Where is the win32 folder?

Hello,

C:\Windows\System32 <--- it's here!
--
@+

It is not there either, even when I search with Windows it doesn't find it. I think I have a virus because I launched a file called winno.exe and since then I keep receiving the message: explorer has stopped working... I do not send, explorer closes and reopens, and the message comes back... every time winno.exe starts (it starts by itself).

• Download Random's System Information Tool (RSIT) (by random/random) to your Desktop.
• Double-click on RSIT.exe to launch the program.
• Click on Continue at the Disclaimer screen.
• If the HijackThis tool (updated version) is not present or detected on the computer, RSIT will download it (allow access in your firewall if prompted) and you will need to accept the license.
• Once the scan is complete, two text files will open. Post the content of log.txt (the one displayed on the screen) as well as info.txt (which you will see in the taskbar).

Note: reports are saved in the folder C:\rsit.
--
@+

le log:
Log du programme d'information système de random 1.06 (écrit par random/random)
Exécuté par gta le 2010-02-11 à 18:12:43
Microsoft Windows XP Édition Familiale Service Pack 3
Le disque système C: a 21 Go (14 %) libres sur 153 Go
RAM totale : 1023 Mo (51 % libre)

Log de Trend Micro HijackThis v2.0.2
Analyse enregistrée à 18:12:56, le 11/02/2010
Plateforme : Windows XP SP3 (WinNT 5.01.2600)
MSIE : Impossible d'obtenir la version d'Internet Explorer !
Mode de démarrage : Normal

Processus en cours :
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\gta\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\gta\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\gta\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\gta\Mes documents\Downloads\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\gta.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Page de démarrage = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,Nom du dossier Liens = Liens
O1 - Hosts: 79.106.2.131 localhost
O1 - Hosts: 79.106.2.131 facebook.com
O1 - Hosts: 79.106.2.131 www.facebook.com
O2 - BHO : AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO : Plugin de téléchargement et d'enregistrement RealPlayer pour Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO : Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO : Classe FDMIECookiesBHO - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO : Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO : JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run : [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run : [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run : [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run : [Surf-Barre] C:\Documents and Settings\gta\Mes documents\Downloads\Surf-Barre.exe
O4 - HKCU\..\Run : [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run : [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (Utilisateur 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (Utilisateur 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (Utilisateur 'SYSTEME')
O4 - HKUS\.DEFAULT\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (Utilisateur 'Utilisateur par défaut')
O8 - Élément supplémentaire du menu contextuel : Ajouter à Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Élément supplémentaire du menu contextuel : Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Élément supplémentaire du menu contextuel : Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Élément supplémentaire du menu contextuel : Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Élément supplémentaire du menu contextuel : Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Élément supplémentaire du menu contextuel : Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Bouton supplémentaire : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (fichier manquant)
O9 - Élément de menu supplémentaire 'Outils' : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (fichier manquant)
O9 - Bouton supplémentaire : (pas de nom) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Élément de menu supplémentaire 'Outils' : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Bouton supplémentaire : Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Élément de menu supplémentaire 'Outils' : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF : {1E54D648-B804-468d-BC78-4AFFED8E262E} (Laboratoire des exigences système) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab
O16 - DPF : {1E54D648-B804-468d-BC78-4AFFED8E262F} (Laboratoire des exigences système) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF : {4EFA317A-8569-4788-B175-5BAF9731A549} (Contrôle avancé VMRC de Microsoft Virtual Server) - https://www.windowsvistatestdrive.com/sp1/ActiveX/VMRCActiveXClient1.cab
O16 - DPF : {C212D449-8B3C-41F2-BD9A-047BD770550F} (Classe Perparer) - http://www.fiaa.eu/OPLauncher.cab
O16 - DPF : {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (Classe MessengerStatsClient) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF : {D27CDB6E-AE6D-11CF-96B8-444553540000} (Objet Shockwave Flash) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF : {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Classe Virtools WebPlayer) - http://a532.g.akamai.net/...
O23 - Service : Autodesk Licensing Service - Propriétaire inconnu - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service : Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service : Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service : FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service : Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service : Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service : InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service : Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service : NMSAccessU - Propriétaire inconnu - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service : NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service : Power Manager (PowerManager) - Propriétaire inconnu - C:\WINDOWS\svchost.exe (fichier manquant)
O23 - Service : ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service : TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service : TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
Fin du fichier - 7643 octets

======Dossier des tâches planifiées======

C:\WINDOWS\tasks\Automatic maintenance.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-299502267-1801674531-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-299502267-1801674531-1004UA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-299502267-1801674531-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-299502267-1801674531-1005UA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-299502267-1801674531-1007Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-299502267-1801674531-1007UA.job
C:\WINDOWS\tasks\Maintenance en 1 clic.job

======Dump du registre======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
Plugin de téléchargement et d'enregistrement RealPlayer pour Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-08-01 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
Classe FDMIECookiesBHO - C:\Program Files\Free Download Manager\iefdm2.dll [2008-12-30 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
Classe JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-08-01 198160]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-02-20 1443072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Surf-Barre"=C:\Documents and Settings\gta\Mes documents\Downloads\Surf-Barre.exe [2010-01-25 1386496]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\eMule\eMule.exe"="C:\Program Files\eMule\eMule.exe:*:Enabled:eMule"
"C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application"
"C:\WINDOWS\system32\usmt\migwiz.exe"="C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Assistant Transfert de fichiers et de paramètres"
"C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorateur Windows"
"C:\Program Files\Steam\steamapps\can57340\condition zero\hl.exe"="C:\Program Files\Steam\steamapps\can57340\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\sofiene57\condition zero\hl.exe"="C:\Program Files\Steam\steamapps\sofiene57\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\can57340\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\can57340\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\can57340\dedicated server\hlds.exe"="C:\Program Files\Steam\steamapps\can57340\dedicated server\hlds.exe:*:Enabled:HLDS Launcher"
"C:\Program Files\Steam\steamapps\yasin57340\condition zero\hl.exe"="C:\Program Files\Steam\steamapps\yasin57340\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\sofiene57\half-life\hl.exe"="C:\Program Files\Steam\steamapps\sofiene57\half-life\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Documents and Settings\gta\Mes documents\Téléchargements\Nouveau dossier\czero.exe"="C:\Documents and Settings\gta\Mes documents\Téléchargements\Nouveau dossier\czero.exe:*:Enabled:Condition Zero Launcher"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"C:\Documents and Settings\gta\temp\TeamViewer\Version4\TeamViewer.exe"="C:\Documents and Settings\gta\temp\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\Autodesk\backburner\monitor.exe"="C:\Program Files\Autodesk\backburner\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\Autodesk\backburner\manager.exe"="C:\Program Files\Autodesk\backburner\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\Autodesk\backburner\server.exe"="C:\Program Files\Autodesk\backburner\server.exe:*:Enabled:backburner 2.3 server"
"C:\3dsmax7\3dsmax.exe"="C:\3dsmax7\3dsmax.exe:*:Enabled:3ds max 7"
"C:\Program Files\backburner 2\monitor.exe"="C:\Program Files\backburner 2\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\backburner 2\manager.exe"="C:\Program Files\backburner 2\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\backburner 2\server.exe"="C:\Program Files\backburner 2\server.exe:*:Enabled:backburner 2.3 server"
"C:\Documents and Settings\gta\Local Settings\Application Data\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\gta\Local Settings\Application Data\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Program Files\Counter-Strike 1.6 V40\hl.exe"="C:\Program Files\Counter-Strike 1.6 V40\hl.exe:*:Enabled:Half-Life Launcher"
"C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======Liste des fichiers/dossiers créés au cours du dernier mois======

2010-02-11 18:12:44 ----D---- C:\Program Files\trend micro
2010-02-11 18:12:43 ----D---- C:\rsit
2010-02-10 12:56:12 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 12:55:57 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 12:50:40 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 12:50:29 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 12:50:13 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 12:50:01 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 12:49:50 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 12:49:38 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 12:49:23 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-09 19:13:52 ----D---- C:\Documents and Settings\gta\Application Data\Malwarebytes
2010-02-09 19:13:39 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-02-09 19:13:37 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-09 18:13:25 ----A---- C:\WINDOWS\system32\libusb0.dll
2010-02-08 19:54:06 ----D---- C:\Program Files\ESET
2010-01-29 22:12:02 ----D---- C:\Program Files\Windows Journal Viewer
2010-01-23 10:47:02 ----D---- C:\video_output
2010-01-23 10:45:13 ----A---- C:\WINDOWS\system32\AVERM.dll
2010-01-23 10:45:13 ----A---- C:\WINDOWS\system32\AVEQT.dll
2010-01-23 10:45:10 ----D---- C:\Program Files\Allok 3GP PSP MP4 iPod Video Converter
2010-01-19 18:08:08 ----D---- C:\Documents and Settings\gta\Application Data\VitySoft
2010-01-18 17:23:17 ----D---- C:\Program Files\Counter-Strike 1.6 V40
2010-01-18 11:48:09 ----D---- C:\Program Files\GameHouse
2010-01-16 12:01:38 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-01-16 12:01:37 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-01-16 12:01:36 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-01-16 12:01:34 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-01-16 12:01:32 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-01-16 12:01:29 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-01-16 12:01:05 ----D---- C:\Program Files\OpenAL
2010-01-16 12:01:05 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2010-01-16 12:01:04 ----A---- C:\WINDOWS\system32\OpenAL32.dll

======Liste des fichiers/dossiers modifiés au cours du dernier mois======

2010-02-11 18:12:44 ----D---- C:\WINDOWS\Temp
2010-02-11 18:12:44 ----D---- C:\Program Files
2010-02-11 17:37:11 ----D---- C:\WINDOWS
2010-02-11 17:20:33 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-10 21:54:04 ----D---- C:\Program Files\Mozilla Firefox
2010-02-10 14:41:07 ----D---- C:\WINDOWS\system32\drivers
2010-02-10 14:41:07 ----D---- C:\WINDOWS\system32
2010-02-10 14:41:05 ----HD---- C:\WINDOWS\inf
2010-02-10 14:40:16 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-10 13:08:03 ----D---- C:\WINDOWS\Prefetch
2010-02-10 12:56:08 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-10 12:56:03 ----A---- C:\WINDOWS\imsins.BAK
2010-02-10 12:56:01 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-09 19:13:46 ----D---- C:\Program Files\Internet Explorer
2010-02-09 19:07:41 ----D---- C:\WINDOWS\ie8updates
2010-02-09 19:06:52 ----DC---- C:\WINDOWS\ie8
2010-02-09 19:06:18 ----D---- C:\WINDOWS\system32\fr-fr
2010-02-09 19:05:11 ----D---- C:\WINDOWS\Help
2010-02-09 19:05:08 ----D---- C:\WINDOWS\WBEM
2010-02-09 19:05:07 ----D---- C:\WINDOWS\Media
2010-02-09 12:57:29 ----SHD---- C:\WINDOWS\Installer
2010-02-09 12:56:35 ----D---- C:\Program Files\Google
2010-02-06 23:32:01 ----D---- C:\WINDOWS\Minidump
2010-02-06 12:35:41 ----D---- C:\Downloads
2010-02-04 13:00:16 ----D---- C:\Documents and Settings\gta\Application Data\dvdcss
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-29 22:12:02 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2010-01-23 23:11:10 ----D---- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2010-01-23 23:09:35 ----D---- C:\Program Files\Messenger Plus! Live
2010-01-23 22:38:21 ----D---- C:\Program Files\Steam
2010-01-23 22:31:45 ----D---- C:\Program Files\CDBurnerXP
2010-01-23 22:30:09 ----D---- C:\Program Files\eMule
2010-01-18 22:47:21 ----D---- C:\Program Files\Fichiers communs\DVDVideoSoft

======Liste des pilotes (R=En cours, S=Arrêté, 0=Démarrage, 1=Système, 2=Auto, 3=Demande, 4=Désactivé)======

R1 AmdK7;Pilote de processeur AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41856]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-02-20 29704]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 33800]
R1 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-09-03 278984]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys

• Display all files and folders:

• Click on start/control panel (in classic view) > folder options > view

• Check "show hidden files and folders"

• Uncheck "hide protected operating system files (recommended)"

• Uncheck "hide extensions for known file types"

• Then click "apply" to confirm the changes.

• And Ok

#########

Go to this site: https://www.virustotal.com/gui/

Click on browse and look for this file: C:\WINDOWS\system32\libusb0.dll

Click on submit file.

Once the file analysis is complete, share with me the result link.

--
@+

Désolé, je ne peux pas accéder à des liens ou contenus externes.

• Download OTM (OldTimer) to your Desktop.
• Right-click on OTM.exe and choose Run as administrator.
• Copy (Ctrl+C) the following text below:

:processes
explorer.exe

:files
C:\Documents and Settings\gta\My Documents\Downloads\Surf-Barre.exe

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Surf-Barre"=-

:commands
[purity]
[emptytemp]
[reboot]

• Paste (Ctrl+V) the previously copied text into the Paste Instructions for Items to be Moved box.
• Now click the MoveIt! button and then close OTM.

---> If a file or folder cannot be deleted immediately, the software will ask you to restart.
Accept by clicking YES.

• Post the report located in this folder: C:\_OTM\MovedFiles\
---> The report name corresponds to the time it was created: date_time.log

###########

• Download Malwarebytes' Anti-Malware (MBAM) to your Desktop.
• Double-click the downloaded file to start the installation process.
• In the Update tab, click on the Check for updates button: if the firewall asks for permission for MBAM to connect to the Internet, accept.
• Once the update is complete, go to the Scan tab.
• Select Run a quick scan.
• Click on Scan. The scan begins.
• At the end of the scan, a message appears:

"The scan has completed normally. Click 'View Results' to see all objects found."

• Click OK to proceed. If MBAM found nothing, it will also tell you.
• Close your browsers.
• If any malware has been detected, click on View Results.
• Select all (or leave checked) and click on Remove Selected, MBAM will destroy the infected files and registry keys and place a copy in quarantine.
• MBAM will open Notepad and copy the scan report there. Copy and paste this report into your next response.

--
@+

Uh... I deleted winno.exe, I no longer have the problem. I did a scan last night (after running winno for the first time), with MBAM, it found 7 infections that I deleted, but winno was still there, and now I no longer have the problem with winno.
Thank you very much.

Okay, safe travels.
--
See you.

Alright, thank you and to you too.

You're welcome, it's my pleasure ;)
--
See you!