Cheval de troie TR/cryptXPACK.Gen3

Résolu
Baskepes -  
Bonjour,
Depuis deux jours mon antivirus (Antivir) me détecte deux chevaux : TR/cryptXPACK.Gen3 et TR/FraudPack.kva.59

voici mon log :
Logfile of random's system information tool 1.08 (written by random/random)
Run by ADMIN at 2010-10-16 12:32:53
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 3 GB (12%) free of 29 GB
Total RAM: 511 MB (12% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:34:16, on 16/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Acer\AcerSync\AcerSyncService.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\clipsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\SFR\9Giga Synchro\9Giga_Synchro.exe
C:\Program Files\iPod\bin\iPodService.exe
E:\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
E:\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\ADMIN\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\ADMIN.exe

Merci pour votre aide.
Cordialement.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://pagesperso-orange.fr/college.saintgabriel/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://172.16.254.252/cgi-bin/slis.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9ff3bd68-7151-814c-bce9-f7e71e9f74f2} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB002" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [\\http://maison-serveur:631\Stylus-Photo-R200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P45 "\\http://maison-serveur:631\Stylus-Photo-R200" /O52 "http://maison-serveur:631/printers/stylus-photo-R200" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" -s
O4 - HKCU\..\Run: [9Giga Synchro] "C:\Program Files\SFR\9Giga Synchro\9Giga_Synchro.exe" /delayed
O4 - HKCU\..\Run: [Hsekihumevixi] rundll32.exe "C:\WINDOWS\mt4c71.dll",Startup
O4 - HKCU\..\Run: [IJKUK66HMN] C:\DOCUME~1\ADMIN\LOCALS~1\Temp\Ycx.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1197972425919
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = STGABHTEGOUL.LAN
O17 - HKLM\Software\..\Telephony: DomainName = STGABHTEGOUL.LAN
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AcerSyncServiceWinService - Unknown owner - C:\Program Files\Acer\AcerSync\AcerSyncService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32\netdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32\netdde.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: XAMPP Service (XAMPP) - Unknown owner - E:\xampplite\service.exe (file missing)

--
End of file - 15013 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cb6b9d47eac957.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2010-09-22 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ff3bd68-7151-814c-bce9-f7e71e9f74f2}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-06-03 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
LimeWire Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-06-10 1233288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-04 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]
C:\Program Files\Microsoft Money\System\mnyviewer.dll [2001-07-25 143420]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]
{D4027C7F-154A-4066-A1AD-4243D8127440} - LimeWire Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-06-10 1233288]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MoneyStartUp10.0"=C:\Program Files\Microsoft Money\System\Activation.exe [2001-07-25 245810]
"ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-04-17 196608]
"ISUSScheduler"=C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe [2004-04-13 69632]
"AppleSyncNotifier"=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-22 116040]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-30 289064]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-06-18 67584]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-05-24 209153]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"EPSON Stylus Photo R200 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE [2003-09-11 99840]
"\\http://maison-serveur:631\Stylus-Photo-R200"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE [2003-09-11 99840]
"Samsung PanelMgr"=C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2009-08-28 606208]
"SunJavaUpdateSched"=C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [2010-05-14 248552]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"CloneCDTray"=C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [2009-01-30 57344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-06-26 1211176]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-09-16 68856]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-06-24 247144]
"9Giga Synchro"=C:\Program Files\SFR\9Giga Synchro\9Giga_Synchro.exe [2008-12-19 6931848]
"Hsekihumevixi"=C:\WINDOWS\mt4c71.dll [2008-04-14 85504]
"IJKUK66HMN"=C:\DOCUME~1\ADMIN\LOCALS~1\Temp\Ycx.exe []

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Logiciel de Synchronisation Orange.lnk - E:\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
Lancement rapide d'Adobe Acrobat.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-10-25 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 240128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=Information à destination des professeurs
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0xFF000000
"NoDriveAutoRun"=128
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=128
"HonorAutoRunSetting"=1
"NoDriveTypeAutoRun"=255
"NoWelcomeScreen"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe:*:Enabled:javaw"
"C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe"="C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Enabled:Dreamweaver MX"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"E:\Site web collège\xampplite\mysql\bin\mysqld.exe"="E:\Site web collège\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"E:\Site web collège\xampplite\apache\bin\apache.exe"="E:\Site web collège\xampplite\apache\bin\apache.exe:*:Enabled:apache"
"E:\xampplite\apache\bin\apache.exe"="E:\xampplite\apache\bin\apache.exe:*:Enabled:Apache HTTP Server"
"E:\xampplite\mysql\bin\mysqld.exe"="E:\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\ABC\abc.exe"="C:\Program Files\ABC\abc.exe:*:Enabled:abc"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"\\maison-serveur\data\StubInstaller.exe"="\\maison-serveur\data\StubInstaller.exe:*:Disabled:StubInstaller.exe"
"C:\Program Files\Maïdo Production\IziSpot 4\IziSpot.exe"="C:\Program Files\Maïdo Production\IziSpot 4\IziSpot.exe:*:Enabled:IziSpot"
"C:\Program Files\Acer\AcerSync\AcerSync.exe"="C:\Program Files\Acer\AcerSync\AcerSync.exe:*:Enabled:Acer Sync"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe:*:Enabled:javaw"
"C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe"="C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Disabled:Dreamweaver MX"
"C:\Program Files\FileZilla\FileZilla.exe"="C:\Program Files\FileZilla\FileZilla.exe:*:Disabled:FileZilla"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"E:\TELECHARGER\joomla_1.5.2_stable_fr\outils\xampplite\apache\bin\apache.exe"="E:\TELECHARGER\joomla_1.5.2_stable_fr\outils\xampplite\apache\bin\apache.exe:*:Enabled:Apache HTTP Server"
"E:\xampplite\apache\bin\apache.exe"="E:\xampplite\apache\bin\apache.exe:*:Enabled:Apache HTTP Server"
"E:\xampplite\mysql\bin\mysqld.exe"="E:\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Maïdo Production\IziSpot 4\IziSpot.exe"="C:\Program Files\Maïdo Production\IziSpot 4\IziSpot.exe:*:Enabled:IziSpot"
"C:\Program Files\Acer\AcerSync\AcerSync.exe"="C:\Program Files\Acer\AcerSync\AcerSync.exe:*:Enabled:Acer Sync"
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe"="C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth"

======List of files/folders created in the last 1 months======

2010-10-16 12:32:53 ----D---- C:\rsit
2010-10-12 20:03:42 ----A---- C:\WINDOWS\Yfowaa.exe
2010-10-12 20:03:35 ----A---- C:\WINDOWS\system32\akfsp.exe
2010-10-12 20:02:22 ----A---- C:\WINDOWS\Yvyroa.exe
2010-10-12 20:02:08 ----N---- C:\WINDOWS\system32\sshnas21.dll
2010-10-12 20:01:52 ----A---- C:\WINDOWS\system32\lgep.exe
2010-10-12 20:01:46 ----A---- C:\WINDOWS\system32\winset.ini
2010-10-12 19:09:53 ----D---- C:\PRONOTE 2010
2010-10-10 19:05:10 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2010-10-10 19:04:25 ----D---- C:\Program Files\Microsoft Visual Studio
2010-10-10 18:48:19 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2010-10-08 11:28:14 ----D---- C:\Documents and Settings\All Users\Application Data\SFR
2010-10-08 11:28:03 ----D---- C:\Program Files\SFR
2010-09-23 16:15:55 ----D---- C:\WINDOWS\Microsoft.VC80.ATL
2010-09-23 16:15:55 ----A---- C:\WINDOWS\FunambolAddin.dll

======List of files/folders modified in the last 1 months======

2010-10-10 18:59:12 ----A---- C:\WINDOWS\win.ini
2010-10-07 12:27:20 ----A---- C:\WINDOWS\CDPLAYER.INI
2010-09-27 14:45:50 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-09-27 09:36:28 ----A---- C:\WINDOWS\ModemLog_Agere Systems AC'97 Modem.txt

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 atiide;atiide; C:\WINDOWS\system32\DRIVERS\atiide.sys [2004-04-14 5632]
R0 caboagp;ATI Cabo AGP Filter; C:\WINDOWS\system32\DRIVERS\atisgkaf.sys [2003-10-27 13842]
R0 ohci1394;Contrôleur hôte compatible IEE 1394 VIA OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Asapi;Asapi; C:\WINDOWS\system32\drivers\Asapi.sys [2002-04-17 11264]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-05-24 96104]
R1 cpuidlep;CpuIdle Pro System Driver; C:\WINDOWS\system32\drivers\cpuidlep.sys [2008-02-22 4484]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-05-19 5632]
R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1997-12-23 23936]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-11 56816]
R2 irda;Protocole IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 osaio;osaio; C:\WINDOWS\system32\drivers\osaio.sys [2004-06-01 10594]
R2 osanbm;osanbm; C:\WINDOWS\system32\drivers\osanbm.sys [2004-06-01 4054]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R2 vnccom;vnccom; C:\WINDOWS\System32\Drivers\vnccom.SYS [2004-06-26 6016]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-06-07 1267724]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-06-21 626204]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-08-05 104512]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-05-15 745984]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2003-09-14 18838]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2005-04-12 4608]
R3 EMSCR;EMSCR; C:\WINDOWS\system32\DRIVERS\EMS7SK.sys [2004-06-25 58240]
R3 ESDCR;ESDCR; C:\WINDOWS\system32\DRIVERS\ESD7SK.sys [2004-07-12 36480]
R3 ESMCR;ESMCR; C:\WINDOWS\system32\DRIVERS\ESM7SK.sys [2004-07-28 330624]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 IPN2220;acer IPN2220 Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\i2220ntx.sys [2004-08-16 160896]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2004-09-22 6912]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-06-09 47360]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-12-05 10368]
R3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-04-13 70144]
R3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2002-11-06 39424]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-05-07 182688]
R3 vncdrv;vncdrv; C:\WINDOWS\system32\DRIVERS\vncdrv.sys [2004-06-26 4736]
S2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 androidusb;ADB Interface Driver; C:\WINDOWS\System32\Drivers\androidusb.sys [2009-08-21 25728]
S3 catchme;catchme; \??\C:\DOCUME~1\ADMIN\LOCALS~1\Temp\catchme.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 Dot4;Pilote MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-23 24064]
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12288]
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2008-04-13 22016]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2005-11-19 20096]
S3 qcusbser;ACER Android USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\qcusbser.sys [2009-08-14 105984]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2005-12-22 80272]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2005-12-22 10864]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2005-12-22 137884]
S3 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-29 28520]
S3 tbhsd;Tunebite High-Speed Dubbing; C:\WINDOWS\system32\drivers\tbhsd.sys [2007-12-11 26784]
S3 usb_rndisx;USB RNDIS Adapter; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2005-10-21 12800]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-11-06 28672]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcerSyncServiceWinService;AcerSyncServiceWinService; C:\Program Files\Acer\AcerSync\AcerSyncService.exe [2010-01-06 172576]
R2 anbmService;Notebook Manager Service; C:\Acer\eManager\anbmServ.exe [2004-08-16 1287168]
R2 AntiVirMailService;Avira AntiVir MailGuard; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [2009-07-29 194817]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-07-29 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-19 185089]
R2 AntiVirWebService;Avira AntiVir WebGuard; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2009-07-29 434945]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-22 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-05-15 376832]
R2 Irmon;Moniteur infrarouge; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-07-17 153376]
R2 SSHNAS;SSHNAS; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;Service de l'iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-07-30 532264]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
S2 gupdate;Service Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]
S2 XAMPP;XAMPP Service; E:\xampplite\service.exe []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-06-03 72704]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-23 182768]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2002-08-01 65536]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 NetTcpPortSharing;Service de partage de ports Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

13 réponses

  1.  Xplode Contributeur sécurité
    Bonjour,

    -+-+-+-+-> ComboFix <-+-+-+-

    [x] Télécharge ComboFix ( de sUBs ) à cette adresse.

    /!\ Ferme toutes les fenêtres de programme ouvertes /!\

    /!\ Désactive temporairement toutes les protections résidentes ( Antivirus, Pare-Feu, AntiSpyware ) /!\

    [x] Double clique sur " Combofix.exe "

    [x] Suis les indications qui sont données à l'écran, à un moment tu auras un message te demandant d'installer la console de récupération, fais le.

    [x] Pendant le scan, ne touche à rien ( souris, clavier )

    [x] Tu seras peut être invité à redémarrer ton PC. A la fin du scan, combofix ouvrira un rapport, copie/colle le dans ta prochaine réponse.

    Note : Si jamais il ne s'ouvrait pas, il se trouve sous C:\Combofix.txt
    1
    1. Xplode Contributeur sécurité
      Ok, combofix a fait du ménage mais il en reste encore :

      -+-+-+-+-> CFScript <-+-+-+-+-

      /!\ Attention : Cette procédure n'est valable que pour Baskepes /!\

      [x] Copie le texte en gras ci dessous :


      KillAll::

      DeQuarantine::

      C:\Qoobox\Quarantine\c\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.exe

      File::

      c:\windows\system32\lgep.exe
      c:\windows\system32\akfsp.exe
      c:\windows\Yvyroa.exe
      c:\windows\Yfowaa.exe
      c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

      Firefox::

      FF - user.js: keyword.enabled - true

      NetSvc::

      hkzqnu

      AtJob::


      [x] Ouvre le bloc-note puis colle le texte ci dessus dedans.

      [x] Enregistre ce fichier sur ton bureau ( appelle le CFScript.txt ).

      [x] Fais un glisser/déposer de ce fichier sur combofix.exe comme expliqué ici.

      [x] Combofix va se lancer, patiente le temps du scan.

      /!\ Ne fais rien pendant le scan ( clavier/souris ) /!\

      [x] Poste le contenu du rapport qui s'ouvrira dans ta prochaine réponse.
      1
      1. Xplode Contributeur sécurité
        Bien. On va supprimer ask toolbar maintenant :

        -+-+-+-+-> AD-Remover <-+-+-+-+-

        [x] Télécharge AD-Remover ( de C_XX ).

        [x] Lance AD-Remover puis choisis l'option " Nettoyer ".

        Note : Utilisateurs de vista/seven -> Clic droit sur "Ad-R.exe" puis " Exécuter en tant qu'administrateur "

        [x] Patiente pendant le scan, un rapport s'ouvrira ensuite. Poste son contenu dans ton prochain message

        [x] Note : Le rapport se trouve également sous C:\Ad-Report-CLEAN.txt
        1
        1. Xplode Contributeur sécurité
          -> Vu. On supprime les résidus d'infection puis on terme la désinfection :

          -+-+-+-+-> ZHPFix <-+-+-+-+-

          /!\ Utilisateurs de vista/7 , cette manipulation est à effectuer en tant qu'administrateur ( Clic droit -> [Exécuter en tant qu'administrateur] ) /!\

          [x] Copie le texte en gras ci-dessous ( CTRL + C pour copier )


          [HKCU\Software\?? ?? ???? ????? ??? ?? ????]
          [HKCU\Software\ContextTool]
          [HKCU\Software\LdShih]
          [HKLM\Software\Trad-FR]
          [HKCU\Software\X3EKEPXJP2]
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.cbid", "OF");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.default-channel-url-mask", "https://fr.ask.com/{query}&o={o}&l={l}&qsrc={qsrc}");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.fresh-install", false);
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.l", "dis");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.last-config-req", "1286290202814");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.locale", "fr_FR");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.o", "16050");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.options-lang", "fr");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.options-locale", "UK");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.qsrc", "2871");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.r", "3");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.to", "16105");
          O69 - SBI: prefs.js [ADMIN - lgt7u2hn.default] user_pref("extensions.asktb.default-channel-url-mask", "https://fr.ask.com/{query}&o={o}&l={l}&qsrc={qsrc}");
          O64 - Services: CurCS - (.not file.) - Image Support (hkzqnu) .(.Pas de propriétaire - Pas de description.) - LEGACY_HKZQNU


          [x] Lance ZHPFix qui est présent sur ton bureau.

          [x] Clique sur le "H" bleu ( Coller les lignes Helper )

          [x] Les lignes précédemment copiées apparaîtront à l'écran dans l'encadré jaune pâle.

          [x] Vérifie que seules les lignes indiquées plus haut sont présentes puis clique sur [Ok]

          [x] Clique maintenant sur [Tous] , puis sur [Nettoyer]

          [x] Copie/Colle le contenu du rapport à l'écran dans ton prochain message.

          [x] Note : le rapport se trouve également sous C:\Program Files\ZHPDiag\ZHPFixReport.txt

          ==============================================================================================================

          La désinfection est maintenant terminée, merci de l'avoir suivie jusqu'au bout :)

          Nous allons maintenant terminer la procédure avec la mise à jour de ton PC, la suppression des outils que nous avons utilisés, un peu d'optimisation et plusieurs liens utiles.

          Si nous avons utilisé Malwarebytes' Anti-Malware, tu peux le garder et passer un scan complet une fois par semaine en prenant soin de bien le mettre à jour avant de lancer le scan.

          -+-+-+-+-> Mise à jour du PC <-+-+-+-+-

          [x] Il est important d'avoir les dernières mises à jour sur ton PC. En effet, celles ci corrigent des failles de sécurité qui peuvent parfois être exploitée par un programme malveillant.

          1ère étape : Java

          [o] Télécharge JavaRa puis décompresse le sur ton bureau.
          [o] Ouvre le dossier JavaRa puis exécute JavaRa.exe.
          [o] Clique sur "Search For Updates".
          [o] Sélectionne "Update Using jucheck.exe" puis clique sur "Search".
          [o] Autorise le processus à se connecter s'il te le demande, clique sur "install" et suis la procédure d'installation.
          [o] Une fois l'installation terminée, revient à l'écran de JavaRa et clique sur "Remove Older Versions".
          [o] Clique sur " Oui " pour confirmer. Laisse l'outil travailler, puis clique sur " Ok " et une nouvelle fois sur " Ok ".
          [o] Un rapport s'ouvrira, copie/colle son contenu dans ton prochain message.

          /!\ Si la méthode "Update Using jucheck.exe" ne fonctionne pas, télécharge la dernière version de java à cette adresse puis passe directement à la partie " Remove Older Versions " /!\

          2ème étape : Adobe Reader

          [x] Si tu utilises adobe reader, il est important qu'il soit à jour.
          [x] Si il n'est pas à jour, certains programmes malveillants peuvent exploiter différentes failles et infecter ton PC ( Voir ici )
          [x] Pour vérifier qu'adobe reader est à jour, lance le puis clique sur [Aide] -> [Rechercher les mises à jour]

          3ème étape : Internet Explorer

          [x] Même si tu n'utilises pas Internet Explorer pour naviguer, il est important de le mettre à jour !
          [o] Télécharge Internet Explorer 8 puis installe le.

          4ème étape : Mise à jour des logiciels

          [o] Il est également primordial de garder tes logiciels à jour. Pour ce faire, il existe un petit utilitaire, Update Checker.
          [o] Télécharge le
          [o] Un tutoriel pour son utilisation est disponible ici.

          -+-+-+-+-> Vacciner les supports amovibles <-+-+-+-+-

          [x] Si nous n'avons pas utilisé USBfix lors de la procédure, tu peux vacciner tes supports amovibles pour éviter qu'ils ne s'infectent.
          [x] Télécharge USBfix puis lance le.
          [x] Note : Si ton anvirus émet une alerte, désactive le momentanément ( il s'agit d'un faux positif )
          [x] Branche tout tes médias amovibles ( Clé USB, Disque dur externe, carte SD ) puis sélectionne l'option [Vacciner].
          [x] Appuie sur [Ok] au message de confirmation.

          -+-+-+-+-> DelFix <-+-+-+-+-

          [x] Télécharge DelFix sur ton bureau.

          [x] Lance le et appuie sur [Suppression]

          [x] Copie/colle le contenu du rapport qui s'ouvrira à l'écran dans ton prochain message.

          Note : Le rapport est également sauvegardé à la racine du disque dur ( C:\DelFixSuppr.txt )

          [x] Une fois le rapport posté sur le forum, relance DelFix et appuie sur [Désinstallation].

          -+-+-+-+-> Optimisation <-+-+-+-+-

          1ère étape : Suppression des fichiers inutiles

          [o] Télécharge CCleaner
          [o] Installe le, puis lance le.
          [o] Va dans l'onglet "Options" puis " Avancé " et décoche " Effacer uniquement les fichiers[...] ".
          [o] Cliques sur l'onglet " Nettoyeur " puis cliques sur [Analyser] . A la fin de l'analyse, clique sur [Nettoyer].
          [o] Rends toi à l'onglet " Registre " puis cliques sur [Chercher les erreurs]. Cliques ensuite sur [Corriger les erreurs séléctionnées.
          [o] Accepte la sauvegarde puis enregistre la dans tes documents ( tu pourras la supprimer si aucun problème n'apparaît après la suppression )
          [o] Cliques ensuite sur [Corriger toutes les erreurs sélectionnées] puis sur [Fermer]
          [o] Tu peux renouveller ces opérations tous les jours.

          2ème étape : Défragmentation

          [x] Au fur et à mesure que tu installes des logiciels, copies des fichiers etc.. le disque dur se fragmente et les accès en lecture/écriture sont plus longs.
          [o] Télécharge Defraggler.
          [o] Un tutoriel pour son utilisation est disponible ici.

          3ème étape : Vérification des disques

          [x] Ouvre l'explorateur, puis fais un clique droit sur ta partition principale ( généralement C:\ )
          [x] Clique sur [Propriété] puis sur l'onglet [Outils]
          [x] Clique sur [Vérifier maintenant] puis coche les deux cases présentes.
          [x] Clique sur [Démarrer] ( Tu devras éventuellement redémarrer ton PC et le scan du disque s'effectuera au prochain démarrage )

          4ème étape : Désactivation des programmes au démarrage

          [x] Clique sur [Démarrer] puis [Exécuter].
          [x] Tape msconfig et valide par [ok].
          [x] A l'onglet [Démarrage] , décoche tout les éléments sauf ceux se rapportant à ton antivirus / pare-feu.
          [x] Clique sur [Appliquer] puis [ok] et redémarre ton PC.

          -+-+-+-+-> Purger la restauration système <-+-+-+-+-

          [x] La restauration système est un endroit que windows utilise pour créer des sauvegardes. En cas de soucis, tu peux utiliser ces sauvegardes pour revenir à un état antérieur au problème.

          [x] Après une désinfection, il faut purger la restauration système pour supprimer toutes traces de malwares y résidant.

          [x] Tutoriels :

          - Windows XP
          - Windows Vista
          - Windows 7

          -+-+-+-+-> UAC ( Uniquement pour Vista/Seven ) <-+-+-+-+-

          [x] Si tu as désactivé l'UAC, il est important de la réactiver.

          -> Pourquoi garder l'UAC activée?

          -+-+-+-+-> Security Check <-+-+-+-+-

          [x] Afin de vérifier si toutes les mise à jour ont bien été installées , nous allons utiliser un petit programme.

          [x] Télécharge Security Check ( de Screen317 ) sur ton bureau.

          [x] Lance le, patiente pendant le scan puis poste le rapport qui s'ouvrira dans ta prochaine réponse.

          [x] Une fois le rapport posté, tu peux supprimer Security Check.

          -+-+-+-+-> Liens utiles <-+-+-+-+-

          Ces liens sont en rapport direct avec la sécurité de ton PC.
          Prends le temps de les lire pour comprendre pourquoi tu as été infecté.

          - Les dangers du P2P
          - La sécurité de son PC, c'est quoi?
          - Sécuriser son ordinateur
          - Pourquoi maintenir son navigateur à jour?
          - Les toolbars c'est pas obligatoire
          1
          2. Xplode Contributeur sécurité
            Voilà. Si tu as bien suivi toutes mes recommandations, tu as un PC tout propre ;-)

            Je mets ton sujet en [Résolu]. Bonne appétit / Bonne journée !

            @+
            1
            1. Baskepes Auteur
              Merci pour ta réponse rapide.
              combofix vient de se terminer.

              Mais au redémarrage deux nouveaux messages de antivir sont apparus :
              TR/Kazy.1682.1 dans yuyroa.exe et TR/Llac.kdc dans lgep.exe.

              voici le log de combofix :
              ComboFix 10-10-15.03 - ADMIN 16/10/2010 13:05:34.5.2 - FAT32x86
              Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.511.259 [GMT 2:00]
              Lancé depuis: c:\documents and settings\ADMIN\Bureau\ComboFix.exe
              AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome.manifest
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome\xulcache.jar
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\defaults\preferences\xulcache.js
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\install.rdf
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\wix8mzlj.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\wix8mzlj.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome.manifest
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\wix8mzlj.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome\xulcache.jar
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\wix8mzlj.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\defaults\preferences\xulcache.js
              c:\documents and settings\admin.STGABHTEGOUL.000\Application Data\Mozilla\Firefox\Profiles\wix8mzlj.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\install.rdf
              c:\documents and settings\ADMIN.STGABHTEGOUL\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}
              c:\documents and settings\ADMIN.STGABHTEGOUL\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome.manifest
              c:\documents and settings\ADMIN.STGABHTEGOUL\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome\xulcache.jar
              c:\documents and settings\ADMIN.STGABHTEGOUL\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\defaults\preferences\xulcache.js
              c:\documents and settings\ADMIN.STGABHTEGOUL\Application Data\Mozilla\Firefox\Profiles\2kvhiux7.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\install.rdf
              c:\documents and settings\ADMIN\Application Data\020000005d0612e8691C.manifest
              c:\documents and settings\ADMIN\Application Data\020000005d0612e8691O.manifest
              c:\documents and settings\ADMIN\Application Data\020000005d0612e8691P.manifest
              c:\documents and settings\ADMIN\Application Data\020000005d0612e8691S.manifest
              c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}
              c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome.manifest
              c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome\xulcache.jar
              c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\defaults\preferences\xulcache.js
              c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\install.rdf
              c:\documents and settings\ehassan\Application Data\Mozilla\Firefox\Profiles\d7rqq50v.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}
              c:\documents and settings\ehassan\Application Data\Mozilla\Firefox\Profiles\d7rqq50v.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome.manifest
              c:\documents and settings\ehassan\Application Data\Mozilla\Firefox\Profiles\d7rqq50v.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome\xulcache.jar
              c:\documents and settings\ehassan\Application Data\Mozilla\Firefox\Profiles\d7rqq50v.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\defaults\preferences\xulcache.js
              c:\documents and settings\ehassan\Application Data\Mozilla\Firefox\Profiles\d7rqq50v.default\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\install.rdf
              c:\documents and settings\salliaume\Application Data\Mozilla\Firefox\Profiles\utilcg44_2.0\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}
              c:\documents and settings\salliaume\Application Data\Mozilla\Firefox\Profiles\utilcg44_2.0\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome.manifest
              c:\documents and settings\salliaume\Application Data\Mozilla\Firefox\Profiles\utilcg44_2.0\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\chrome\xulcache.jar
              c:\documents and settings\salliaume\Application Data\Mozilla\Firefox\Profiles\utilcg44_2.0\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\defaults\preferences\xulcache.js
              c:\documents and settings\salliaume\Application Data\Mozilla\Firefox\Profiles\utilcg44_2.0\extensions\{53d3a96a-bfd6-42d3-a947-c10579fd7bd6}\install.rdf
              C:\InfoSat.txt
              c:\program files\webserver
              c:\program files\webserver\add_server.gif
              c:\program files\webserver\arrow_down.gif
              c:\program files\webserver\arrow_up.gif
              c:\program files\webserver\arrow_up_q.gif
              c:\program files\webserver\black.gif
              c:\program files\webserver\blue1.gif
              c:\program files\webserver\blue2.gif
              c:\program files\webserver\blue3.gif
              c:\program files\webserver\blue4.gif
              c:\program files\webserver\blue5.gif
              c:\program files\webserver\blue6.gif
              c:\program files\webserver\checked.gif
              c:\program files\webserver\checked_no.gif
              c:\program files\webserver\complete.gif
              c:\program files\webserver\completing.gif
              c:\program files\webserver\connecting.gif
              c:\program files\webserver\ct_0.gif
              c:\program files\webserver\ct_1.gif
              c:\program files\webserver\ct_a.gif
              c:\program files\webserver\ct_h.gif
              c:\program files\webserver\ct_l.gif
              c:\program files\webserver\ct_m.gif
              c:\program files\webserver\ct_s.gif
              c:\program files\webserver\ct_u.gif
              c:\program files\webserver\disconnected.gif
              c:\program files\webserver\downloading.gif
              c:\program files\webserver\error.gif
              c:\program files\webserver\failed.gif
              c:\program files\webserver\favicon.ico
              c:\program files\webserver\file.gif
              c:\program files\webserver\filedown.gif
              c:\program files\webserver\filetype_archive.gif
              c:\program files\webserver\filetype_audio.gif
              c:\program files\webserver\filetype_cdimage.gif
              c:\program files\webserver\filetype_document.gif
              c:\program files\webserver\filetype_emulecollection.gif
              c:\program files\webserver\filetype_other.gif
              c:\program files\webserver\filetype_picture.gif
              c:\program files\webserver\filetype_program.gif
              c:\program files\webserver\filetype_video.gif
              c:\program files\webserver\green.gif
              c:\program files\webserver\greenpercent.gif
              c:\program files\webserver\h_emule.gif
              c:\program files\webserver\h_graph.gif
              c:\program files\webserver\h_graphs.gif
              c:\program files\webserver\h_kad.gif
              c:\program files\webserver\h_log.gif
              c:\program files\webserver\h_preferences.gif
              c:\program files\webserver\h_search.gif
              c:\program files\webserver\h_server.gif
              c:\program files\webserver\h_shared.gif
              c:\program files\webserver\h_statistic.gif
              c:\program files\webserver\h_transfer.gif
              c:\program files\webserver\hashing.gif
              c:\program files\webserver\high.gif
              c:\program files\webserver\is_a4af.gif
              c:\program files\webserver\is_banned.gif
              c:\program files\webserver\is_credit.gif
              c:\program files\webserver\is_friend.gif
              c:\program files\webserver\is_getflc.gif
              c:\program files\webserver\is_halfcmtbad.gif
              c:\program files\webserver\is_halfcmtgood.gif
              c:\program files\webserver\is_halfnone.gif
              c:\program files\webserver\is_none.gif
              c:\program files\webserver\is_release.gif
              c:\program files\webserver\is_static.gif
              c:\program files\webserver\l_add.gif
              c:\program files\webserver\l_calendar.gif
              c:\program files\webserver\l_cancel.gif
              c:\program files\webserver\l_catarrow.gif
              c:\program files\webserver\l_category.gif
              c:\program files\webserver\l_catprio.gif
              c:\program files\webserver\l_clear.gif
              c:\program files\webserver\l_clock.gif
              c:\program files\webserver\l_close.gif
              c:\program files\webserver\l_comments.gif
              c:\program files\webserver\l_con.gif
              c:\program files\webserver\l_connect.gif
              c:\program files\webserver\l_dndoublearrow.gif
              c:\program files\webserver\l_downarrow.gif
              c:\program files\webserver\l_ed2klink.gif
              c:\program files\webserver\l_filedonkey.gif
              c:\program files\webserver\l_filesearch.gif
              c:\program files\webserver\l_forum.gif
              c:\program files\webserver\l_friend.gif
              c:\program files\webserver\l_getflc.gif
              c:\program files\webserver\l_hasherror.gif
              c:\program files\webserver\l_homepage.gif
              c:\program files\webserver\l_info.gif
              c:\program files\webserver\l_logout.gif
              c:\program files\webserver\l_none.gif
              c:\program files\webserver\l_options.gif
              c:\program files\webserver\l_pause.gif
              c:\program files\webserver\l_reboot.gif
              c:\program files\webserver\l_remove.gif
              c:\program files\webserver\l_rename.gif
              c:\program files\webserver\l_resume.gif
              c:\program files\webserver\l_search.gif
              c:\program files\webserver\l_server.gif
              c:\program files\webserver\l_shared.gif
              c:\program files\webserver\l_showcat.gif
              c:\program files\webserver\l_shutdown.gif
              c:\program files\webserver\l_sources_0.gif
              c:\program files\webserver\l_sources_10.gif
              c:\program files\webserver\l_sources_25.gif
              c:\program files\webserver\l_sources_5.gif
              c:\program files\webserver\l_sources_50.gif
              c:\program files\webserver\l_static.gif
              c:\program files\webserver\l_stop.gif
              c:\program files\webserver\l_timer.gif
              c:\program files\webserver\l_timer_off.gif
              c:\program files\webserver\l_uparrow.gif
              c:\program files\webserver\l_updoublearrow.gif
              c:\program files\webserver\l_users.gif
              c:\program files\webserver\l_version.gif
              c:\program files\webserver\login_bottom.gif
              c:\program files\webserver\login_downmain.gif
              c:\program files\webserver\login_lefttop.gif
              c:\program files\webserver\login_righttop.gif
              c:\program files\webserver\login_top.gif
              c:\program files\webserver\login_topdown.gif
              c:\program files\webserver\login_topseperator.gif
              c:\program files\webserver\logo.jpg
              c:\program files\webserver\low.gif
              c:\program files\webserver\m_category.gif
              c:\program files\webserver\m_catprio.gif
              c:\program files\webserver\m_clearcompleted.gif
              c:\program files\webserver\main_bg.gif
              c:\program files\webserver\main_menubg.gif
              c:\program files\webserver\main_topbar.gif
              c:\program files\webserver\main_topbardarker.gif
              c:\program files\webserver\main_topbarseperator.gif
              c:\program files\webserver\p_black.gif
              c:\program files\webserver\p_blue1.gif
              c:\program files\webserver\p_blue2.gif
              c:\program files\webserver\p_blue3.gif
              c:\program files\webserver\p_blue4.gif
              c:\program files\webserver\p_blue5.gif
              c:\program files\webserver\p_blue6.gif
              c:\program files\webserver\p_green.gif
              c:\program files\webserver\p_greenpercent.gif
              c:\program files\webserver\p_red.gif
              c:\program files\webserver\p_yellow.gif
              c:\program files\webserver\paused.gif
              c:\program files\webserver\qs_con.jpg
              c:\program files\webserver\qs_down.jpg
              c:\program files\webserver\qs_up.jpg
              c:\program files\webserver\qs_user.jpg
              c:\program files\webserver\red.gif
              c:\program files\webserver\stalled.gif
              c:\program files\webserver\stats_0.gif
              c:\program files\webserver\stats_1.gif
              c:\program files\webserver\stats_10.gif
              c:\program files\webserver\stats_11.gif
              c:\program files\webserver\stats_12.gif
              c:\program files\webserver\stats_13.gif
              c:\program files\webserver\stats_14.gif
              c:\program files\webserver\stats_15.gif
              c:\program files\webserver\stats_16.gif
              c:\program files\webserver\stats_17.gif
              c:\program files\webserver\stats_2.gif
              c:\program files\webserver\stats_3.gif
              c:\program files\webserver\stats_4.gif
              c:\program files\webserver\stats_5.gif
              c:\program files\webserver\stats_6.gif
              c:\program files\webserver\stats_7.gif
              c:\program files\webserver\stats_8.gif
              c:\program files\webserver\stats_9.gif
              c:\program files\webserver\stats_back.gif
              c:\program files\webserver\stats_con.gif
              c:\program files\webserver\stats_down.gif
              c:\program files\webserver\stats_hidden.gif
              c:\program files\webserver\stats_space.gif
              c:\program files\webserver\stats_up.gif
              c:\program files\webserver\stats_visible.gif
              c:\program files\webserver\stopped.gif
              c:\program files\webserver\t_complete.gif
              c:\program files\webserver\t_completing.gif
              c:\program files\webserver\t_connecting.gif
              c:\program files\webserver\t_downloading.gif
              c:\program files\webserver\t_error.gif
              c:\program files\webserver\t_hashing.gif
              c:\program files\webserver\t_next.gif
              c:\program files\webserver\t_paused.gif
              c:\program files\webserver\t_stalled.gif
              c:\program files\webserver\t_stopped.gif
              c:\program files\webserver\t_uploading.gif
              c:\program files\webserver\t_waiting.gif
              c:\program files\webserver\t_waitinghash.gif
              c:\program files\webserver\transparent.gif
              c:\program files\webserver\waiting.gif
              c:\program files\webserver\waitinghash.gif
              c:\program files\webserver\yellow.gif
              c:\windows\mt4c71.dll
              c:\windows\system\oeminfo.ini
              c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.exe
              c:\windows\system32\sshnas21.dll
              c:\windows\system32\test
              c:\windows\system32\winset.ini
              c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
              c:\windows\Uninstall.ini

              .
              ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
              .

              -------\Legacy_SSHNAS
              -------\Service_SSHNAS
              -------\Service_usnjsvc

              ((((((((((((((((((((((((((((( Fichiers créés du 2010-09-16 au 2010-10-16 ))))))))))))))))))))))))))))))))))))
              .

              2010-10-16 10:32 . 2010-10-16 10:32 -------- d-----w- C:\rsit
              2010-10-12 18:03 . 2010-10-12 18:03 200704 ----a-w- c:\windows\Yfowaa.exe
              2010-10-12 18:03 . 2010-10-12 18:03 351232 ----a-w- c:\windows\system32\akfsp.exe
              2010-10-12 18:02 . 2010-10-12 18:02 204800 ----a-w- c:\windows\Yvyroa.exe
              2010-10-12 18:01 . 2010-10-12 18:02 351232 ----a-w- c:\windows\system32\lgep.exe
              2010-10-12 17:09 . 2010-10-12 17:09 -------- d-----w- C:\PRONOTE 2010
              2010-10-10 16:48 . 2010-10-10 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
              2010-10-08 09:28 . 2010-10-08 09:28 -------- d-----w- c:\documents and settings\All Users\Application Data\SFR
              2010-10-08 09:28 . 2010-10-08 09:28 -------- d-----w- c:\documents and settings\ADMIN\Local Settings\Application Data\SFR
              2010-10-08 09:28 . 2010-10-08 09:28 -------- d-----w- c:\program files\SFR
              2010-09-23 14:15 . 2010-09-23 14:15 -------- d-----w- c:\windows\Microsoft.VC80.ATL
              2010-09-23 14:15 . 2008-07-29 13:38 98304 ----a-w- c:\windows\FunambolAddin.dll
              2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
              2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .

              ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
              "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

              [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

              [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
              2010-06-10 15:28 1233288 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
              "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

              [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
              [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
              "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

              [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
              [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-16 68856]
              "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-06-24 247144]
              "9Giga Synchro"="c:\program files\SFR\9Giga Synchro\9Giga_Synchro.exe" [2008-12-19 6931848]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "MoneyStartUp10.0"="c:\program files\Microsoft Money\System\Activation.exe" [2001-07-25 245810]
              "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
              "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
              "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
              "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
              "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
              "SoundMan"="SOUNDMAN.EXE" [2004-06-18 67584]
              "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-05-24 209153]
              "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
              "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2009-08-28 606208]
              "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
              "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
              "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
              "CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]

              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

              c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
              Logiciel de Synchronisation Orange.lnk - e:\orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-3-22 684032]
              Lancement rapide d'Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2007-5-31 25214]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
              "NoWelcomeScreen"= 1 (0x1)

              [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
              "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
              2009-10-25 17:35 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1085031214-1229272821-1801674531-1128\Scripts\Logon\0\0]
              "Script"=\\serv1\NETLOGON\CG44_Start_Support.vbs

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1085031214-1229272821-1801674531-1128\Scripts\Logon\0\1]
              "Script"=\\serv1\NETLOGON\PRINTERS.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1113\Scripts\Logoff\0\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1113\Scripts\Logon\0\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOn_Support.vbs

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1113\Scripts\Logon\0\1]
              "Script"=\\serv1\NETLOGON\PRINTERS.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logoff\0\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logon\0\0]
              "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logon\1\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOn_User.vbs

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logon\1\1]
              "Script"=\\serv1\netlogon\PRINTERS.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logoff\0\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logon\0\0]
              "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logon\1\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOn_User.vbs

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logon\1\1]
              "Script"=\\serv1\netlogon\PRINTERS.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logoff\0\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logon\0\0]
              "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logon\1\0]
              "Script"=\\serv1\NETLOGON\CG44_LogOn_User.vbs

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logon\1\1]
              "Script"=\\serv1\netlogon\PRINTERS.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logoff\0\0]
              "Script"=\\serv1\netlogon\CG44_LogOff_User.bat

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logon\0\0]
              "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logon\1\0]
              "Script"=\\serv1\netlogon\CG44_LogOn_User.vbs

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logon\1\1]
              "Script"=\\serv1\NETLOGON\PRINTERS.VBS

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
              "c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
              "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
              "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
              "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
              "c:\\Program Files\\LimeWire\\LimeWire.exe"=
              "c:\\Program Files\\iTunes\\iTunes.exe"=
              "c:\\Program Files\\ABC\\abc.exe"=
              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
              "%windir%\\system32\\sessmgr.exe"=
              "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
              "c:\\Program Files\\MSN Messenger\\livecall.exe"=
              "\\\\maison-serveur\\data\\StubInstaller.exe"=
              "c:\\Program Files\\Maïdo Production\\IziSpot 4\\IziSpot.exe"=
              "c:\\Program Files\\Acer\\AcerSync\\AcerSync.exe"=

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
              "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
              "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

              R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [24/05/2007 20:12 5632]
              R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [05/11/2007 20:26 11264]
              R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [13/05/2008 12:43 12872]
              R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [13/05/2008 12:43 61440]
              R2 AcerSyncServiceWinService;AcerSyncServiceWinService;c:\program files\Acer\AcerSync\AcerSyncService.exe -p --> c:\program files\Acer\AcerSync\AcerSyncService.exe -p [?]
              R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [24/05/2009 19:29 194817]
              R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [24/05/2009 19:29 108289]
              R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [24/05/2009 19:29 434945]
              R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/06/2010 16:41 92008]
              R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [26/04/2010 11:43 6016]
              R3 IPN2220;acer IPN2220 Wireless LAN Card Driver;c:\windows\system32\drivers\i2220ntx.sys [01/01/1980 160896]
              S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [01/02/2010 08:44 135664]
              S2 hkzqnu;Image Support;c:\windows\system32\svchost.exe -k netsvcs [02/03/2006 12:00 14336]
              S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
              S2 XAMPP;XAMPP Service;e:\xampplite\service.exe --> e:\xampplite\service.exe [?]
              S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [30/05/2010 11:37 25728]
              S3 qcusbser;ACER Android USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [30/05/2010 11:37 105984]
              S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [13/05/2008 12:44 12872]
              S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [23/08/2007 18:59 87824]
              S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [23/08/2007 18:59 85696]

              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
              hkzqnu

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
              2007-09-19 08:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
              .
              Contenu du dossier 'Tâches planifiées'

              2010-09-22 c:\windows\Tasks\AppleSoftwareUpdate.job
              - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

              2010-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
              - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 06:44]

              2010-09-27 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
              - c:\program files\Ask.com\UpdateTask.exe [2010-06-10 15:28]

              2010-10-12 c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
              - c:\windows\Yfowaa.exe [2010-10-12 18:03]

              2010-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb6b9d47eac957.job
              - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 06:44]
              .
              .
              ------- Examen supplémentaire -------
              .
              uStart Page = hxxp://home.neuf.fr/
              uInternet Settings,ProxyOverride = <local>
              IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
              IE: Convertir en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
              IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
              IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
              IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
              IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
              IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
              IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
              IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
              IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
              LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
              Trusted Zone: localhost
              FF - ProfilePath - c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\
              FF - prefs.js: browser.search.selectedEngine - Google
              FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
              FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=LMW2&o=16050&locale=fr_FR&q=
              FF - prefs.js: network.proxy.type - 4
              FF - component: c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
              FF - plugin: c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{9CCE52B0-5079-4177-9586-1BF6575E62DE}\platform\WINNT\plugins\npcplay.dll
              FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
              FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
              FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
              FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
              FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
              FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
              FF - plugin: c:\program files\Panda Security\TotalScan\npwrapper.dll
              FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

              ---- PARAMETRES FIREFOX ----
              /search.php?q=);
              FF - user.js: keyword.enabled - true
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
              .
              - - - - ORPHELINS SUPPRIMES - - - -

              BHO-{9ff3bd68-7151-814c-bce9-f7e71e9f74f2} - (no file)
              HKCU-Run-Hsekihumevixi - c:\windows\mt4c71.dll
              HKLM-Run-EPSON Stylus Photo R200 Series - c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE

              [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\hkzqnu]
              "ServiceDll"="c:\windows\system32\jbgfozmt.dll"
              .
              --------------------- CLES DE REGISTRE BLOQUEES ---------------------

              [HKEY_USERS\S-1-5-21-2367553672-2179607304-20112698-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
              "Name"="ActiveSync"
              "DisplayName"="Microsoft ActiveSync"
              "Param1"="ActiveSync"
              "Param2"=""
              "Type"="wellknown"
              "Order"=dword:00000000
              "State"=dword:00000007

              [HKEY_USERS\S-1-5-21-2367553672-2179607304-20112698-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\DesktopAppInstall\oemDesktop3]
              "Name"="oemDesktop3"
              "DisplayName"="Pilote du modem USB"
              "Param1"="oem\\apps\\drivers\\GSM USB Modem\\USBModem_Dialer.exe"
              "Param2"=""
              "Type"="createprocess"
              "Order"=dword:00000000
              "State"=dword:0000001b

              [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\run\OptionalComponents\IMAIL]
              @DACL=(02 0000)
              @=""
              "Installed"="1"

              [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\run\OptionalComponents\MAPI]
              @DACL=(02 0000)
              @=""
              "Installed"="1"
              "NoChange"="1"

              [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\run\OptionalComponents\MSFS]
              @DACL=(02 0000)
              @=""
              "Installed"="1"
              .
              --------------------- DLLs chargées dans les processus actifs ---------------------

              - - - - - - - > 'winlogon.exe'(748)
              c:\program files\SUPERAntiSpyware\SASWINLO.DLL

              - - - - - - - > 'lsass.exe'(808)
              c:\program files\Avira\AntiVir Desktop\avsda.dll

              - - - - - - - > 'explorer.exe'(3696)
              c:\program files\Windows Media Player\wmpband.dll
              c:\windows\system32\WPDShServiceObj.dll
              c:\windows\system32\eappprxy.dll
              c:\program files\Avira\AntiVir Desktop\avsda.dll
              c:\windows\system32\PortableDeviceTypes.dll
              c:\windows\system32\PortableDeviceApi.dll
              .
              ------------------------ Autres processus actifs ------------------------
              .
              c:\windows\system32\Ati2evxx.exe
              c:\windows\system32\netdde.exe
              c:\program files\Acer\AcerSync\AcerSyncService.exe
              c:\acer\eManager\anbmServ.exe
              c:\program files\Avira\AntiVir Desktop\avguard.exe
              c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              c:\program files\Java\jre6\bin\jqs.exe
              c:\windows\system32\wbem\wmiapsrv.exe
              c:\windows\SOUNDMAN.EXE
              c:\program files\Microsoft ActiveSync\wcescomm.exe
              c:\progra~1\MICROS~3\rapimgr.exe
              e:\orange\Logiciel de Synchronisation Orange\SyncManager.exe
              c:\program files\iPod\bin\iPodService.exe
              .
              **************************************************************************
              .
              Heure de fin: 2010-10-16 13:25:56 - La machine a redémarré
              ComboFix-quarantined-files.txt 2010-10-16 11:25

              Avant-CF: 3 516 071 936 octets libres
              Après-CF: 3 939 434 496 octets libres

              WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
              [boot loader]
              timeout=2
              default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
              [operating systems]
              c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
              UnsupportedDebug="do not select this" /debug
              multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

              - - End Of File - - 8DE0331ABF43C6E1DE99B7AE9D440D00
              Cordialement.
              A+
              0
              1. Baskepes Auteur
                Voici le rapport :
                ComboFix 10-10-15.03 - ADMIN 16/10/2010 14:02:18.6.2 - FAT32x86
                Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.511.283 [GMT 2:00]
                Lancé depuis: c:\documents and settings\ADMIN\Bureau\ComboFix.exe
                Commutateurs utilisés :: c:\documents and settings\ADMIN\Bureau\CFScript.txt
                AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

                FILE ::
                "c:\windows\system32\akfsp.exe"
                "c:\windows\system32\lgep.exe"
                "c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job"
                "c:\windows\Yfowaa.exe"
                "c:\windows\Yvyroa.exe"
                .

                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                .

                c:\windows\system32\akfsp.exe
                c:\windows\system32\lgep.exe
                c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
                c:\windows\Yfowaa.exe
                c:\windows\Yvyroa.exe

                .
                ((((((((((((((((((((((((((((( Fichiers créés du 2010-09-16 au 2010-10-16 ))))))))))))))))))))))))))))))))))))
                .

                2010-10-16 10:32 . 2010-10-16 10:32 -------- d-----w- C:\rsit
                2010-10-12 17:09 . 2010-10-12 17:09 -------- d-----w- C:\PRONOTE 2010
                2010-10-10 16:48 . 2010-10-10 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
                2010-10-08 09:28 . 2010-10-08 09:28 -------- d-----w- c:\documents and settings\All Users\Application Data\SFR
                2010-10-08 09:28 . 2010-10-08 09:28 -------- d-----w- c:\documents and settings\ADMIN\Local Settings\Application Data\SFR
                2010-10-08 09:28 . 2010-10-08 09:28 -------- d-----w- c:\program files\SFR
                2010-09-23 14:15 . 2010-09-23 14:15 -------- d-----w- c:\windows\Microsoft.VC80.ATL
                2010-09-23 14:15 . 2008-07-29 13:38 98304 ----a-w- c:\windows\FunambolAddin.dll
                2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
                2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

                .
                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .

                ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                REGEDIT4

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
                "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

                [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

                [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
                2010-06-10 15:28 1233288 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

                [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
                [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
                [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
                [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
                "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]

                [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
                [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
                [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
                [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-16 68856]
                "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-06-24 247144]
                "9Giga Synchro"="c:\program files\SFR\9Giga Synchro\9Giga_Synchro.exe" [2008-12-19 6931848]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "MoneyStartUp10.0"="c:\program files\Microsoft Money\System\Activation.exe" [2001-07-25 245810]
                "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
                "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
                "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
                "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
                "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
                "SoundMan"="SOUNDMAN.EXE" [2004-06-18 67584]
                "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-05-24 209153]
                "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
                "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2009-08-28 606208]
                "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
                "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
                "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
                "CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]

                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
                Logiciel de Synchronisation Orange.lnk - e:\orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-3-22 684032]
                Lancement rapide d'Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2007-5-31 25214]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
                "NoWelcomeScreen"= 1 (0x1)

                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
                2009-10-25 17:35 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1085031214-1229272821-1801674531-1128\Scripts\Logon\0\0]
                "Script"=\\serv1\NETLOGON\CG44_Start_Support.vbs

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1085031214-1229272821-1801674531-1128\Scripts\Logon\0\1]
                "Script"=\\serv1\NETLOGON\PRINTERS.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1113\Scripts\Logoff\0\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1113\Scripts\Logon\0\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOn_Support.vbs

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1113\Scripts\Logon\0\1]
                "Script"=\\serv1\NETLOGON\PRINTERS.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logoff\0\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logon\0\0]
                "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logon\1\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOn_User.vbs

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1161\Scripts\Logon\1\1]
                "Script"=\\serv1\netlogon\PRINTERS.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logoff\0\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logon\0\0]
                "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logon\1\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOn_User.vbs

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1173\Scripts\Logon\1\1]
                "Script"=\\serv1\netlogon\PRINTERS.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logoff\0\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOff_User.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logon\0\0]
                "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logon\1\0]
                "Script"=\\serv1\NETLOGON\CG44_LogOn_User.vbs

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1174\Scripts\Logon\1\1]
                "Script"=\\serv1\netlogon\PRINTERS.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logoff\0\0]
                "Script"=\\serv1\netlogon\CG44_LogOff_User.bat

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logon\0\0]
                "Script"=\\serv1\NETLOGON\PRINTERSP.VBS

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logon\1\0]
                "Script"=\\serv1\netlogon\CG44_LogOn_User.vbs

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1717642210-3911622346-2367019261-1186\Scripts\Logon\1\1]
                "Script"=\\serv1\NETLOGON\PRINTERS.VBS

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
                "c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
                "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
                "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
                "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
                "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                "c:\\Program Files\\iTunes\\iTunes.exe"=
                "c:\\Program Files\\ABC\\abc.exe"=
                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                "%windir%\\system32\\sessmgr.exe"=
                "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
                "c:\\Program Files\\MSN Messenger\\livecall.exe"=
                "\\\\maison-serveur\\data\\StubInstaller.exe"=
                "c:\\Program Files\\Maïdo Production\\IziSpot 4\\IziSpot.exe"=
                "c:\\Program Files\\Acer\\AcerSync\\AcerSync.exe"=

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
                "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

                R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [24/05/2007 20:12 5632]
                R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [05/11/2007 20:26 11264]
                R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [13/05/2008 12:43 12872]
                R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [13/05/2008 12:43 61440]
                R2 AcerSyncServiceWinService;AcerSyncServiceWinService;c:\program files\Acer\AcerSync\AcerSyncService.exe -p --> c:\program files\Acer\AcerSync\AcerSyncService.exe -p [?]
                R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [24/05/2009 19:29 194817]
                R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [24/05/2009 19:29 108289]
                R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [24/05/2009 19:29 434945]
                R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/06/2010 16:41 92008]
                R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [26/04/2010 11:43 6016]
                R3 IPN2220;acer IPN2220 Wireless LAN Card Driver;c:\windows\system32\drivers\i2220ntx.sys [01/01/1980 160896]
                S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [01/02/2010 08:44 135664]
                S2 hkzqnu;Image Support;c:\windows\system32\svchost.exe -k netsvcs [02/03/2006 12:00 14336]
                S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
                S2 XAMPP;XAMPP Service;e:\xampplite\service.exe --> e:\xampplite\service.exe [?]
                S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [30/05/2010 11:37 25728]
                S3 qcusbser;ACER Android USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [30/05/2010 11:37 105984]
                S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [13/05/2008 12:44 12872]
                S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [23/08/2007 18:59 87824]
                S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [23/08/2007 18:59 85696]

                [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
                2007-09-19 08:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
                .
                Contenu du dossier 'Tâches planifiées'

                2010-09-22 c:\windows\Tasks\AppleSoftwareUpdate.job
                - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

                2010-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
                - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 06:44]

                2010-09-27 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
                - c:\program files\Ask.com\UpdateTask.exe [2010-06-10 15:28]

                2010-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb6b9d47eac957.job
                - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 06:44]
                .
                .
                ------- Examen supplémentaire -------
                .
                uStart Page = hxxp://home.neuf.fr/
                uInternet Settings,ProxyOverride = <local>
                IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                IE: Convertir en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
                IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
                IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
                IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
                LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
                Trusted Zone: localhost
                FF - ProfilePath - c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\
                FF - prefs.js: browser.search.selectedEngine - Google
                FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
                FF - prefs.js: network.proxy.type - 4
                FF - component: c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
                FF - plugin: c:\documents and settings\ADMIN\Application Data\Mozilla\Firefox\Profiles\lgt7u2hn.default\extensions\{9CCE52B0-5079-4177-9586-1BF6575E62DE}\platform\WINNT\plugins\npcplay.dll
                FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
                FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
                FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
                FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
                FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
                FF - plugin: c:\program files\Panda Security\TotalScan\npwrapper.dll
                FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

                ---- PARAMETRES FIREFOX ----
                /search.php?q=);
                FF - user.js: keyword.enabled - true
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
                .

                [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\hkzqnu]
                "ServiceDll"="c:\windows\system32\jbgfozmt.dll"
                .
                --------------------- CLES DE REGISTRE BLOQUEES ---------------------

                [HKEY_USERS\S-1-5-21-2367553672-2179607304-20112698-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
                "Name"="ActiveSync"
                "DisplayName"="Microsoft ActiveSync"
                "Param1"="ActiveSync"
                "Param2"=""
                "Type"="wellknown"
                "Order"=dword:00000000
                "State"=dword:00000007

                [HKEY_USERS\S-1-5-21-2367553672-2179607304-20112698-1005\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\DesktopAppInstall\oemDesktop3]
                "Name"="oemDesktop3"
                "DisplayName"="Pilote du modem USB"
                "Param1"="oem\\apps\\drivers\\GSM USB Modem\\USBModem_Dialer.exe"
                "Param2"=""
                "Type"="createprocess"
                "Order"=dword:00000000
                "State"=dword:0000001b

                [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\run\OptionalComponents\IMAIL]
                @DACL=(02 0000)
                @=""
                "Installed"="1"

                [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\run\OptionalComponents\MAPI]
                @DACL=(02 0000)
                @=""
                "Installed"="1"
                "NoChange"="1"

                [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\run\OptionalComponents\MSFS]
                @DACL=(02 0000)
                @=""
                "Installed"="1"
                .
                --------------------- DLLs chargées dans les processus actifs ---------------------

                - - - - - - - > 'winlogon.exe'(752)
                c:\program files\SUPERAntiSpyware\SASWINLO.DLL

                - - - - - - - > 'lsass.exe'(812)
                c:\program files\Avira\AntiVir Desktop\avsda.dll

                - - - - - - - > 'explorer.exe'(1848)
                c:\program files\Windows Media Player\wmpband.dll
                c:\windows\system32\eappprxy.dll
                c:\windows\system32\WPDShServiceObj.dll
                c:\program files\Avira\AntiVir Desktop\avsda.dll
                c:\windows\system32\PortableDeviceTypes.dll
                c:\windows\system32\PortableDeviceApi.dll
                .
                ------------------------ Autres processus actifs ------------------------
                .
                c:\windows\system32\Ati2evxx.exe
                c:\windows\system32\netdde.exe
                c:\program files\Acer\AcerSync\AcerSyncService.exe
                c:\acer\eManager\anbmServ.exe
                c:\program files\Avira\AntiVir Desktop\avguard.exe
                c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                c:\program files\Java\jre6\bin\jqs.exe
                c:\windows\system32\wbem\wmiapsrv.exe
                c:\windows\SOUNDMAN.EXE
                c:\program files\Microsoft ActiveSync\wcescomm.exe
                c:\progra~1\MICROS~3\rapimgr.exe
                e:\orange\Logiciel de Synchronisation Orange\SyncManager.exe
                c:\program files\iPod\bin\iPodService.exe
                .
                **************************************************************************
                .
                Heure de fin: 2010-10-16 14:20:03 - La machine a redémarré
                ComboFix-quarantined-files.txt 2010-10-16 12:20
                ComboFix2.txt 2010-10-16 11:25

                Avant-CF: 3 789 094 912 octets libres
                Après-CF: 3 784 835 072 octets libres

                WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
                [boot loader]
                timeout=2
                default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
                [operating systems]
                c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                UnsupportedDebug="do not select this" /debug
                multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

                - - End Of File - - 8A934FB1A2ACE66F78DB676B94B705FE

                Encore merci.
                0
                1. Baskepes Auteur
                  Ok,
                  voici le rapport :
                  ======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======

                  Mis à jour par C_XX le 16/09/10 à 13:30
                  Contact: AdRemover.contact[AT]gmail.com
                  Site web: http://www.teamxscript.org

                  C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 14:40:43 le 16/10/2010, Mode normal

                  Microsoft Windows XP Professionnel Service Pack 3 (X86)
                  ADMIN@STGABHTEGOULP01 ( )

                  ============== ACTION(S) ==============

                  0,Dossier supprimé: C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
                  0,Fichier supprimé: C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
                  0,Fichier supprimé: C:\Documents and Settings\ADMIN\Application Data\Mozilla\FireFox\Profiles\lgt7u2hn.default\searchplugins\askcom.xml
                  0,Dossier supprimé: C:\Program Files\Ask.com
                  0,Dossier supprimé: C:\Documents and Settings\ADMIN\Local Settings\Application Data\AskToolbar
                  0,Fichier supprimé: C:\WINDOWS\system32\3bfc4e05-60ba-a91e-09d2-763d2e649264.exe
                  3,Fichier supprimé: C:\WINDOWS\Installer\f85dc.msi

                  (!) -- Fichiers temporaires supprimés.

                  -- Fichier ouvert: C:\Documents and Settings\ADMIN\Application Data\Mozilla\FireFox\Profiles\lgt7u2hn.default\Prefs.js --
                  -- Fichier Fermé --

                  1,Clé supprimée: HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
                  1,Clé supprimée: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
                  1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
                  1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
                  1,Clé supprimée: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
                  1,Clé supprimée: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
                  1,Clé supprimée: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
                  1,Clé supprimée: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
                  1,Clé supprimée: HKLM\Software\Classes\TypeLib\{A471012F-E2E5-48EB-9A8B-9D4090B1D0C7}
                  1,Clé supprimée: HKLM\Software\Classes\TypeLib\{C6416898-DF97-4013-B22E-0A5D2A98DDF4}
                  0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
                  0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
                  0,Clé supprimée: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
                  1,Clé supprimée: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
                  0,Clé supprimée: HKCU\Software\Ask.com
                  0,Clé supprimée: HKCU\Software\AskToolbar
                  0,Clé supprimée: HKCU\Software\AppDataLow\AskToolbarInfo
                  3,Clé supprimée: HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
                  3,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
                  3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
                  3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
                  3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
                  0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

                  0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{00000000-6E41-4FD3-8538-502F5495E5FC}
                  0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
                  0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

                  ============== SCAN ADDITIONNEL ==============

                  ** Mozilla Firefox Version [3.6.10 (fr)] **

                  -- C:\Documents and Settings\ADMIN\Application Data\Mozilla\FireFox\Profiles\lgt7u2hn.default\Prefs.js --
                  browser.download.dir, E:\\TELECHARGER\\vidéo
                  browser.download.lastDir, C:\\Documents and Settings\\ADMIN\\Bureau
                  browser.search.defaultenginename, Ask.com
                  browser.search.selectedEngine, Google
                  browser.startup.homepage, hxxp://www.google.fr/
                  browser.startup.homepage_override.mstone, rv:1.9.2.10
                  privacy.popups.showBrowserMessage, false

                  ========================================

                  ** Internet Explorer Version [7.0.5730.13] **

                  [HKCU\Software\Microsoft\Internet Explorer\Main]
                  AutoHide: yes
                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Do404Search: 0x01000000
                  Enable Browser Extensions: yes
                  Local Page: C:\WINDOWS\system32\blank.htm
                  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                  Show_ToolBar: yes
                  Start Page: hxxp://fr.msn.com/
                  Use Search Asst: no

                  [HKLM\Software\Microsoft\Internet Explorer\Main]
                  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Delete_Temp_Files_On_Exit: yes
                  Local Page: C:\WINDOWS\system32\blank.htm
                  Search bar: hxxp://search.msn.com/spbasic.htm
                  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Start Page: hxxp://fr.msn.com/

                  [HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
                  Tabs: res://ieframe.dll/tabswelcome.htm
                  Blank: res://mshtml.dll/blank.htm

                  ========================================

                  C:\Program Files\Ad-Remover\Quarantine: 36 Fichier(s)
                  C:\Program Files\Ad-Remover\Backup: 31 Fichier(s)

                  C:\Ad-Report-CLEAN[1].txt - 16/10/2010 (3732 Octet(s))

                  Fin à: 14:44:54, 16/10/2010

                  ============== E.O.F ==============
                  0
                  1. Xplode Contributeur sécurité
                    -> Vu.

                    On a fait du ménage, mais on a pas encore terminé :

                    -+-+-+-+-> Malwarebytes' Anti-Malware <-+-+-+-+-

                    [x] Télécharge Malwarebytes' Anti-malware sur ton bureau.

                    [x] Installe le en laissant les options par défaut ( Cocher seulement " Créer une icône sur le bureau " )

                    [x] A la fin de l'installation, MBAM se mettra à jour automatiquement puis s'exécutera.

                    [x] Une fois lancé, clique sur " Exécuter un examen complet " puis sur " Rechercher "

                    [x] Sélectionne tout tes disques locaux et amovibles.

                    [x] Patiente pendant toute la durée du scan, puis clique sur " Ok " une fois l'analyse effectuée.

                    [x] Clique ensuite sur " Afficher les résultats " puis sur " Supprimer la sélection ". Valide ensuite par " Ok ".

                    [x] MBAM ouvrira un rapport, copie/colle son contenu dans ta prochaine réponse.

                    [x] Tu peux ensuite vider la quarantaine de MBAM.

                    [x] Note : MBAM t'invitera peut être à redémarrer ton PC, fais le. Le rapport se trouve dans la partie " Rapports/Logs " de MBAM.

                    [x] Si tu as des soucis, un tutoriel est disponible à cette adresse.
                    0
                    1. Baskepes Auteur
                      Voici le rapport de MBAM :
                      Malwarebytes' Anti-Malware 1.46
                      www.malwarebytes.org

                      Version de la base de données: 4849

                      Windows 5.1.2600 Service Pack 3
                      Internet Explorer 7.0.5730.13

                      16/10/2010 19:26:49
                      mbam-log-2010-10-16 (19-26-49).txt

                      Type d'examen: Examen complet (C:\|E:\|)
                      Elément(s) analysé(s): 314053
                      Temps écoulé: 1 heure(s), 18 minute(s), 30 seconde(s)

                      Processus mémoire infecté(s): 0
                      Module(s) mémoire infecté(s): 0
                      Clé(s) du Registre infectée(s): 2
                      Valeur(s) du Registre infectée(s): 0
                      Elément(s) de données du Registre infecté(s): 0
                      Dossier(s) infecté(s): 0
                      Fichier(s) infecté(s): 0

                      Processus mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Module(s) mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Clé(s) du Registre infectée(s):
                      HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\IJKUK66HMN (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                      Valeur(s) du Registre infectée(s):
                      (Aucun élément nuisible détecté)

                      Elément(s) de données du Registre infecté(s):
                      (Aucun élément nuisible détecté)

                      Dossier(s) infecté(s):
                      (Aucun élément nuisible détecté)

                      Fichier(s) infecté(s):
                      (Aucun élément nuisible détecté)
                      0
                      1. Xplode Contributeur sécurité
                        Ok, ça devrait être clean maintenant. On va quand même faire une vérification :

                        -+-+-+-+-> ZHPDiag <-+-+-+-+-

                        [x] Nous allons effectuer un diagnostic de ton ordinateur, pour ce faire, télécharge ZHPDiag ( de Nicolas Coolman ).

                        [x] Exécute l'installateur -> /!\ Coche la case " créer une icône sur le bureau " /!\

                        [x] Lance le en double cliquant sur l'icône ZHPDiag qui se trouve sur ton bureau ( Sous Vista/Seven : Clic droit sur l'icône -> " Exécuter en tant qu'administrateur " )

                        [x] Clique sur l'icône en forme de loupe en haut à gauche ( Lancer le diagnostic ).

                        [x] Une fois l'analyse terminée, clique sur l'icône en forme de disquette bleue puis sauvegarde le fichier sur ton bureau.

                        [x] Rend toi sur cjoint puis clique sur " Parcourir ".

                        [x] Sélectionne le fichier ZHPDiag.txt présent sur ton bureau, puis clique sur " Ouvrir ".

                        [x] Clique ensuite sur " Créer le lien cjoint " puis copie/colle dans ta prochaine réponse le lien créé.
                        0
                        2. Baskepes Auteur
                          Et voilà, il y avait du travail. Merci beaucoup pour ton aide.

                          ci-joint les rapports :
                          Rapport de ZHPFix 1.12.3211 par Nicolas Coolman, Update du 14/10/2010
                          Fichier d'export Registre : C:\ZHPExportRegistry-17-10-2010-10-38-54.txt
                          Run by ADMIN at 17/10/2010 10:38:54
                          Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
                          Contact : nicolascoolman@yahoo.fr

                          ========== Clé(s) du Registre ==========
                          HKCU\Software\?? ?? ???? ????? ??? ?? ???? => Clé absente
                          HKCU\Software\ContextTool => Clé supprimée avec succès
                          HKCU\Software\LdShih => Clé supprimée avec succès
                          HKLM\Software\Trad-FR => Clé supprimée avec succès
                          HKCU\Software\X3EKEPXJP2 => Clé supprimée avec succès
                          O64 - Services: CurCS - (.not file.) - Image Support (hkzqnu) .(.Pas de propriétaire - Pas de description.) - LEGACY_HKZQNU => Clé supprimée avec succès

                          ========== Préférences navigateur ==========
                          /*user_pref("extensions.asktb.cbid", "OF");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.default-channel-url-mask", "https://fr.ask.com/{query}&o={o}&l={l}&qsrc={qsrc}");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.fresh-install", false);*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.l", "dis");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.last-config-req", "1286290202814");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.locale", "fr_FR");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.o", "16050");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.options-lang", "fr");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.options-locale", "UK");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.overlay-reloaded-using-restart", true);*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.qsrc", "2871");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.r", "3");*/ => Valeur supprimée avec succès
                          /*user_pref("extensions.asktb.to", "16105");*/ => Valeur supprimée avec succès
                          /*/*user_pref("extensions.asktb.default-channel-url-mask", "https://fr.ask.com/{query}&o={o}&l={l}&qsrc={qsrc}");*/*/ => Valeur supprimée avec succès

                          ========== Récapitulatif ==========
                          6 : Clé(s) du Registre
                          14 : Préférences navigateur

                          End of the scan

                          JavaRa 1.15 Removal Log.

                          Report follows after line.

                          ------------------------------------

                          The JavaRa removal process was started on Sun Oct 17 10:41:51 2010

                          Found and removed: C:\Program Files\Java\jre1.6.0_01

                          Found and removed: C:\Program Files\Java\jre1.6.0_02

                          Found and removed: C:\Program Files\Java\jre1.6.0_03

                          Found and removed: C:\Program Files\Java\jre1.6.0_05

                          Found and removed: C:\Program Files\Java\jre1.6.0_07

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_11

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_12

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_13

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_15

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_17

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_18

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_20

                          Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610001

                          Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610002

                          Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003

                          Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005

                          Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610001

                          Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610002

                          Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

                          Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005

                          Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610001

                          Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610002

                          Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

                          Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

                          Found and removed: SOFTWARE\Classes\JavaPlugin.160_01

                          Found and removed: SOFTWARE\Classes\JavaPlugin.160_02

                          Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

                          Found and removed: SOFTWARE\Classes\JavaPlugin.160_05

                          Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_01

                          Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_02

                          Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

                          Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05

                          Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_01

                          Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_02

                          Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

                          Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05

                          Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

                          Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

                          Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

                          Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610001

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610002

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610001

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610002

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610001

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610002

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160010}

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160020}

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}

                          Found and removed: Software\Classes\JavaPlugin.160_01

                          Found and removed: Software\Classes\JavaPlugin.160_02

                          Found and removed: Software\Classes\JavaPlugin.160_03

                          Found and removed: Software\Classes\JavaPlugin.160_05

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_01

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_02

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05

                          Found and removed: Software\JavaSoft\Java2D\1.6.0

                          Found and removed: Software\JavaSoft\Java2D\1.6.0_01

                          Found and removed: Software\JavaSoft\Java2D\1.6.0_02

                          Found and removed: Software\JavaSoft\Java2D\1.6.0_03

                          Found and removed: Software\JavaSoft\Java2D\1.6.0_05

                          Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_01

                          Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_02

                          Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03

                          Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

                          Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_07

                          Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_07

                          Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610007

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610007

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160070}

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_01\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_02\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_01\bin\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_02\bin\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\bin\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\

                          Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

                          JavaRa 1.15 Removal Log.

                          Report follows after line.

                          ------------------------------------

                          The JavaRa removal process was started on Sun Oct 17 10:48:29 2010

                          Found and removed: C:\Documents and Settings\ADMIN\Application Data\Sun\Java\jre1.6.0_21

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

                          Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

                          Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

                          Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

                          ------------------------------------

                          Finished reporting.

                          JavaRa 1.15 Removal Log.

                          Report follows after line.

                          ------------------------------------

                          The JavaRa removal process was started on Sun Oct 17 10:48:43 2010

                          ------------------------------------

                          Finished reporting.

                          Rapport DelFix v5.8 - 17/10/2010 à 11:35,06
                          Mis à jour le 15/10/10 à 12h par Xplode
                          Système d'exploitation : Microsoft Windows XP (32 bits) [version 5.1.2600] Service Pack 3
                          Navigateur : Mozilla Firefox 3.6.10 (fr) [Navigateur par défaut]
                          Processeur : Intel(R) Pentium(R) 4 CPU 3.00GHz
                          Mémoire vive totale : 510 Mo
                          Nom d'utilisateur : ADMIN - STGABHTEGOULP01 (Administrateur)
                          Exécuté depuis : C:\Documents and Settings\ADMIN\Bureau\DelFix.exe

                          ~~~~~~ Dossiers ~~~~~~

                          Supprimé : C:\Qoobox
                          Supprimé : C:\USBFix
                          Supprimé : C:\RSIT
                          Supprimé : C:\Program Files\Ad-Remover
                          Supprimé : C:\Program Files\Navilog1
                          Supprimé : C:\Program Files\ZHPDiag
                          Supprimé : C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ZHP

                          ~~~~~~ Fichiers ~~~~~~

                          Supprimé : C:\ComboFix.txt
                          Supprimé : C:\cleannavi.txt
                          Supprimé : C:\UsbFix.txt
                          Supprimé : C:\Ad-Report-SCAN[1].log
                          Supprimé : C:\Ad-Report-CLEAN[1].log
                          Supprimé : C:\Ad-Report-CLEAN[1].txt
                          Supprimé : C:\WINDOWS\grep.exe
                          Supprimé : C:\WINDOWS\PEV.exe
                          Supprimé : C:\WINDOWS\NIRCMD.exe
                          Supprimé : C:\WINDOWS\MBR.exe
                          Supprimé : C:\WINDOWS\sed.exe
                          Supprimé : C:\WINDOWS\SWREG.exe
                          Supprimé : C:\WINDOWS\SWSC.exe
                          Supprimé : C:\WINDOWS\SWXCACLS.exe
                          Supprimé : C:\WINDOWS\zip.exe
                          Supprimé : C:\Documents and Settings\ADMIN\Bureau\ZHPDiag.exe
                          Supprimé : C:\Documents and Settings\ADMIN\Bureau\ZHPDiag.txt
                          Supprimé : C:\Documents and Settings\ADMIN\Bureau\ZHPFixReport.txt
                          Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
                          Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
                          Supprimé : C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk
                          Supprimé : C:\Documents and Settings\ADMIN\Mes documents\Téléchargements\ComboFix.exe
                          Supprimé : C:\Documents and Settings\ADMIN\Mes documents\Téléchargements\RSIT.exe
                          Supprimé : C:\Documents and Settings\ADMIN\Mes documents\Téléchargements\UsbFix.exe
                          Supprimé : C:\Documents and Settings\ADMIN\Mes documents\Téléchargements\AD-R.lnk

                          ~~~~~~ Registre ~~~~~~

                          Clé Supprimée : HKLM\Software\swearware
                          Clé Supprimée : HKLM\Software\TrendMicro
                          Clé Supprimée : HKCU\SOFTWARE\Ad-Remover
                          Clé Supprimée : HKCU\SOFTWARE\USBFix
                          Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Remover
                          Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\USBFix
                          Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

                          ########## EOF - "C:\DelFixSuppr.txt" - [2555 octets] ##########
                          0

                          Discussions similaires

                          Cheval de Troie- e.tre456.worm.windows
                          Ninou037

                          13 réponses
                          Signification des abréviations RE: et TR:
                          La Salamandre

                          19 réponses
                          Sa veux dire koi??Subject: FW: Tr :FW: TR: TR
                          france22

                          12 réponses
                          Virus potentiel
                          Ramon1

                          29 réponses
                          virus et ou cheval de troie
                          FLORE+60

                          1 réponse