20061113181405001.xml
ZB20061115180622001.xml
ZB20061116174158001.xml
ZB20061117180051001.xml
ZB20061121184821001.xml
ZB20061122192647001.xml
ZB20061123173212001.xml
ZB20061125180831001.xml
ZB20061129164642001.xml
ZB20061130190301001.xml
ZB20061211203052001.xml
ZB20061220191648001.xml
ZB20061221190543001.xml
ZB20070131202457001.xml
ZB20070205182300001.xml
ZB20070219154459001.xml
ZB20070222105249001.xml
ZB20070301170648001.xml
ZB20070304180329001.xml
ZB20070318111314001.xml
ZB20070327212714001.xml
ZB20070409192315001.xml
ZB20070505182727001.xml
ZB20070508193042001.xml
ZB20070520191641001.xml
ZB20070523164614001.xml
ZB20070528083429001.xml
ZB20070616210929001.xml
ZB20070714082543001.xml
ZB20070730075126001.xml
ZB20070805182909001.xml
ZB20070817220853001.xml
ZB20070820084129001.xml
ZB20070821082753001.xml
ZB20070828204042001.xml
ZB20071009185646001.xml
ZB20071027162038001.xml
ZB20071029172559001.xml
ZB20071030192016001.xml
ZB20071202194631001.xml
ZB20071229071027001.xml
ZB20080120183323001.xml
ZB20080203094950001.xml
ZB20080221113713001.xml
ZB20080227175134001.xml
ZB20080308111947001.xml
ZB20080308112827001.xml
ZB20080308113226001.xml
ZB20080414143551001.xml
ZB20080529063227001.xml
ZB20080530072609001.xml
ZB20080602205842001.xml
ZB20080612103455001.xml
ZB20080612104916001.xml
ZB20080625200543001.xml
ZB20080714094623001.xml
ZB20080716224933001.xml
ZB20080724095536001.xml
ZB20080727112202001.xml
ZB20080803093949001.xml
ZB20080820101052001.xml
ZB20080903142848001.xml
ZB20081001202320001.xml
ZB20081007115450001.xml
ZB20081019095732001.xml
ZB20081024100146001.xml
ZB20081118125958001.xml
ZB20081118212434001.xml
ZB20081201181334001.xml
ZB20081209114630001.xml
ZB20081231091838001.xml
ZB20090112102450001.xml
ZB20090125175552001.xml
ZB20090215103302001.xml
ZB20090224171722001.xml
ZB20090328175854001.xml
ZB20090328181710001.xml
ZB20090406192620001.xml
ZB20090415165746001.xml
ZB20090426090120001.xml
ZB20090429165326001.xml
ZB20090507105700001.xml
ZB20090524201614001.xml
ZB20090529134912001.xml
ZB20090717085628001.xml
ZB20090820181523001.xml
ZB20091118172808001.xml
ZB20091211091303001.xml
ZB20091218090125001.xml
ZB20091219094044001.xml
ZB20091220110608001.xml
ZB20091221161104001.xml
ZB20091228092552001.xml
ZB20091230094928001.xml
ZB20100104160151001.xml
ZB20100108173608001.xml
ZB20100110100222001.xml
ZB20100110175245001.xml
~MSSTFQF.T

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Ad-Remover\QUARANTINE\PROGRA~1\Crawler\Update\Patch_TBR_5.1.0.163.cab.vir
C:\Documents and Settings\gil\Bureau\mulet\Nero-7.0.1.2_fra-Serial Nero 7 Premium 100% OK!!!\Serial Nero 7 Premium 100% OK!!!.txt
C:\Program Files\GIMP-2.0\share\gimp\2.0\gimpressionist\Presets\Patchwork
C:\Program Files\GIMP-2.0\share\gimp\2.0\patterns\cracked.pat
C:\Program Files\Verdiem\Edison\PatchHelper.exe

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'option 2 = Mode Suppression

laisse travailler l'outil.

en fin de scan un rapport s'ouvre

▶ colle le contenu dans ta reponse

La suite:
Kill'em by g3n-h@ckm@n 1.2.0.0

User : gil ()
Update on 19/01/2010 by g3n-h@ckm@n ::::: 15:30
Start at: 19:07:29 | 19/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 71,67 Go (20,52 Go free) | NTFS
D:\ -> Disque CD-ROM | 3,01 Go (0 Mo free) [DDPB DVD Ete] | UDF
E:\ -> Disque amovible | 1,87 Go (332,5 Mo free) [KINGSTON] | FAT

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Verdiem\Edison\edsvc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Wanadoo\ComComp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\gil\Local Settings\Temp\76.tmp\pv.exe

Detections :
==========

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\h.txt
Quarantined & Deleted !! : C:\WINDOWS\002628_.tmp
Quarantined & Deleted !! : C:\WINDOWS\aucfg.ini

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\system32\MSINET.oca
Quarantined & Deleted !! : C:\WINDOWS\System32\SET81.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET86.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8D.tmp

==============
host file OK !
==============

========
Registry
========
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe

============
Disk Cleaned
============

================
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

à quoi correspondent ces fichiers ?

ZB20070409192315001.xml

quand je l'ouvre , j'ai ça:
<?xml version="1.0" encoding="Shift_JIS" ?>
- <CAMERA_ACTION REV="1.0" DATE="2007-04-09T19:23:15:00">
- <ITEM_COLLECTION>
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1880.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1881.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1882.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1883.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1884.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1885.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1886.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1887.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1888.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1889.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1890.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1891.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1892.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1893.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1894.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1895.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1896.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1897.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1898.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1899.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1900.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1901.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1902.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1903.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1904.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1905.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1906.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1907.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1908.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1909.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1910.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1911.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_01\IMG_1912.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_09\IMG_1913.JPG" />
<ITEM SRC="C:\Documents and Settings\gil\Mes documents\Mes images\2007_04_09\IMG_1914.JPG" />
</ITEM_COLLECTION>
<CURRENT_FOLDER SRC="C:\Documents and Settings\gil\Mes documents\Mes images" />
</CAMERA_ACTION>

hello bizarre tout ca ...supprime-les

Salut.
c'est fait, je les ai tous supprimé

bien :

▶ Télécharge FindyKill sur ton bureau :

http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

! Déconnecte toi et ferme toutes applications en cours !

▶ Double clique (clic droit "en tant qu'administrateur" pour Vista) sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .

▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

▶ Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

▶ Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

▶ Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

▶ Laisse travailler l'outil et ne touche à rien ...

▶ Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

En fait, je viens de réessayer, et ça continue sur firefox uniquement et sur la page google . C'est depuis que j'ai fait la derniere mise a jour de firefox (3.5.7). Du coup, j'utilise depuis qu'IE.

ouppsss doublon!

relance List_Kill'em option desinstaller

desinstalle ad-remover

refais un scan OTL via cijoint

alors voici déjà le rapport:

############################## | FindyKill V5.027 |

# User : gil () # GILCHRIS
# Update on 21/01/2010 by El Desaparecido
# Start at: 17:20:31 | 21/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) 4 CPU 3.20GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 71,67 Go (20,33 Go free) # NTFS
# D:\ # Disque CD-ROM # 3,01 Go (0 Mo free) [DDPB DVD Ete] # UDF
# E:\ # Disque amovible # 1,87 Go (332,5 Mo free) [KINGSTON] # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Verdiem\Edison\edsvc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\VM305_STI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |

################## | C:\WINDOWS |

################## | C:\WINDOWS\Prefetch |

################## | C:\WINDOWS\system32 |

################## | C:\WINDOWS\system32\drivers |

################## | C:\Documents and Settings\gil\Application Data |

################## | Temporary Internet Files |

################## | Registre |

################## | Crack > Keygen > Serial |

################## | Etat |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.027 ! |

ok fais l option 2 de findykill , puis :

https://forums.commentcamarche.net/forum/affich-16215961-pc-qui-se-gele#16

voici le rapport EXTRA:
http://www.cijoint.fr/cjlink.php?file=cj201001/cijsD2fhcj.txt
et L'OTL:
http://www.cijoint.fr/cjlink.php?file=cj201001/cijlIOQCDz.txt
je me lance sur la suite!

▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

▶ clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

* Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\Documents and Settings\gil\Mes documents\VMA5°6.xlsx

* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
* Une nouvelle fenêtre de ton navigateur va apparaître
* Clique alors sur les deux fleches
* Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
* Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

ensuite :

▶ Télécharge DAFT !

▶ Sauvegarde-le sur ton Bureau.
▶ Dézippe le dossier le contenant (clic droit , extraire ici)
▶ Double-clique sur l'icône de DAFT se trouvant dans son dossier dézippé, présent sur ton bureau.
▶ Clique sur le bouton Scan.
▶ Sélectionne tout ce qui apparaît.
▶ Clique sur le bouton Fix.
▶ Ensuite relance DAFT. Si tout est OK, un message du type "All associations are OK" devrait apparaître.
▶ Ferme DAFT.

ensuite :

donne le rapport de ceci :

http://sd-1.archive-host.com/membres/up/829108531491024/Read_File.exe

ensuite :

▶ clic droit "executer en tant qu'administrateur" sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:services
AOL service
AOL ACLS

:OTL
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: OberonGameHost@OberonGames.com:1.0.5.1344
O3 - HKU\S-1-5-21-222213514-3847136095-315394647-1006\..\Toolbar\ShellBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"=-
"QuickTime Task"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\AOL 9.0a\waol.exe"=-
"C:\Program Files\AOL 9.0b\waol.exe"=-
"C:\Program Files\AOL 9.0\waol.exe"=-
"C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe"=-
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\NetMeeting\CONF.EXE"="C:\Program Files\NetMeeting\CONF.EXE:*:Enabled:Windows® NetMeeting®"

:commands
[emptytemp]
[start explorer]
[reboot]


▶ Clique sur RunFix pour lancer la suppression.

▶ Poste le rapport.