Personal security

encore merci de prendre du temps pour me répondre.

voici le rapport claennavi :

Fix Navipromo version 4.0.6 commencé le 21/02/2010 12:37:21,57

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 03.01.2010 à 11h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
BIOS : Default System BIOS
USER : Casanova ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)


C:\ (Local Disk) - NTFS - Total:298 Go (Free:149 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)


Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur


c:\docume~1\casanova\locals~1\applic~1\avqdelhz.dat supprimé !


Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Casanova\locals~1\Temp effectué !

le rapport Kill'em :

Kill'em by g3n-h@ckm@n 1.2.5.3

User : Casanova (Administrateurs)
Update on 19/02/2010 by g3n-h@ckm@n ::::: 13.15
Start at: 11:46:41 | 21/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Processeur Intel Pentium III Xeon
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 298,08 Go (149,6 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Casanova\Local Settings\Temp\C6.tmp\ERUNT.EXE
C:\Documents and Settings\Casanova\Local Settings\Temp\C6.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\labvisionrc
Quarantined & Deleted !! : C:\Program Files\Ask.com
Quarantined & Deleted !! : C:\WINDOWS\002712_.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp
Quarantined & Deleted !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BD.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BF.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C3.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C4.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CB.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET212.tmp
Quarantined & Deleted !! : C:\WINDOWS\system32\win32extension.dll
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\Application Data\pcouffin.inf
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\Application Data\inst.exe
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\avqdelhz_nav.dat
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\tilyfsfs_nav.dat
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\avqdelhz_navps.dat
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\NEW16C.tmp.exe
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\wlsetup-cvr.exe
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\_is5.exe
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\_is6.exe
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\NEventMessages.dll
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\swt-awt-win32-3346.dll
Quarantined & Deleted !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\swt-win32-3346.dll

==============
host file OK !
==============

========
Registry
========

Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{9CB65206-89C4-402c-BA80-02D8C59F9B1D}
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ComRepl
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ComRepl
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Esent Utl
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MstInit
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mstsc
Deleted : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Esent Utl
Deleted : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Deleted : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}"
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}"
Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Deleted : HKCU\software\Ask.com
Deleted : HKCU\SOFTWARE\fcn
Deleted : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Deleted : HKLM\software\classes\appid\GenericAskToolbar.DLL
Deleted : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Deleted : HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
Deleted : HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
Deleted : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
Deleted : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
Deleted : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Deleted : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Deleted : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Deleted : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Deleted : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Deleted : HKLM\System\CurrentControlSet\Servises
========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

l'examen est en cours depuis 35 minutes.

je dois m'absenter, je posterai le rapport en fin d'après midi.

merci, voici le rapport :

List'em by g3n-h@ckm@n 1.2.5.3

User : Casanova (Administrateurs)
Update on 19/02/2010 by g3n-h@ckm@n ::::: 13.15
Start at: 10:27:03 | 21/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Processeur Intel Pentium III Xeon
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 298,08 Go (149,62 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

ah ok voila :

List'em by g3n-h@ckm@n 1.2.5.3

User : Casanova (Administrateurs)
Update on 19/02/2010 by g3n-h@ckm@n ::::: 13.15
Start at: 10:27:03 | 21/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Processeur Intel Pentium III Xeon
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 298,08 Go (149,62 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Casanova\Local Settings\Temp\9B.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
DAEMON Tools Lite REG_SZ "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
LightScribe Control Panel REG_SZ C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
avqdelhz REG_SZ "c:\documents and settings\casanova\local settings\application data\avqdelhz.exe" avqdelhz
PersSecurity REG_SZ C:\Program Files\PersSecurity\psecurity.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
PHIME2002ASync REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
StartCCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
RTHDCPL REG_SZ RTHDCPL.EXE
Alcmtr REG_SZ ALCMTR.EXE
inetsrv REG_SZ C:\WINDOWS\system32\inetsrv.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
SystrayORAHSS REG_SZ "C:\Program Files\Orange\Systray\SystrayApp.exe"
ORAHSSSessionManager REG_SZ C:\Program Files\Orange\SessionManager\SessionManager.exe
itype REG_SZ "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
IntelliPoint REG_SZ "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
Logitech Utility REG_SZ Logi_MwX.Exe
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_BINARY 95000000

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ HYACINTHE
DefaultUserName REG_SZ Casanova
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Casanova
AltDefaultDomainName REG_SZ HYACINTHE
ChangePasswordUseKerberos REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Documents and Settings\Casanova\Bureau\WAR Europe Downloader.exe REG_SZ C:\Documents and Settings\Casanova\Bureau\WAR Europe Downloader.exe:*:Enabled:Warhammer Downloader
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Documents and Settings\Casanova\Bureau\WAR_VO_French.exe REG_SZ C:\Documents and Settings\Casanova\Bureau\WAR_VO_French.exe:*:Enabled:Warhammer Voice Over Downloader
C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
C:\Program Files\World of Warcraft\WoW-1.12.0-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-1.12.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Orange\Connectivity\ConnectivityManager.exe REG_SZ C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS
C:\Program Files\World of Warcraft\BackgroundDownloader.exe REG_SZ C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\Launcher.exe REG_SZ C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher
C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp01\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp01\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp03\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp03\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp04\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp04\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp05\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp05\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp08\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp08\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp09\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp09\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp10\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp10\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp11\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp11\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp12\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp12\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp13\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp13\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp16\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp16\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp18\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp18\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp19\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp19\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp20\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp20\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp21\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp21\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp22\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp22\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp23\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp23\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp24\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp24\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp25\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp25\mdm.exe:*:Enabled:UpdateWizzard
C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp27\mdm.exe REG_SZ C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp27\mdm.exe:*:Enabled:UpdateWizzard
C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\TVAnts\Tvants.exe REG_SZ C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts
C:\Program Files\SopCast\SopCast.exe REG_SZ C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application
C:\Program Files\SopCast\adv\SopAdver.exe REG_SZ C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver
C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-frFR-downloader.exe REG_SZ C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-frFR-downloader.exe:*:Enabled:Blizzard Downloader
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C73FD00D-A099-405C-92B4-8997710D187D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\Casanova\Local Settings\Temp\9B.tmp
## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys


Sources
=======

C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
C:\WINDOWS\ServicePackFiles\i386\atapi.sys
C:\WINDOWS\system32\drivers\atapi.sys
C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys
C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys

Référence :
==========

Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
298 Go total, 150 Go libre (50%), 28% fragment‚ (fragmentation du fichier 57%)

Vous devriez d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\labvisionrc
Present !! : C:\Program Files\Ask.com
Present !! : C:\WINDOWS\002712_.tmp
Present !! : C:\WINDOWS\SET3.tmp
Present !! : C:\WINDOWS\SET4.tmp
Present !! : C:\WINDOWS\SET8.tmp
Present !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Present !! : C:\WINDOWS\System32\SET*.tmp
Present !! : C:\WINDOWS\System32\win32extension.dll"
Present !! : C:\Documents and Settings\Casanova\Application Data\pcouffin.inf
Present !! : C:\Documents and Settings\Casanova\Application Data\inst.exe
Present !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\avqdelhz_nav.dat
Present !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\tilyfsfs_nav.dat
Present !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\avqdelhz_nav.dat
Present !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\avqdelhz_navps.dat
Present !! : C:\Documents and Settings\Casanova\Local Settings\Application Data\tilyfsfs_nav.dat
Present !! : C:\Documents and Settings\Casanova\Local Settings\Temp\dw.log
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv.exe
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\NEW16C.tmp.exe
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\wlsetup-cvr.exe
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\_is5.exe
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\_is6.exe
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\NEventMessages.dll
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\swt-awt-win32-3346.dll
Present !! : C:\Documents and Settings\Casanova\LOCAL Settings\Temp\swt-win32-3346.dll

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{9CB65206-89C4-402c-BA80-02D8C59F9B1D}
Present !! : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}"
Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}"
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKCU\software\Ask.com
Present !! : HKCU\SOFTWARE\fcn
Present !! : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Present !! : HKLM\software\classes\appid\GenericAskToolbar.DLL
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
Present !! : HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
Present !! : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Present !! : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Present !! : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Present !! : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Present !! : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Present !! : HKLM\System\CurrentControlSet\Servises

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-21 10:32:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:6a,88,1b,55,fb,3f,6b,58,5e,45,0b,41,92,cf,8f,cb,77,e2,80,5f,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,7a,d4,b5,56,83,6e,c6,71,46,bc,7f,c7,ca,61,d5,cc,bc,..
"khjeh"=hex:d8,2c,8c,81,bd,1f,ba,9c,2b,85,d6,5d,8d,09,4a,5e,2a,e7,54,03,a6,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ca,1f,e5,0b,07,ab,d1,65,a6,7f,e0,88,9a,ad,4f,f2,21,ad,e2,84,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:6a,88,1b,55,fb,3f,6b,58,5e,45,0b,41,92,cf,8f,cb,77,e2,80,5f,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,7a,d4,b5,56,83,6e,c6,71,46,bc,7f,c7,ca,61,d5,cc,bc,..
"khjeh"=hex:d8,2c,8c,81,bd,1f,ba,9c,2b,85,d6,5d,8d,09,4a,5e,2a,e7,54,03,a6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ca,1f,e5,0b,07,ab,d1,65,a6,7f,e0,88,9a,ad,4f,f2,21,ad,e2,84,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:6a,88,1b,55,fb,3f,6b,58,5e,45,0b,41,92,cf,8f,cb,77,e2,80,5f,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,7a,d4,b5,56,83,6e,c6,71,46,bc,7f,c7,ca,61,d5,cc,bc,..
"khjeh"=hex:d8,2c,8c,81,bd,1f,ba,9c,2b,85,d6,5d,8d,09,4a,5e,2a,e7,54,03,a6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ca,1f,e5,0b,07,ab,d1,65,a6,7f,e0,88,9a,ad,4f,f2,21,ad,e2,84,a6,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spqq.sys >>UNKNOWN [0x8A5C1938]<<
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

Adobe
Ask.com
Astonsoft
Atari
ATI
ATI Technologies
Avira
BitComet
ComPlus Applications
DAEMON Tools Lite
DIFX
DivX
eMule
Fichiers communs
Gimp-2.0
Google
InstallShield Installation Information
Intel
Internet Explorer
Java
JetAudio
LimeWire
List_Kill'em
Logitech
ma-config.com
Malwarebytes' Anti-Malware
Messenger
Messenger Plus! Live
Microsoft
microsoft frontpage
Microsoft IntelliPoint
Microsoft IntelliType Pro
Microsoft Windows OneCare Live
Movie Maker
Mozilla Firefox
MSBuild
MSN
MSN Gaming Zone
MSXML 4.0
MSXML 6.0
Mumble
Nero
NetMeeting
Nokia
Online Services
Orange
Outlook Express
PC Connectivity Solution
PersSecurity
Realtek
Reference Assemblies
SAGEM
Securitoo
Services en ligne
SopCast
Spybot - Search & Destroy
SystemRequirementsLab
Teamspeak2_RC2
TVAnts
Uninstall Information
Vepro
VSO
Wanadoo
Windows Live
Windows Live SkyDrive
Windows Media Connect 2
Windows Media Player
Windows NT
Windows Sidebar
WindowsUpdate
WinRAR
World of Warcraft
WowCartographe
xerox

============
Drive C:
============

8d0563f85cfef494f129b34c9f99
9d6027ecb453875ef6c493dd190c
ATI
AUTOEXEC.BAT
boot.ini
Bootfont.bin
Click2Cast
Config.Msi
CONFIG.SYS
Documents and Settings
Downloads
error.log
f524ae6cfed4c5a51fccddd8a8e6
Intel
IO.SYS
Kill'em
List'em.txt
Logs
MSDOS.SYS
NTDETECT.COM
ntldr
pagefile.sys
Program Files
RECYCLER
Setup.log
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
System Volume Information
temp
Warhammer Online - Age of Reckoning
WINDOWS

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials





¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 11:06:59,96

Logfile of random's system information tool 1.06 (written by random/random)
Run by Casanova at 2010-02-21 20:07:37
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 154 GB (50%) free of 305 GB
Total RAM: 2047 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:07:41, on 21/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Casanova\Mes documents\Téléchargements\RSIT(3).exe
C:\Program Files\trend micro\Casanova.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
F3 - REG:win.ini: load=C:\WINDOWS\ieudinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL (file missing)
O2 - BHO: &Security Update - {C73FD00D-A099-405C-92B4-8997710D187D} - C:\WINDOWS\system32\win32extension.dll (file missing)
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

voilou la suite :

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 02/21/2010 at 09:34 PM

Application Version : 4.34.1000

Core Rules Database Version : 4605
Trace Rules Database Version: 2417

Scan type : Complete Scan
Total Scan Time : 00:49:23

Memory items scanned : 757
Memory threats detected : 0
Registry items scanned : 4336
Registry threats detected : 0
File items scanned : 70771
File threats detected : 192

Adware.Tracking Cookie
C:\Documents and Settings\Casanova\Cookies\casanova@www3.smartadserver[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.ratiatum[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@homairvacances.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.webtrekk[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@lfstmedia[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@at.atwola[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@bs.serving-sys[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adlegend[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adbrite[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@atdmt[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@click-fr[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@toplist[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.cdiscount[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@qnsr[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@cdiscount[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@tacoda[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@wysistat[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@roiservice[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@shinystat[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@weborama[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@uk.sitestat[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.yieldmanager[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@stats.equinoa[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adv.bewebmedia[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[5].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.effiliation[6].txt
C:\Documents and Settings\Casanova\Cookies\casanova@videoegg.adbureau[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@boursoramabanque.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.aedgency[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@cetelem.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.pointroll[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@segafredovirginradiotour.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@nextag[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.torrentreactor[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@snapfish.112.2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.webgains[4].txt
C:\Documents and Settings\Casanova\Cookies\casanova@sfr.122.2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@msnportal.112.2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.proxad[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@sega.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@t.bbtrack[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.gsexe[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.freeporn[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@serving-sys[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.at.atwola[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ww57.smartadserver[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@laredoute.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@stats.canalblog[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@himedia.individuad[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@bnpparibasnet.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@rm.piximedia[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adtech[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[5].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.zanox[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@a.websponsors[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@interhome.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@d2.advertserve[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@bouyguestelecom.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@insightexpressai[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@market1.the-adult-company[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.sexyavenue[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adcentriconline[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@questionmarket[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@overture[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[7].txt
C:\Documents and Settings\Casanova\Cookies\casanova@cgm.adbureau[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.webtrekk[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@media.intelia[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@int.sitestat[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[4].txt
C:\Documents and Settings\Casanova\Cookies\casanova@samsung.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@rambler[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fructismen07mars06avril.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[7].txt
C:\Documents and Settings\Casanova\Cookies\casanova@specificclick[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fr.sitestat[6].txt
C:\Documents and Settings\Casanova\Cookies\casanova@intermarche2009.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@tracking.publicidees[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@content.yieldmanager[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@sexy[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@samsungpinkribbon.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.bridgetrack[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@msnaccountservices.112.2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.logaweb[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@stats.searchtrack[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@smartadserver[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@yourmedia[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adsby.webtraffic[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@sexyavenue[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@casio.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@account.yusho[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@xiti[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@imrworldwide[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@banquepopulaire.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.canalblog[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserver.aol[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@advertstream[4].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[6].txt
C:\Documents and Settings\Casanova\Cookies\casanova@estat[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@lorealparis.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@collective-media[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@naiadsystems[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@bwincom.122.2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@specificmedia[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.effiliation[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@trackers.1st-affiliation[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@a.websponsors[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.aedgency[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@stat.onestat[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.espaceclient[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@lascad.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@int.sitestat[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fl01.ct2.comclick[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@advertstream[6].txt
C:\Documents and Settings\Casanova\Cookies\casanova@2o7[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.adultadvertising[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@zanox[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.pornattitude[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@bubblestat[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.googleadservices[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@uk.sitestat[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads1.adultadvertising[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad2.doublepimp[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@interflora2.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@market1.the-adult-company[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adfarm1.adition[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@stat.blogorama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[9].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.adultadvertising[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[8].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.ad4game[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.lavoix[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adbureau[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@247realmedia[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@247realmedia[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.smartadserver[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@pornattitude[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[7].txt
C:\Documents and Settings\Casanova\Cookies\casanova@blancheporte.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@discountmanga[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@media.carpediem[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.118000[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@orange3.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@gsexe[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserver.alyzamedia[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@argusauto2.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@3479.stats.misstrends[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@fnacmagasin.solution.weborama[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@pornravage[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@notrefamille.112.2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.clicmanager[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@2o7[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@account.yusho[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.yieldmanager[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.yieldmanager[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ad.zanox[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adbureau[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@ads.aedgency[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adsby.webtraffic[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.aedgency[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[4].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[6].txt
C:\Documents and Settings\Casanova\Cookies\casanova@adserving.favorit-network[8].txt
C:\Documents and Settings\Casanova\Cookies\casanova@advertstream[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@advertstream[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@advertstream[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@advertstream[5].txt
C:\Documents and Settings\Casanova\Cookies\casanova@bs.serving-sys[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@casio.solution.weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@exoclick[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@market1.the-adult-company[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@pacificpoker[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@pornattitude[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[4].txt
C:\Documents and Settings\Casanova\Cookies\casanova@server.iad.liveperson[5].txt
C:\Documents and Settings\Casanova\Cookies\casanova@serving-sys[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@smartadserver[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.effiliation[2].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.effiliation[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.effiliation[4].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.webgains[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@track.webgains[3].txt
C:\Documents and Settings\Casanova\Cookies\casanova@weborama[1].txt
C:\Documents and Settings\Casanova\Cookies\casanova@www.smartadserver[1].txt

le lien :

http://www.cijoint.fr/cjlink.php?file=cj201002/cijbygfqMV.txt

ZHPFix v1.12.302 by Nicolas Coolman - Rapport de suppression du 21/02/2010 23:44:46
Fichier d'export Registre : C:\ZHPExportRegistry-21-02-2010-23-44-46.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL => Clé supprimée avec succès
O2 - BHO: &Security Update - {C73FD00D-A099-405C-92B4-8997710D187D} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\system32\win32extension.dll => Clé supprimée avec succès
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} . (.Pas de propriétaire - Pas de description.) -- (.not file.) => Clé supprimée avec succès
O2 - BHO: (no name) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} . (.Pas de propriétaire - Pas de description.) -- (.not file.) => Clé supprimée avec succès

Valeur du Registre :
O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} . (.Pas de propriétaire - Pas de description.) -- => Valeur supprimée avec succès
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp01\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp01\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp03\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp03\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp04\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp04\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp05\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp05\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp08\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp08\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp09\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp09\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp10\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp10\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp11\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp11\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp12\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp12\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp13\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp13\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp16\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp16\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp18\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp18\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp19\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp19\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp20\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp20\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp21\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp21\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp22\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp22\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp23\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp23\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp24\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp24\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp25\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp25\mdm.exe => Valeur supprimée avec succès
O47 - AAKE:Key Export SP - "C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp27\mdm.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) -- C:\DOCUME~1\Casanova\LOCALS~1\Temp\~temp\mlp27\mdm.exe => Valeur supprimée avec succès

Elément de données du Registre :
F3 - REG:win.ini: load=C:\WINDOWS\ieudinit.exe => Donnée supprimée avec succès

Dossier :
(Néant)

Fichier :
c:\windows\ieudinit.exe => Fichier absent
c:\program files\asktbar\srchastt\1.bin\a5srchas.dll => Fichier absent
c:\windows\system32\win32extension.dll => Fichier absent
c:\windows\tasks\scheduled update for ask toolbar.job => Supprimé et mis en quarantaine
c:\docume~1\casanova\locals~1\temp\~temp\mlp01\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp03\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp04\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp05\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp08\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp09\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp10\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp11\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp12\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp13\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp16\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp18\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp19\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp20\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp21\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp22\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp23\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp24\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp25\mdm.exe => Fichier absent
c:\docume~1\casanova\locals~1\temp\~temp\mlp27\mdm.exe => Fichier absent

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 4
Valeur du Registre : 22
Elément de données du Registre : 1
Dossier : 0
Fichier : 24
Logiciel : 0
Autre : 0


End of the scan

il a l'air de plutôt bien se comporter pour l'instant.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Casanova at 2010-02-22 00:18:47
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 153 GB (50%) free of 305 GB
Total RAM: 2047 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:18:55, on 22/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Casanova\Mes documents\Téléchargements\RSIT(2).exe
C:\Program Files\trend micro\Casanova.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

ca m'a l'air assez long donc je continuerai demain :) re re merci et bonne nuit ^^

merci de m'avoir aidé à enlever cette m**** :)

Bonne continuation.