Infecté par un virus!!!

Merci pour ta réponse moment de grace, je teste ça!

Le scann est trop long, ça fait 20 min. que je l'ai lancé et il n'est qu'à 60%. Est-ce que c'est normal?

Voici le rapport de FindyKill:


############################## | FindyKill V5.035 |

# User : MAGOMERZAEV (Administrateurs) # PC-DE-HIZIR
# Update on 08/02/2010 by El Desaparecido
# Start at: 14:10:08 | 17.02.2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
# Internet Explorer 7.0.6000.16386
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 226,86 Go (98,91 Go free) [HP] # NTFS
# D:\ # Disque fixe local # 6,02 Go (666,89 Mo free) [Recovery] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nonoh.net\Nonoh\nonoh.exe
C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Users\MAGOMERZAEV\AppData\Local\cckyi.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Windows\VPro620.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\MAGOMERZAEV\Desktop\Hjt (2).exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\msiexec.exe
C:\Program Files\aMSN\bin\wish.exe
C:\Windows\explorer.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |

D:\autorun.inf

################## | C:\Windows |


################## | C:\Windows\Prefetch |


################## | C:\Windows\system32 |

C:\Windows\system32\AutoRun.inf

################## | C:\Windows\system32\drivers |


################## | C:\Users\MAGOMERZAEV\AppData\Roaming |


################## | Temporary Internet Files |


################## | Zip ... |


################## | Registre |


################## | Etat |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Uac : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 3 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 3 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.035 ! |

moment de grace, tu peux me dire ce que t'en pense s'il te plait?

Voici le nouveau rapport:

############################## | FindyKill V5.035 |

# User : MAGOMERZAEV (Administrateurs) # PC-DE-HIZIR
# Update on 08/02/2010 by El Desaparecido
# Start at: 14:47:14 | 17.02.2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
# Internet Explorer 7.0.6000.16386
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 226,86 Go (102,06 Go free) [HP] # NTFS
# D:\ # Disque fixe local # 6,02 Go (666,89 Mo free) [Recovery] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHReconfSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\runonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |

Supprimé ! D:\autorun.inf

################## | C:\Windows |


################## | C:\Windows\Prefetch |


################## | C:\Windows\system32 |

Supprimé ! C:\Windows\system32\AutoRun.inf

################## | C:\Windows\system32\drivers |


################## | C:\Users\MAGOMERZAEV\AppData\Roaming |


################## | MD5 ... |


################## | CRC32 ... |

################## | Temporary Internet Files |


################## | Registre |


################## | Etat |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 3 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | Fichiers corrompus # Réinstallation requise |

... OK !

################## | Upload |

Veuillez envoyer le fichier : C:\FindyKill_Upload_Me_PC-de-Hizir.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

################## | ! Fin du rapport # FindyKill V5.035 ! |

Le rapport de log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by MAGOMERZAEV at 2010-02-17 15:18:50
Microsoft® Windows Vista™ Édition Familiale Premium
System drive C: has 104 GB (45%) free of 232 GB
Total RAM: 1022 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:19:12, on 17.02.2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nonoh.net\Nonoh\nonoh.exe
C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Users\MAGOMERZAEV\AppData\Local\cckyi.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Windows\VPro620.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hp\kbd\kbd.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\MAGOMERZAEV\Desktop\RSIT.exe
C:\Users\MAGOMERZAEV\Desktop\MAGOMERZAEV.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Program Files\Mail.Ru\Agent\Mra\dll\newmrasearch.dll
R3 - URLSearchHook: ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll
R3 - URLSearchHook: (no name) - {93cadcb6-7c80-4672-ae2d-7df92eb4f95e} - (no file)
R3 - URLSearchHook: myBabylon English4 Toolbar - {fc600575-3013-4e8e-941c-4b00dafce730} - C:\Program Files\myBabylon_English4\tbmyBa.dll
O1 - Hosts: ::1 localhost
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: ???????@Mail.Ru - {8984B388-A5BB-4DF7-B274-77B879E179DB} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: myBabylon English4 Toolbar - {fc600575-3013-4e8e-941c-4b00dafce730} - C:\Program Files\myBabylon_English4\tbmyBa.dll
O3 - Toolbar: ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll
O3 - Toolbar: (no name) - {93cadcb6-7c80-4672-ae2d-7df92eb4f95e} - (no file)
O3 - Toolbar: myBabylon English4 Toolbar - {fc600575-3013-4e8e-941c-4b00dafce730} - C:\Program Files\myBabylon_English4\tbmyBa.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MAgent] C:\Program Files\Mail.Ru\Agent\MAgent.exe -LM
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Nonoh] "C:\Program Files\Nonoh.net\Nonoh\nonoh.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [cckyi] "c:\users\magomerzaev\appdata\local\cckyi.exe" cckyi
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: VPro620.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Mail.Ru ????? - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra 'Tools' menuitem: Mail.Ru ????? - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: ?????? iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

le rapport de info.txt:

info.txt logfile of random's system information tool 1.06 2010-02-17 15:19:21

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Acoustica Effects Pack-->C:\PROGRA~1\ACOUST~2\UNWISE.EXE C:\PROGRA~1\ACOUST~2\INSTALL.LOG
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Premiere Pro Tryout-->RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{084709F7-38C5-4609-B55F-2417939315EB}\setup.exe"
Adobe Reader 7.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A71000000002}
Adobe Shockwave Player-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
Adobe Support Advisor-->msiexec /qb /x {443DC1E4-965E-EA2C-3BA2-5BEA7C00E353}
Adobe Support Advisor-->MsiExec.exe /I{443DC1E4-965E-EA2C-3BA2-5BEA7C00E353}
aMSN 0.97.2-->C:\Program Files\aMSN\uninstall.exe
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ASIO4ALL-->C:\Program Files\ASIO4ALL v2\uninstall.exe
Ask Toolbar-->"C:\Program Files\AskBarDis\unins000.exe"
Ask Toolbar-->rundll32 C:\PROGRA~1\AskTBar\bar\1.bin\AskTBar.dll,O
Athan Basic 3.5-->C:\Windows\iun6002.exe "C:\Program Files\Athan\irunin.ini"
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Audio Editor Gold v8.4.4-->"C:\Program Files\Audio Editor Gold\unins000.exe"
AVIcodec (remove only)-->"C:\Program Files\AVIcodec\uninst.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins001.exe"
Blender (remove only)-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CCScore-->MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}
CD MP3 Ripper 1.0-->"C:\Program Files\CDMP3Ripper\unins000.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Codeur Windows Media Série 9-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Codeur Windows Media Série 9-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Collab-->C:\Program Files\Image-Line\Collab\uninstall.exe
Cool Edit 2000-->C:\Program Files\Cool2000\ce2Kunin.exe
COSMOSEMS 2008 SP0-->MsiExec.exe /I{EF7C9D3E-4AB1-454E-AAE8-06FBA201B63D}
DivX Plus Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Empires And Dungeons-->"C:\Program Files\Empires And Dungeons\ReflexiveArcade\unins000.exe"
eMule 0.49c-->MsiExec.exe /I{E348B879-F482-441E-AB35-21C648D09744}
ESSBrwr-->MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}
ESSCDBK-->MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
ESScore-->MsiExec.exe /I{42938595-0D83-404D-9F73-F8177FDD531A}
ESSgui-->MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}
ESSini-->MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}
ESSPCD-->MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
ESSPDock-->MsiExec.exe /I{FCDB1C92-03C6-4C76-8625-371224256091}
ESSSONIC-->MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34}
ESSTOOLS-->MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}
essvatgt-->MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}
Express Burn-->C:\Program Files\NCH Swift Sound\ExpressBurn\uninst.exe
Express Dictate-->C:\Program Files\NCH Swift Sound\Express\uninst.exe
Express Rip-->C:\Program Files\NCH Swift Sound\ExpressRip\uninst.exe
EZdrummer-->MsiExec.exe /I{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}
EZXCocktail-->MsiExec.exe /I{147567F0-8575-4BE0-B5B3-62706C67FA5A}
Favorit-->c:\users\magomerzaev\appdata\local\gopxq.bat
fflink-->MsiExec.exe /I{608D2A3C-6889-4C11-9B54-A42F45ACBFDB}
FL Studio 8-->C:\Program Files\Image-Line\FL Studio 8\uninstall.exe
GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
GIMP 2.4.5-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Gunner 2-->"C:\Program Files\Gunner 2\ReflexiveArcade\unins000.exe"
HijackThis 2.0.2-->"C:\Users\MAGOMERZAEV\Desktop\HijackThis.exe" /uninstall
Hotfix for Windows Media Encoder (KB929182)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={5406B219-A1AC-4BC4-8695-72292C8195AC} /qb
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}\setup.exe" -l0x9 -removeonly
HP Easy Setup - Core-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}\setup.exe" -l0x9
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40F7AED3-0C7D-4582-99F6-484A515C73F2}\setup.exe" -l0x9 -removeonly
HP On-Screen Caps/Num/Scroll Lock Indicator-->C:\Windows\system32\OsdRemove.exe
HP Picasso Media Center Add-In-->MsiExec.exe /I{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
ICE Book Reader Professional v8.9.2-->"C:\Program Files\ICE Book Reader Professional\unins000.exe"
IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0}
Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe
iTunes-->MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
iZotope Ozone 4-->"C:\Program Files\iZotope\Ozone 4\unins000.exe"
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
Kantaris Media Player 0.3.2-->"C:\Program Files\Kantaris\unins000.exe"
kgcbaby-->MsiExec.exe /I{E18B549C-5D15-45DA-8D8F-8FD2BD946344}
kgcbase-->MsiExec.exe /I{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}
kgchday-->MsiExec.exe /I{11F3F858-4131-4FFA-A560-3FE282933B6E}
kgchlwn-->MsiExec.exe /I{03EDED24-8375-407D-A721-4643D9768BE1}
kgcinvt-->MsiExec.exe /I{9BD54685-1496-46A5-AB62-357CD140ED8B}
kgckids-->MsiExec.exe /I{693C08A7-9E76-43FF-B11E-9A58175474C4}
kgcmove-->MsiExec.exe /I{A1588373-1D86-4D44-86C9-78ABD190F9CC}
kgcvday-->MsiExec.exe /I{8A8664E1-84C8-4936-891C-BC1F07797549}
KSU-->MsiExec.exe /I{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}
Logiciel Intel® Viiv™-->MsiExec.exe /X{6E7BF6EC-C3E7-43A7-8A03-0D204E3EC01B} /qb!
Logiciel Kodak EasyShare-->C:\ProgramData\Kodak\EasyShareSetup\$SETUP_140002_22e1668\Setup.exe /APR-REMOVE
Mail.Ru ????? 5.1 (?????? 2243, ??? ???? ?????????????)-->C:\Program Files\Mail.Ru\Agent\magentsetup.exe -uninstalllm
Mail.Ru ??????? 2.0-->C:\Program Files\Mail.Ru\Sputnik\SputnikInstaller.exe -uninstall
Microsoft Search Enhancement Pack-->MsiExec.exe /I{299CF645-48C7-4FA1-8BCD-5CE200CF180D}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Mozilla Firefox (3.5.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MP3 CD Maker-->"C:\Program Files\mp3cd\unins000.exe"
mRadio Toolbar-->C:\PROGRA~1\mRadio\UNWISE.EXE /U C:\PROGRA~1\mRadio\INSTALL.LOG
myBabylon_English4 Toolbar-->C:\PROGRA~1\MYBABY~1\UNWISE.EXE /U C:\PROGRA~1\MYBABY~1\INSTALL.LOG
Native Instruments Kore Player-->C:\PROGRA~1\NATIVE~1\KOREPL~1\UNWISE.EXE C:\PROGRA~1\NATIVE~1\KOREPL~1\INSTALL.LOG
Native Instruments Service Center-->C:\PROGRA~1\NATIVE~1\SERVIC~1\UNWISE.EXE C:\PROGRA~1\NATIVE~1\SERVIC~1\INSTALL.LOG
Naval Strike-->"C:\Program Files\Naval Strike\ReflexiveArcade\unins000.exe"
netbrdg-->MsiExec.exe /I{4537EA4B-F603-4181-89FB-2953FC695AB1}
Nonoh-->"C:\Program Files\Nonoh.net\Nonoh\unins000.exe"
Notifier-->MsiExec.exe /I{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA Stereoscopic 3D Driver-->C:\Windows\system32\nvStInst.exe /uninstall /ask
OfotoXMI-->MsiExec.exe /I{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}
Opera 9.64-->MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620}
Orange menu toepassing-->C:\Program Files\Orange\GLOBAL\Mnu\uninst.exe /G:{80CA15EA-C0A5-7CAF-B9E9-B8B2A87EFE11}
Orange registratie toepassing-->C:\Program Files\Orange\GLOBAL\Sung\uninst.exe /G:{90CA15EA-C0A5-7CAF-B9E9-B8B2A87EFE11}
Outils de diagnostic du matériel-->C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
Package de pilotes Windows - Philips (SPC620) Image (06/29/2007 1.50.1.4830)-->C:\PROGRA~1\DIFX\270581355A767BF1\DPInst32.exe /u C:\Windows\System32\DriverStore\FileRepository\spc620.inf_06f91b07\spc620.inf
Package de pilotes Windows - Philips USB (06/29/2007 1.50.1.4830)-->C:\PROGRA~1\DIFX\270581355A767BF1\DPInst32.exe /u C:\Windows\System32\DriverStore\FileRepository\spc620c.inf_80be11ee\spc620c.inf
Philips SPC620NC Webcam-->C:\Program Files\InstallShield Installation Information\{5CA6F170-E18D-4B4C-8670-3ED096478C41}\Setup.exe -runfromtemp -l0x040c -removeonly
Philips VLounge-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EA57A1B9-0DD2-44DD-9B70-64E8DA553F6F}\Setup.exe" -l0x9
PhotoDVD 2.9.6.1d-->"C:\Program Files\vso\PhotoDVD\unins000.exe"
Pianissimo-->C:\PROGRA~1\PIANIS~1\Unwise.exe
PoiZone-->C:\Program Files\Image-Line\PoiZone\uninstall.exe
PVSonyDll-->MsiExec.exe /I{3D3E663D-4E7E-4577-A560-7ECDDD45548A}
Python 2.4.3-->MsiExec.exe /I{75E71ADD-042C-4F30-BFAC-A9EC42351313}
QuickTime-->MsiExec.exe /I{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
RM-X® Mov To DivX-->"C:\Program Files\RM-X® Mov To DivX\unins000.exe"
Roxio Creator Audio-->MsiExec.exe /X{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Basic v9-->MsiExec.exe /X{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Copy-->MsiExec.exe /X{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /X{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator EasyArchive-->MsiExec.exe /X{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
Roxio Creator Tools-->MsiExec.exe /X{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler 3-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD Basic v9-->MsiExec.exe /X{E4A02A3F-4F8A-4D94-BB99-68BC1D1CF6DB}
SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -l0x40c -removeonly
Samsung PC Studio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x40c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Windows Media Encoder (KB954156)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={E836F1B7-43FB-46B0-A0D9-E4D2A5951659} /qb
SFR-->MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}
SHASTA-->MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237}
skin0001-->MsiExec.exe /I{5316DFC9-CE99-4458-9AB3-E8726EDE0210}
SKINXSDK-->MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}
Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SLOW-PCfighter-->C:\Program Files\Fighters\SLOW-PCfighter\Uninstall.exe
SLOW-PCfighter-->MsiExec.exe /X{B53671B5-D9A4-4554-9437-680533116875}
Solution de clavier multimédia amélioré-->C:\HP\KBD\Install.exe /u
Spooky Sounds-->MsiExec.exe /I{FF88307C-AEA0-4978-AB94-D5C5BF902B5C}
staticcr-->MsiExec.exe /I{8943CE61-53BD-475E-90E1-A580869E98A2}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TomTom HOME 2.7.3.1894-->C:\Program Files\TomTom HOME 2\Uninstall TomTom HOME.exe
tooltips-->MsiExec.exe /I{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}
Total Video Converter 3.20 090114-->"C:\Program Files\Total Video Converter\unins000.exe"
Totally Free Burner-->"C:\Program Files\Totally Free Burner\unins000.exe"
Tournament.com 1.0.0.166-->"C:\Program Files\Tournament.com\unins000.exe"
Toxic Biohazard-->C:\Program Files\Image-Line\Toxic Biohazard\uninstall.exe
Virtual Dj Studio 5.3-->"C:\Program Files\VDJ5\unins000.exe"
VPRINTOL-->MsiExec.exe /I{999D43F4-9709-4887-9B1A-83EBB15A8370}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Movie Maker 2.6-->MsiExec.exe /X{B3DAF54F-DB25-4586-9EF1-96D24BB14088}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WIRELESS-->MsiExec.exe /I{F9593CFB-D836-49BC-BFF1-0E669A411D9F}
ZipGenius 6 (6.0.3.1150)-->"C:\Program Files\ZipGenius 6\unins000.exe"

======Security center information======

AS: Windows Defender (outdated)

======System event log======

Computer Name: PC-de-Hizir
Event Code: 3004
Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
Pour plus d’informations, consultez les données suivantes :
Non applicable
ID d’analyse : {0E2BC025-D818-4D02-9E6A-47E68B12ADA6}
Utilisateur : PC-de-Hizir\MAGOMERZAEV
Nom : Unknown
ID :
ID de gravité :
ID de catégorie :
Chemin d’accès trouvé : regkey:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\FindyKill;runonce:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\FindyKill;file:C:\FyK\GO.cmd
Type d’alerte : Logiciel non classifié
Type de détection :
Record Number: 849676
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20100217134308.000000-000
Event Type: Avertissement
User:

Computer Name: PC-de-Hizir
Event Code: 20
Message: Échec de l'installation : l'installation de la mise à jour suivante a échoue avec l'erreur 0x80073712 : Mise à jour pour Windows Vista (KB976098).
Record Number: 849678
Source Name: Microsoft-Windows-WindowsUpdateClient
Time Written: 20100217134426.893162-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Hizir
Event Code: 7000
Message: Le service Parallel port driver n'a pas pu démarrer en raison de l'erreur :
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.
Record Number: 849726
Source Name: Service Control Manager
Time Written: 20100217134731.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-Hizir
Event Code: 7023
Message: Le service Net Driver HPZ12 s'est arrêté avec l'erreur :
Le fichier spécifié est introuvable.
Record Number: 849739
Source Name: Service Control Manager
Time Written: 20100217134731.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-Hizir
Event Code: 7023
Message: Le service Pml Driver HPZ12 s'est arrêté avec l'erreur :
Le fichier spécifié est introuvable.
Record Number: 849741
Source Name: Service Control Manager
Time Written: 20100217134731.000000-000
Event Type: Erreur
User:

=====Application event log=====

Computer Name: PC-de-Hizir
Event Code: 11935
Message: Product: MSXML 4.0 SP2 (KB954430) -- Error 1935. An error occured during the installation of assembly component {7B30B69B-0E6C-B7E0-A06B-D6B9ABF34537}. HRESULT: 0x80073712. assembly interface: IAssemblyCacheItem, function: Commit, assembly name: Microsoft.MSXML2,type="win32",version="4.20.9870.0",publicKeyToken="6bd6b9abf345378f",processorArchitecture="x86"
Record Number: 96472
Source Name: MsiInstaller
Time Written: 20100217130157.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Hizir
Event Code: 33
Message: La création du contexte d’activation a échoué pour « C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe ». Assembly dépendant Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé.
Record Number: 96553
Source Name: SideBySide
Time Written: 20100217141010.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-Hizir
Event Code: 33
Message: La création du contexte d’activation a échoué pour « C:\Program Files\TomTom HOME 2\TomTomHOME.exe ». Assembly dépendant Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé.
Record Number: 96554
Source Name: SideBySide
Time Written: 20100217141023.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-Hizir
Event Code: 33
Message: La création du contexte d’activation a échoué pour « C:\Program Files\TomTom HOME 2\TomTomHOME.exe ». Assembly dépendant Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé.
Record Number: 96555
Source Name: SideBySide
Time Written: 20100217141023.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-Hizir
Event Code: 33
Message: La création du contexte d’activation a échoué pour « C:\Program Files\TomTom HOME 2\TomTomHOME.exe ». Assembly dépendant Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé.
Record Number: 96556
Source Name: SideBySide
Time Written: 20100217141048.000000-000
Event Type: Erreur
User:

=====Security event log=====

Computer Name: PC-de-Hizir
Event Code: 4689
Message: Un processus est terminé.

Sujet :
ID de sécurité : S-1-5-21-2188641158-1201864951-1172457240-1003
Nom du compte : Akram
Domaine du compte : PC-de-Hizir
ID d’ouverture de session : 0x1002c5a

Informations sur le processus :
ID du processus : 0xf10
Nom du processus : C:\Program Files\QuickTime\qttask.exe
État de fin : 0x40010004
Record Number: 215800
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090929224337.354500-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-Hizir
Event Code: 4689
Message: Un processus est terminé.

Sujet :
ID de sécurité : S-1-5-21-2188641158-1201864951-1172457240-1003
Nom du compte : Akram
Domaine du compte : PC-de-Hizir
ID d’ouverture de session : 0x1002c5a

Informations sur le processus :
ID du processus : 0xdc4
Nom du processus : C:\Windows\System32\wpcumi.exe
État de fin : 0x40010004
Record Number: 215801
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090929224337.354500-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-Hizir
Event Code: 4689
Message: Un processus est terminé.

Sujet :
ID de sécurité : S-1-5-21-2188641158-1201864951-1172457240-1003
Nom du compte : Akram
Domaine du compte : PC-de-Hizir
ID d’ouverture de session : 0x1002c5a

Informations sur le processus :
ID du processus : 0x1340
Nom du processus : C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
État de fin : 0x40010004
Record Number: 215802
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090929224337.370100-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-Hizir
Event Code: 4689
Message: Un processus est terminé.

Sujet :
ID de sécurité : S-1-5-21-2188641158-1201864951-1172457240-1003
Nom du compte : Akram
Domaine du compte : PC-de-Hizir
ID d’ouverture de session : 0x1002c5a

Informations sur le processus :
ID du processus : 0x1318
Nom du processus : C:\Windows\RtHDVCpl.exe
État de fin : 0x40010004
Record Number: 215803
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090929224337.385700-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-Hizir
Event Code: 4689
Message: Un processus est terminé.

Sujet :
ID de sécurité : S-1-5-21-2188641158-1201864951-1172457240-1003
Nom du compte : Akram
Domaine du compte : PC-de-Hizir
ID d’ouverture de session : 0x1002c5a

Informations sur le processus :
ID du processus : 0xaa4
Nom du processus : C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
État de fin : 0x40010004
Record Number: 215804
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090929224337.401300-000
Event Type: Succès de l'audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\hp\bin\Python;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\ZipGenius 6\;C:\Program Files\Common Files\iZotope\Runtimes
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0f02
"NUMBER_OF_PROCESSORS"=2
"RoxioCentral"=c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
"PLATFORM"=HPD
"PCBRAND"=Pavilion
"OnlineServices"=Services en ligne
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Voilà j'ai fait tout ce ke tu m'a demandé, qu'est-ce que je dois faire maintenant?

oui crapoulou j'ai fait tous les scannes qu'il m'a demandé de faire mais j'ai toujours des fenêtres de pub qui s'ouvrent.

Bonsoir moment de grace, je n'ai pas fait le scann de usbfix car j'avais pas de clés usb sur moi. Voici le rapport de navilog1:

Fix Navipromo version 4.0.6 commencé le 17.02.2010 20:49:59,97

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 03.01.2010 à 11h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : MAGOMERZAEV ( Not Administrator ! )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:226 Go (Free:100 Go)
D:\ (Local Disk) - NTFS - Total:6 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)


Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur


c:\users\magome~1\appdata\local\virtua~1\progra~1\InternetGamebox supprimé !
c:\users\magome~1\appdata\local\virtua~1\progra~1\Live-Player supprimé !
C:\Windows\prefetch\LIVE-PLAYER_SETUP.EXE-2F7672CF.pf supprimé !
C:\Windows\prefetch\LIVE-PLAYER.EXE-038B57E5.pf supprimé !
C:\Windows\prefetch\gopxq*.pf supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\csuaiaa.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\csuaiaa_nav.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\csuaiaa_navps.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\csuaiaa_navup.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\dqfthdl.exe supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\dqfthdl.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\dqfthdl_nav.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\dqfthdl_navps.dat supprimé !
C:\Users\MAGOMERZAEV\AppData\Local\gopxq.bat supprimé !


Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\MAGOME~1\AppData\Local\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !



*** Scan terminé 17.02.2010 20:59:50,24 ***

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3753
Windows 6.0.6000
Internet Explorer 7.0.6000.16386

17.02.2010 23:21:11
mbam-log-2010-02-17 (23-21-11).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
Eléments examinés: 302679
Temps écoulé: 56 minute(s), 23 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{fffc57db-1de3-4303-b24d-cee6dcdd3d86} (Adware.MyCentria) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyCentria (Adware.MyCentria) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gaopdxserv.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\MyCentria (Adware.MyCentria) -> Quarantined and deleted successfully.
C:\Program Files\MyCentria\Firefox (Adware.MyCentria) -> Quarantined and deleted successfully.
C:\Program Files\MyCentria\InfoBar (Adware.MyCentria) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\mRadio\tbmRad.dll (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Users\MAGOMERZAEV\AppData\Local\VirtualStore\Windows\System32\tapi.nfo (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Users\MAGOMERZAEV\Downloads\InstallAVg_77024203.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-90-100005950-100032219-100012185-9976.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Akram\AppData\Local\Temp\~tmpa.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Akram\AppData\Local\Temp\~tmpd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

quel antivirus gratuit tu me recommanderait dans mon cas?

D'accord, je vais le faire demain. Mais en tout cas merci pour ton aide car j'ai supprimé pas mal de trojans grace à toi!

############################## | UsbFix V6.095 |

User : MAGOMERZAEV (Administrateurs) # PC-DE-HIZIR
Update on 15/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 13:35:53 | 18.02.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
Internet Explorer 7.0.6000.16386
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 226,86 Go (99,93 Go free) [HP] # NTFS
D:\ -> Disque fixe local # 6,02 Go (666,89 Mo free) [Recovery] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque amovible # 1,86 Go (1,38 Go free) [NOLIMIT] # FAT

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nonoh.net\Nonoh\nonoh.exe
C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Windows\VPro620.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmplayer.exe
K:\Nolimit.exe
C:\Windows\system32\SearchProtocolHost.exe

################## | Elements infectieux |

K:\autorun.inf
K:\NoLimit.exe

################## | Registre |


################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\F
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\demarrer.html

HKCU\..\..\Explorer\MountPoints2\{0280443d-8cb0-11de-a8c5-001a9299d00d}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL K:\NoLimit.exe

HKCU\..\..\Explorer\MountPoints2\{5736734c-da74-11de-b92d-001a9299d00d}
shell\AutoRun\command =

HKCU\..\..\Explorer\MountPoints2\{5913e739-b886-11dd-b8c2-001a9299d00d}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\demarrer.html

HKCU\..\..\Explorer\MountPoints2\{689d1bb4-0d81-11df-8e0d-001a9299d00d}
shell\AutoRun\command =K:\InstallTomTomHOME.exe

HKCU\..\..\Explorer\MountPoints2\{73dff8a9-d8f3-11db-9848-806e6f6e6963}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\RECYCLER\S-1-5-90-100005950-100032219-100012185-9976.com d:\
shell\Open\command =D:\RECYCLER\S-1-5-90-100005950-100032219-100012185-9976.com d:\

HKCU\..\..\Explorer\MountPoints2\{7928acfa-ad90-11dd-ab10-001a9299d00d}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\demarrer.html

HKCU\..\..\Explorer\MountPoints2\{bb0b64d9-c6ca-11de-b42e-001a9299d00d}
shell\AutoRun\command =

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné !

################## | ! Fin du rapport # UsbFix V6.095 ! |

c'est fait


############################## | UsbFix V6.095 |

User : MAGOMERZAEV (Administrateurs) # PC-DE-HIZIR
Update on 15/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 13:44:27 | 18.02.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
Internet Explorer 7.0.6000.16386
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 226,86 Go (99,69 Go free) [HP] # NTFS
D:\ -> Disque fixe local # 6,02 Go (666,89 Mo free) [Recovery] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque amovible # 1,86 Go (1,38 Go free) [NOLIMIT] # FAT

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\Explorer.EXE
C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHReconfSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\WerCon.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

Supprimé ! C:\$Recycle.Bin\S-1-5-18
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1365494002-316332048-1444418596-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2152478756-3922319563-605102323-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1001
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1003
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1004
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1005
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-501
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1001
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1003
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1004
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-1005
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-500
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2188641158-1201864951-1172457240-501
Supprimé ! K:\autorun.inf
Supprimé ! K:\NoLimit.exe

################## | Registre |


################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{0280443d-8cb0-11de-a8c5-001a9299d00d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{5736734c-da74-11de-b92d-001a9299d00d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{5913e739-b886-11dd-b8c2-001a9299d00d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{689d1bb4-0d81-11df-8e0d-001a9299d00d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{73dff8a9-d8f3-11db-9848-806e6f6e6963}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{7928acfa-ad90-11dd-ab10-001a9299d00d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{bb0b64d9-c6ca-11de-b42e-001a9299d00d}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[18.09.2006 22:43|--a------|24] C:\autoexec.bat
[02.11.2006 10:53|-rahs----|438840] C:\bootmgr
[15.03.2007 23:39|-ra-s----|8192] C:\BOOTSECT.BAK
[22.02.2008 11:27|--a------|63] C:\cdrlog.txt
[17.02.2010 20:59|--a------|2169] C:\cleannavi.txt
[12.10.2007 20:20|--a------|74] C:\CMLoader.log
[18.09.2006 22:43|--a------|10] C:\config.sys
[12.10.2007 19:54|--a------|0] C:\conmgr.log
[17.02.2010 15:07|--a------|1233] C:\FindyKill_Upload_Me_PC-de-Hizir.zip
[17.02.2010 15:08|--a------|3767] C:\FyK.txt
[?|?|?] C:\hiberfil.sys
[08.09.2007 07:37|-rahs----|0] C:\IO.SYS
[01.07.2009 12:32|--a------|777] C:\logfile
[02.03.2008 00:19|--a------|29186] C:\MP4debug.log
[08.09.2007 07:37|-rahs----|0] C:\MSDOS.SYS
[04.09.2008 01:11|--a------|54600] C:\npbittorrent.dll
[15.07.2009 15:07|--a------|0] C:\out.txt
[?|?|?] C:\pagefile.sys
[18.01.2010 16:55|--a------|2807] C:\rapport.txt
[15.03.2007 14:54|--a------|396] C:\RHDSetup.log
[06.02.2008 18:14|--a------|230432] C:\SPC220NC.DAT
[20.01.2010 11:53|--a------|3005] C:\TB.txt
[18.02.2010 13:48|--a------|5758] C:\UsbFix.txt
[04.10.2006 00:02|--ahs----|438328] D:\boo.mgr
[02.11.2006 01:53|--ahs----|438840] D:\bootmgr
[13.10.2006 15:00|--ahs----|1322] D:\Desktop.ini
[16.03.2007 00:52|--ahs----|106] D:\MASTER.LOG
[11.07.2007 13:29|--ahs----|487] D:\pcdr.ini
[10.09.2002 13:58|--ahs----|181616] D:\Protect.ed
[16.03.2007 00:52|--ahs----|44] D:\RESTORE.INI
[18.01.2007 12:10|--ahs----|34] D:\SystemRecovery.txt
[11.03.2008 09:54|--a------|65327] K:\ConditionsEN.txt
[15.11.2006 08:34|--a------|16216] K:\ConditionsFR.txt
[04.02.2009 16:15|--a------|2093] K:\Lisez-moi.txt
[04.02.2009 16:15|--a------|3774] K:\Nlm.ico
[18.02.2010 13:36|--a------|5190] K:\Nolimit.log
[19.08.2009 13:13|--a------|130] K:\000D88275DB8C941C38D021D.Cache
[14.07.2009 20:26|--a------|3961460] K:\Nejnaya pohodka.mp3
[03.01.2010 19:36|--a------|1630208] K:\silalleh.mp3
[28.02.2008 13:01|--a------|3895343] K:\Ma elha.mp3
[19.09.2007 21:30|--a------|3789623] K:\Nohchi vui.mp3
[30.01.2010 15:45|--a------|8254971] K:\Eurodance Guitar .mp3
[19.09.2007 21:32|--a------|8355896] K:\Z1aderza nohchi.mp3
[14.07.2009 20:22|--a------|2031535] K:\Jimalla.mp3
[14.07.2009 20:22|--a------|1874382] K:\Jimalla 2 (prodoljenie).mp3
[14.07.2009 20:24|--a------|9264867] K:\Tri lezginki.mp3
[14.07.2009 20:36|--a------|3604074] K:\Vaha_Bersanukaev-Diana(mix)(shax-dag.ru).mp3
[27.01.2010 14:04|--a------|4048898] K:\ace_of_base_-_happy_nation.mp3
[13.02.2009 16:39|--a------|2415638] K:\The Final Countdown.mp3
[13.02.2009 16:38|--a------|5425353] K:\The Unforgiven.mp3
[27.01.2010 13:43|--a------|1992832] K:\Nenan do1a.mp3
[13.02.2009 16:49|--a------|3489528] K:\What can I do.wma
[19.08.2009 14:22|--a------|4667068] K:\This is the life.mp3
[17.08.2007 23:12|--a------|9816565] K:\Sesan yurt.mp3
[14.07.2009 20:24|--a------|5285888] K:\Pondaran az.mp3
[18.02.2009 18:09|--a------|2255561] K:\Bezam.mp3
[18.08.2009 13:48|--a------|3877450] K:\Lekhachu lomara.mp3
[14.07.2009 20:25|--a------|6234942] K:\Nana (2).mp3
[13.02.2009 16:39|--a------|5006594] K:\Wind of change.mp3
[13.02.2009 16:49|--a------|6023352] K:\Holliday.wma
[14.07.2009 20:28|--a------|6993755] K:\Haza han.mp3
[14.07.2009 20:23|--a------|4535872] K:\Nohchi pondar.mp3
[18.02.2009 18:06|--a------|3578193] K:\Dahar ch1ana du.mp3
[18.05.2008 11:38|--a------|3492929] K:\Lovzaran illi.mp3
[19.09.2007 21:26|--a------|3604858] K:\Devushka s rodinkoy.mp3
[24.05.2009 21:25|--a------|4410502] K:\Kura k1ant.mp3
[13.02.2009 16:50|--a------|4128995] K:\Nana.mp3
[13.02.2009 16:38|--a------|6228027] K:\Hotel california.mp3
[13.02.2009 16:38|--a------|1957346] K:\Eye of the Tiger.mp3
[14.07.2009 21:37|--a------|6052762] K:\Ma h1eja h1o.mp3
[19.09.2007 21:29|--a------|5670663] K:\Massara ala.mp3
[28.02.2008 13:01|--a------|3895343] K:\???????.mp3
[28.02.2008 13:01|--a------|3895343] K:\?? ????.mp3
[14.11.2007 15:23|--a------|5066926] K:\Ci sar….mp3
[29.12.2008 18:24|--a------|6930432] K:\Tu soltanto tu.mp3
[29.12.2008 18:48|--a------|8373033] K:\Liberta.mp3
[13.02.2009 16:40|--a------|5994191] K:\Felicit….mp3
[11.06.2009 13:10|--a------|7315549] K:\arash.feat_aysel_-_alwayseurovision_2009_best_quality.mp3
[31.03.2009 21:48|--a------|3842176] K:\I wanna hear your hearthbeat.mp3
[28.01.2008 21:19|--a------|3404042] K:\Pretty young girl.mp3
[13.02.2009 16:42|--a------|7641531] K:\You're a woman.mp3
[25.03.2009 00:48|--a------|3498053] K:\Now you're gone.mp3
[25.02.2009 23:13|--a------|4608000] K:\Wonderful life.mp3
[12.01.2008 15:52|--a------|3939811] K:\Ma baker.mp3
[13.02.2009 16:40|--a------|5822464] K:\Bye bye bluebird.mp3
[05.10.2008 14:20|--a------|7692416] K:\Please forgive me.mp3
[13.02.2009 16:40|--a------|9053261] K:\Dov'Š l'amore.mp3
[13.02.2009 16:41|--a------|3580052] K:\Strong enough.mp3
[28.01.2008 22:54|--a------|3844096] K:\It's my life.mp3
[06.05.2009 20:27|--a------|4925568] K:\Sacrifice.mp3
[13.02.2009 16:40|--a------|3733576] K:\Lonely sleephead.mp3
[13.02.2009 16:40|--a------|7641088] K:\Le vent, le cri.mp3
[27.06.2008 13:32|--a------|5691392] K:\Tired of being sorry.mp3
[12.01.2008 16:37|--a------|3993013] K:\Pi— che poi.mp3
[13.02.2009 16:40|--a------|4228578] K:\My immortal.mp3
[13.02.2009 16:40|--a------|5745792] K:\Bring me to life.mp3
[13.02.2009 16:40|--a------|3838256] K:\Flames of love.mp3
[18.02.2009 16:36|--a------|14886518] K:\I like chopin.mp3
[29.03.2009 15:26|--a------|5343232] K:\Primavera in anticipo (It's my song).mp3
[13.02.2009 16:40|--a------|3840000] K:\Come Se Non Fosse Stato Mai Amore.mp3
[13.02.2009 16:40|--a------|3823211] K:\E ritorno da te.mp3
[02.06.2008 23:27|--a------|6021898] K:\Relax take it easy.mp3
[13.02.2009 16:40|--a------|4940235] K:\Moonlight Shadow.mp3
[30.01.2008 22:20|--a------|5244928] K:\Do you wanna.mp3
[30.01.2008 22:30|--a------|4587520] K:\You can win if you want.mp3
[13.02.2009 16:42|--a------|3248131] K:\You're my heart, you're my soul.mp3
[13.02.2009 16:40|--a------|4421632] K:\Brother Louis.mp3
[19.09.2007 21:24|--a------|5292160] K:\Little russian.mp3
[20.08.2008 14:04|--a------|3373665] K:\Lascia che io sia.mp3
[04.12.2007 20:24|--a------|8411264] K:\Violon.mp3
[13.05.2009 14:51|--a------|4939904] K:\Zemren late peng.mp3
[28.01.2008 22:33|--a------|7192576] K:\D.I.S.C.O..mp3
[19.09.2007 21:24|--a------|4702208] K:\Gelato al ciocolato.mp3
[13.02.2009 16:41|--a------|3584626] K:\Solo con te.mp3
[13.02.2009 16:41|--a------|3590887] K:\Senza fortuna.mp3
[25.08.2007 03:22|--a------|3461176] K:\Ciao.mp3
[13.02.2009 16:41|--a------|3196566] K:\Su di noi.mp3
[13.02.2009 16:40|--a------|4222976] K:\Come vorrei.mp3
[13.02.2009 16:40|--a------|7557092] K:\LIsten to your heart.mp3
[13.02.2009 16:38|--a------|5469505] K:\Flash in the night.mp3
[30.08.2007 16:03|--a------|3172352] K:\L.A. goodbye.mp3
[13.02.2009 16:41|--a------|8350568] K:\Stayin alive.mp3
[13.02.2009 16:40|--a------|3665595] K:\L'Italiano.mp3
[18.02.2008 15:35|--a------|5029888] K:\Ti amo.mp3
[11.06.2009 13:07|--a------|7306372] K:\Is it true.mp3
[13.02.2009 16:41|--a------|4921327] K:\On n'oublie jamais rien on vie avec.mp3
[13.02.2009 16:40|--a------|6340278] K:\Head over heels.mp3
[25.02.2008 19:08|--a------|3481203] K:\Beautiful life.mp3
[19.09.2007 21:23|--a------|4409009] K:\Chi mai.mp3
[16.04.2008 23:49|--a------|4339712] K:\What is love.mp3
[16.04.2008 19:14|--a------|6753731] K:\In the army now.mp3
[13.02.2009 16:38|--a------|6462831] K:\Losing my religion.mp3
[13.02.2009 16:38|--a------|6210465] K:\Nothing else metters.mp3

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# K:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).

################## | Upload |

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-Hizir.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.095 ! |

Pour l'info: j'ai aucun antivirus sur mon PC car le virus m'empêchait de l'installer jusqu'à présent.

List'em by g3n-h@ckm@n 1.2.5.2

User : MAGOMERZAEV (Administrateurs)
Update on 16/02/2010 by g3n-h@ckm@n ::::: 13.30
Start at: 14:06:01 | 18.02.2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
Internet Explorer 7.0.6000.16386
Windows Firewall Status : Disabled

C:\ -> Disque fixe local | 226,86 Go (99,77 Go free) [HP] | NTFS
D:\ -> Disque fixe local | 6,02 Go (666,89 Mo free) [Recovery] | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque amovible | 1,86 Go (1,4 Go free) [NOLIMIT] | FAT

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\svchost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\explorer.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Windows\VPro620.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\MAGOMERZAEV\AppData\Local\Temp\562A.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
ISUSPM Startup REG_SZ C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe
Nonoh REG_SZ "C:\Program Files\Nonoh.net\Nonoh\nonoh.exe" -nosplash -minimized
BitTorrent DNA REG_SZ "C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe"
DAEMON Tools Lite REG_SZ "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
TomTomHOME.exe REG_SZ "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\OsdMaestro

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
hpsysdrv REG_SZ c:\hp\support\hpsysdrv.exe
KBD REG_SZ C:\HP\KBD\KbdStub.EXE
OsdMaestro REG_SZ "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
IAAnotif REG_SZ "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
RtHDVCpl REG_SZ RtHDVCpl.exe
HP Software Update REG_SZ c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
<NO NAME> REG_SZ
WPCUMI REG_SZ C:\Windows\system32\WpcUmi.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
MAgent REG_SZ C:\Program Files\Mail.Ru\Agent\MAgent.exe -LM
TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Athan REG_SZ C:\Program Files\Athan\Athan.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Windows Mobile-based device management REG_EXPAND_SZ %windir%\WindowsMobile\wmdSync.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin REG_DWORD 2 (0x2)
ConsentPromptBehaviorUser REG_DWORD 1 (0x1)
EnableInstallerDetection REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 1 (0x1)
EnableSecureUIAPaths REG_DWORD 1 (0x1)
EnableVirtualization REG_DWORD 1 (0x1)
PromptOnSecureDesktop REG_DWORD 1 (0x1)
ValidateAdminCodeSignatures REG_DWORD 0 (0x0)
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0 (0x0)
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
FilterAdministratorToken REG_DWORD 0 (0x0)
UacDisableNotify REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
NoDriveAutorun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveAutoRun REG_DWORD 255 (0xff)
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
AutoRestartShell REG_DWORD 1 (0x1)
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 1 (0x1)
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 5 (0x5)

===============

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\BitTorrent\bittorrent.exe REG_SZ C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{E54A439F-A4B0-4526-A16B-B4E2ECE95B3D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2318C2B1-4965-11d4-9B18-009027A5CD4F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{454AA0D9-D0AE-85AF-328F-47A134D53390}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F4B2380F-9F83-482B-B51F-FD18C7EDD923}

==============
BHO :
======
[<NO NAME> REG_SZ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{8984B388-A5BB-4DF7-B274-77B879E179DB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{fc600575-3013-4e8e-941c-4b00dafce730}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x2 ( OK = 2 )
Wlansvc : 0x2 ( OK = 2 )
SharedAccess : 0x3 ( OK = 2 )
windefend : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
wscsvc : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Users\MAGOMERZAEV\AppData\Local\Temp\562A.tmp
## C:\> hashdeep C:\Windows\System32\Drivers\atapi.sys
##
19048,4f4fcb8b6ea06784fb6d475b7ec7300f,6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896,C:\Windows\System32\Drivers\atapi.sys


Sources
=======

C:\Windows\System32\drivers\atapi.sys
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

Référence :
==========

Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: HP

Taille du volume = 227 Go
Espace libre = 99.70 Go
tendue d'espace libre la plus grande = 1.54 Go
Pourcentage de fragmentation des fichiers = 10 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Program Files\AskBarDis
Present !! : C:\Windows\System32\tmp.reg"
Present !! : C:\Users\MAGOMERZAEV\AppData\Roaming\inst.exe

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
Present !! : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Present !! : HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
Present !! : HKCU\Software\AppDataLow\AskBarDis
Present !! : HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
Present !! : HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
Present !! : HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
Present !! : HKLM\Software\Classes\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
Present !! : HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-18 14:27:36
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"hdf12"=hex:d3,4b,61,98,6a,6b,52,8f,3a,a2,a7,ea,3c,4a,71,77,d0,0d,7c,a9,b5,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,71,1e,c3,91,38,2b,85,85,19,a8,df,02,af,35,3e,ee,d7,..
"hdf12"=hex:b7,53,05,76,e1,db,02,2b,0e,09,9f,2c,70,12,2b,40,84,45,82,21,94,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:12,07,44,21,a3,3f,89,20,82,72,4f,9f,0d,35,3f,da,e7,73,44,de,20,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"hdf12"=hex:d3,4b,61,98,6a,6b,52,8f,3a,a2,a7,ea,3c,4a,71,77,d0,0d,7c,a9,b5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,71,1e,c3,91,38,2b,85,85,19,a8,df,02,af,35,3e,ee,d7,..
"hdf12"=hex:b7,53,05,76,e1,db,02,2b,0e,09,9f,2c,70,12,2b,40,84,45,82,21,94,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:12,07,44,21,a3,3f,89,20,82,72,4f,9f,0d,35,3f,da,e7,73,44,de,20,..

scanning hidden registry entries ...

scanning hidden files ...

C:\Windows\Temp\OutofProcReport2666266.txt
C:\Windows\Temp\WERA850.tmp.hdmp

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iastor.sys spwa.sys hal.dll >>UNKNOWN [0x867C6938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8680f1f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

==========
Programs
==========

A123 WMV to AVI DVD MPEG MP4 MOV Converter
Acoustica Mixcraft 4
Acoustica Shared Effects
Adobe
AdobeSupportAdvisor
Alwil Software
aMSN
Apple Software Update
ASIO4ALL v2
AskBardis
Athan
Audacity
Audio Editor Gold
AVI to DVD Maker
AVIcodec
AVS4YOU
BitTorrent
Blender Foundation
Bricsys
CCleaner
CDMP3Ripper
Common Files
Conduit
Cool2000
d-lusion
DAEMON Tools Lite
desktop.ini
DIFX
Disc2Phone
DivX
DMV
DNA
Doblon
EA GAMES
Empires And Dungeons
eMule
Fichiers communs
Fighters
GameSpy Arcade
GIMP-2.0
Google
Gunner 2
Hewlett-Packard
HP
ICE Book Reader Professional
Illustrate
Image-Line
InstallShield Installation Information
Intel
Internet Explorer
iPod
iTunes
IZArc
iZotope
Java
Kantaris
KaraFun
Kodak
Konvertor
List_Kill'em
Loop12 V2
MAGIX
Mail.Ru
MakeHuman 0.9.1 RC1
Malwarebytes' Anti-Malware
Managed DirectX (0901)
Microsoft
Microsoft CAPICOM 2.1.0.2
Microsoft Games
Microsoft Office
Microsoft Works
Movie Maker
Movie Maker 2.6
Mozilla Firefox
mp3cd
mp3DirectCut
mRadio
MSBuild
MSN
Multi Password Recovery
MusicLab
myBabylon_English4
Native Instruments
Naval Strike
Navilog1
NCH Software
NCH Swift Sound
Nero
Nonoh.net
NOS
NovaLogic
Okoker All to Mp3 Converter
Opera
Orange
Outsim
PC-Doctor 5 for Windows
Philips
Philips_VLounge
PhotoActions
Pianissimo
QuickTime
Real
Realtek
Reference Assemblies
ReflexiveArcade
RegCure
RM-X© Mov To DivX
Roxio
Samsung
Services en ligne
Skype
Space Taxi 2
Spybot - Search & Destroy
Steinberg
SuperDVD Video Editor
Super_DVD_Creator_9.8
SystemRequirementsLab
TomTom DesktopSuite
TomTom HOME 2
Toontrack
Total Video Converter
Totally Free Burner
Tournament.com
Trend Micro
Typemock
Uniblue
Uninstall Information
VDJ5
vso
VstPlugins
WinAVI MP4 Converter
Windows Calendar
Windows Collaboration
Windows Defender
Windows Journal
Windows Mail
Windows Media Components
Windows Media Player
Windows NT
Windows Photo Gallery
Windows Sidebar
WinRAR
Yahoo!
ZipGenius 6

============
Drive C:
============

$Recycle.Bin
a123
autoexec.bat
autorun.inf
Boonty
Boot
bootmgr
BOOTSECT.BAK
cdrlog.txt
cleannavi.txt
CMLoader.log
config.sys
conmgr.log
COSMOSEMS2008
COSMOSEMS2008Unzip
divx
Documents and Settings
DVTemp
FindyKill_Upload_Me_PC-de-Hizir.zip
FyK
FyK.txt
hiberfil.sys
hp
IMCHAT
IMLOG
IO.SYS
Kill'em
List'em.txt
logfile
Movavi files
MP4debug.log
MSDOS.SYS
mxcraft 4 files
npbittorrent.dll
NVIDIA
out.txt
pagefile.sys
Program Files
ProgramData
rapport.txt
RECYCLER
RHDSetup.log
rsit
SolidWorks Data
SPC220NC.DAT
System Volume Information
TB.txt
tmp
tmpDownload
ToolBar SD
UsbFix.txt
UsbFix_Upload_Me_PC-de-Hizir.zip
Users
VideoOutput
Windows
YouTubeGet

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\hp\KBD\Install.exe
D:\hp\apps\APP09321\src\MSWorks\Install.exe
D:\hp\Drv\APP26312\Install.exe
D:\hp\Drv\APP26312\src\Install.exe




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 14:42:40,70

ca yest j'ai fait le scan! qu'est-ce que je fait après?

Kill'em by g3n-h@ckm@n 1.2.5.2

User : MAGOMERZAEV (Administrateurs)
Update on 16/02/2010 by g3n-h@ckm@n ::::: 13.30
Start at: 19:28:08 | 18.02.2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
Internet Explorer 7.0.6000.16386
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 226,86 Go (99,09 Go free) [HP] | NTFS
D:\ -> Disque fixe local | 6,02 Go (666,89 Mo free) [Recovery] | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\svchost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\explorer.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Windows\VPro620.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\aMSN\bin\wish.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\MAGOMERZAEV\AppData\Local\Temp\6685.tmp\ERUNT.EXE
C:\Users\MAGOMERZAEV\AppData\Local\Temp\6685.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Program Files\AskBarDis

Quarantined & Deleted !! : C:\Windows\system32\tmp.reg
Quarantined & Deleted !! : C:\Users\MAGOMERZAEV\AppData\Roaming\inst.exe

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
Deleted : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Deleted : "HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Deleted : HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
Deleted : HKCU\Software\AppDataLow\AskBarDis
Deleted : HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
Deleted : HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
Deleted : HKLM\Software\Classes\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
Deleted : HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

bonsoir moment de grace, j'ai fait le teste mais il n'ya pas de message disant "MBR rootkit code detected" donc j'ai pas tapé la commande. Voici le rapport:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Le PC va très bien: il n'y a plus de fenêtres intempestives, il ne rame plus. Alors on peut installer un antivirus maintenant?

Logfile of random's system information tool 1.06 (written by random/random)
Run by MAGOMERZAEV at 2010-02-19 14:37:48
Microsoft® Windows Vista™ Édition Familiale Premium
System drive C: has 101 GB (43%) free of 232 GB
Total RAM: 1022 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:07, on 19.02.2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nonoh.net\Nonoh\nonoh.exe
C:\Windows\System32\mobsync.exe
C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Windows\VPro620.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\taskeng.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\MAGOMERZAEV\Desktop\RSIT.exe
C:\Users\MAGOMERZAEV\Desktop\MAGOMERZAEV.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Program Files\Mail.Ru\Agent\Mra\dll\newmrasearch.dll
R3 - URLSearchHook: ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll
R3 - URLSearchHook: (no name) - {93cadcb6-7c80-4672-ae2d-7df92eb4f95e} - (no file)
R3 - URLSearchHook: myBabylon English4 Toolbar - {fc600575-3013-4e8e-941c-4b00dafce730} - C:\Program Files\myBabylon_English4\tbmyBa.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: ???????@Mail.Ru - {8984B388-A5BB-4DF7-B274-77B879E179DB} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: myBabylon English4 Toolbar - {fc600575-3013-4e8e-941c-4b00dafce730} - C:\Program Files\myBabylon_English4\tbmyBa.dll
O3 - Toolbar: ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll
O3 - Toolbar: (no name) - {93cadcb6-7c80-4672-ae2d-7df92eb4f95e} - (no file)
O3 - Toolbar: myBabylon English4 Toolbar - {fc600575-3013-4e8e-941c-4b00dafce730} - C:\Program Files\myBabylon_English4\tbmyBa.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MAgent] C:\Program Files\Mail.Ru\Agent\MAgent.exe -LM
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Nonoh] "C:\Program Files\Nonoh.net\Nonoh\nonoh.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\MAGOMERZAEV\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: VPro620.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Mail.Ru ????? - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra 'Tools' menuitem: Mail.Ru ????? - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Program Files\Mail.Ru\Agent\magent.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: ?????? iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

j'ai vérifié les 4 fichiers et j'ai eu "résultat 0/40 (0.00%)" partout!