Cheval de troie j'en peux plus !

Attention, avant de commencer, lit attentivement la procédure, et imprime la

Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Télécharge ComboFix de sUBs sur ton Bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et <gras>DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ </gras>

---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Excuse, c'est pas ta faute c'est la mienne mais je comprend pas :(
Reboot = ?

Ok ok, je vais voir ce que ça donne.

Non toujours rien ..!

Quand je met "Cliquez ici pour déposer le fichier " , la page ne veut pas s'afficher ..

ok

* Télécharge load_tdsskiller (de Loup Blanc) sur ton Bureau

http://fradesch.perso.cegetel.net/transf/Load_tdsskiller.exe

* Lance load_tdsskiller en faisant un double-clic dessus / Lance par un clic-droit dessus ? Exécuter en temps qu'administrateur
* L'outil va se connecter pour télécharger une copie à jour de TDSSKiller, puis va lancer une analyse
* Lorsque l'outil a terminé son travail d'inspection, si des nuisibles ("Malicious objects") ont été trouvés, vérifier que l'option (Cure) est sélectionnée,
* Si des objects suspects ("Suspicious objects") ont été détectés, sur l'écran de demande de confirmation, modifier l'action à entreprendre et indiquer Quarantine (au lieu de Skip),
* A la fin, il te sera demandé d'appuyer sur une touche, puis le rapport s'affichera automatiquement : copie-colle son contenu dans ta prochaine réponse (C:\tdsskiller\report.txt)

J'ai tout fait mais l'outil ne trouve rien

Mais justement quel rapport ? rien ne se met ..

pour le rapport zhp essaie de passer par là https://www.cjoint.com/

http://cjoint.com/data/0bmpWY4AyrV.htm

Waaah ça à l'air risqué, mais bon on va essayer

ComboFix 11-01-11.03 - Christine 12/01/2011 16:34:57.1.1 - x86
Microsoft® Windows Vista(TM) Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.2813.1702 [GMT 1:00]
Lancé depuis: c:\users\Bastien\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\OfferBox
c:\program files\OfferBox\help.url
c:\program files\OfferBox\home.url
c:\program files\OfferBox\OfferBox.exe
c:\program files\OfferBox\OfferBoxEngine.dll
c:\program files\OfferBox\res\about_bk.bmp
c:\program files\OfferBox\res\Language.xml
c:\program files\OfferBox\res\loader.gif
c:\program files\OfferBox\res\tray-paused.ico
c:\program files\OfferBox\res\tray.ico
c:\program files\OfferBox\search.url
c:\users\Christine\AppData\Local\ifaurm.exe
c:\users\Christine\AppData\Roaming\OfferBox
c:\users\Christine\AppData\Roaming\OfferBox\config.dat
c:\users\Christine\AppData\Roaming\OfferBox\config.xml
c:\users\Christine\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\chrome.manifest
c:\users\Christine\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\chrome\OfferBoxffx.jar
c:\users\Christine\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\components\DataXPCOM.dll
c:\users\Christine\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\components\DataXPCOM_TypeLib.xpt
c:\users\Christine\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\defaults\preferences\offerboxffxPrefs.js
c:\users\Christine\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\install.rdf
c:\users\Jérémy\AppData\Roaming\xssend2
c:\users\Jérémy\AppData\Roaming\xssend2\svcnost.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-12-12 au 2011-01-12 ))))))))))))))))))))))))))))))))))))
.

2011-01-12 15:49 . 2011-01-12 15:50 -------- d-----w- c:\users\Christine\AppData\Local\temp
2011-01-12 15:49 . 2011-01-12 15:49 -------- d-----w- c:\users\Jérémy\AppData\Local\temp
2011-01-12 15:49 . 2011-01-12 15:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-12 15:49 . 2011-01-12 15:49 -------- d-----w- c:\users\Morgane\AppData\Local\temp
2011-01-12 15:30 . 2011-01-12 15:30 -------- d-----w- C:\32788R22FWJFW
2011-01-12 14:04 . 2011-01-12 14:36 -------- d-----w- C:\tdsskiller
2011-01-12 13:34 . 2011-01-12 13:55 -------- d-----w- c:\program files\ZHPDiag
2011-01-11 21:33 . 2011-01-11 21:33 -------- d-----w- c:\program files\CCleaner
2011-01-11 20:37 . 2011-01-11 20:37 -------- d-----w- c:\users\Bastien\AppData\Roaming\Malwarebytes
2011-01-11 20:27 . 2011-01-11 20:27 -------- d-----w- c:\users\Christine\AppData\Roaming\Malwarebytes
2011-01-11 20:27 . 2010-11-29 16:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-11 20:27 . 2011-01-11 20:27 -------- d-----w- c:\programdata\Malwarebytes
2011-01-11 20:27 . 2011-01-11 20:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-11 20:27 . 2010-11-29 16:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-11 16:28 . 2011-01-11 21:56 -------- d---a-w- C:\Navilog1
2011-01-11 16:12 . 2011-01-12 15:49 -------- d-----w- c:\users\Bastien\AppData\Local\Temp
2011-01-11 15:55 . 2011-01-11 16:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-01-11 15:55 . 2011-01-11 16:44 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-01-11 10:46 . 2011-01-12 13:19 -------- d-----w- c:\users\Jérémy\AppData\Roaming\uhjhmxrame3bts2oierib3hnpf2ds232
2011-01-09 13:14 . 2011-01-09 14:28 -------- d-----w- c:\users\Bastien\AppData\Roaming\gtk-2.0
2011-01-09 13:13 . 2011-01-09 13:13 -------- d-----w- c:\users\Bastien\.thumbnails
2011-01-09 13:09 . 2011-01-09 14:29 -------- d-----w- c:\users\Bastien\.gimp-2.6
2011-01-09 12:49 . 2011-01-12 13:20 -------- d-----w- c:\program files\GIMP-2.0
2011-01-07 09:05 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BABF6BF4-417A-4350-8520-44E29CAE627C}\mpengine.dll
2010-12-26 21:52 . 2011-01-11 23:30 -------- d-----w- c:\users\Bastien\AppData\Roaming\nwjt
2010-12-15 16:04 . 2010-10-28 13:20 2048 ----a-w- c:\windows\system32\tzres.dll
2010-12-15 16:03 . 2010-11-03 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2010-12-14 16:59 . 2010-12-14 16:59 -------- d-----w- c:\users\Jérémy\AppData\Roaming\Samsung

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-16 15:22 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-21 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-13 6711840]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-03 30192]
"Acer ePower Management"="c:\program files\eMachines\eMachines Power Management\ePowerTray.exe" [2009-02-06 686624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-09 1418536]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2009-01-17 862728]
"WarReg_PopUp"="c:\program files\eMachines\WR_PopUp\WarReg_PopUp.exe" [2008-11-04 57344]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-01-13 1833504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

c:\users\Morgane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

c:\users\Bastien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - klmd25

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenu du dossier 'Tâches planifiées'

2011-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 20:08]

2011-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 20:08]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://www.shareware-fr.com/fr/index.php?rvs=hompag
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{ef79f67a-6ad7-4715-a0f8-932fca442023} - (no file)
HKCU-Run-OfferBox - c:\program files\OfferBox\OfferBox.exe
HKLM-Run-NPSStartup - (no file)
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-12 16:50
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2011-01-12 16:55:28
ComboFix-quarantined-files.txt 2011-01-12 15:55

Avant-CF: 69 893 623 808 octets libres
Après-CF: 70 413 934 592 octets libres

- - End Of File - - 213187D6F9BF009A6640CCD677929C5D

Ok

1)

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour cet utilisateur, il n'est pas transposable sur un autre ordinateur !

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScript
Copies y ce texte dedans et enregistres le

KillAll::

Folder::

c:\users\Jérémy\AppData\Roaming\uhjhmxrame3bts2oierib3hnpf2ds232
c:\users\Bastien\AppData\Roaming\nwjt

* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant)
http://sd-2.archive-host.com/membres/images/135518691112296573/cfscriptop0.gif
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt

.....................

2)

* Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX)
http://www.teamxscript.org/adremoverTelechargement.html

/!\ Déconnecte-toi d'internet et ferme toutes applications en cours /!\

Désactive provisoirement et seulement le temps de l'utilisation de ADremover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

- Double-clique sur l'icône Ad-remover située sur ton Bureau.
- Sur la page, clique sur le bouton « NETTOYER »
- Confirme lancement du scan
- Laisse travailler l'outil.
- Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(Scan/clean).Txt)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Je copie tout ça :

KillAll::

Folder::

c:\users\Jérémy\AppData\Roaming\uhjhmxrame3bts2oierib3hnpf2ds232
c:\users\Bastien\AppData\Roaming\nwjt

Ou juste les deux liens juste au dessus?

ce texte en gras

KillAll::

Folder::

c:\users\Jérémy\AppData\Roaming\uhjhmxrame3bts2oierib3hnpf2ds232
c:\users\Bastien\AppData\Roaming\nwjt

J'ai fait 1) et ça a redémarré l'ordi sans donner de rapport ..

======= RAPPORT D'AD-REMOVER 2.0.0.2,D | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 09/01/11 à 12:30
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 17:39:55 le 12/01/2011, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Basique Service Pack 2 (X86)
Christine@PC-DE-CHRISTINE (eMachines eMachines E625)

============== ACTION(S) ==============

Fichier supprimé: C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar
Dossier supprimé: C:\Program Files\Ask.com
Dossier supprimé: C:\Users\Christine\AppData\LocalLow\AskToolbar
Dossier supprimé: C:\Users\Christine\AppData\LocalLow\Conduit
Dossier supprimé: C:\Users\Christine\AppData\Roaming\freeTVRadio
Dossier supprimé: C:\Users\Jérémy\AppData\Roaming\freeTVRadio
Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OfferBox

(!) -- Fichiers temporaires supprimés.

Clé supprimée: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Clé supprimée: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Clé supprimée: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2720081
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2849852
Clé supprimée: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
Clé supprimée: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Clé supprimée: HKLM\Software\Conduit
Clé supprimée: HKCU\Software\Ask.com
Clé supprimée: HKCU\Software\AppDataLow\AskBarDis
Clé supprimée: HKCU\Software\AppDataLow\AskHomePage
Clé supprimée: HKCU\Software\AppDataLow\Software\AskToolbar
Clé supprimée: HKCU\Software\AppDataLow\Software\Conduit
Clé supprimée: HKCU\Software\AppDataLow\Software\conduitEngine
Clé supprimée: HKLM\Software\Classes\Installer\Products\5B4758C25396ECF468E04F8E063287FF
Clé supprimée: HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\5B4758C25396ECF468E04F8E063287FF
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2C8574B5-6935-4FCE-860E-F4E8602378FF}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Erreur suppression clé: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar

Valeur supprimée: HKCU\Software\Mozilla\Firefox\Extensions|offerboxffx@offerbox.com
Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

============== SCAN ADDITIONNEL ==============

** Internet Explorer Version [7.0.6002.18005] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 19 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)

\Ad-Report-CLEAN[1].txt - 12/01/2011 (5378 Octet(s))

Fin à: 17:47:25, 12/01/2011

============== E.O.F ==============

ok

comment va le pc ?

_______

Fais un nouveau rapport ZHPdiag stp

Rend toi sur Cjoint : http://www.cijoint.fr/

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Cliquez ici pour déposer le fichier " et copie/colle le lien dans ton prochain message
______________

si cela coince sur sur ci joint.fr passer par https://www.cjoint.com/

Rapport de ZHPDiag v1.27.1491 par Nicolas Coolman, Update du 09/01/2011
Run by Christine at 12/01/2011 14:54:12
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\\ Web Browser
MSIE: Internet Explorer v7.0.6002.18005
GCIE: Google Chrome v8.0.552.224 (Defaut)

---\\ System Information
Windows Vista Home Basic Edition, 32-bit Service Pack 2 (Build 6002)
Processor: x86 Family 15 Model 124 Stepping 2, AuthenticAMD
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2813 MB (62% free)
System Restore: Activé (Enable)
System drive C: has 63 GB (46%) free of 136 GB

---\\ Logged in mode
Computer Name: PC-DE-CHRISTINE
User Name: Christine
All Users Names: Morgane, Jérémy, Christine, Bastien, Administrateur,
Unselected Option: O1,O45,O61,O62,O65,O66,O82
Logged in as Administrator

---\\ Environnement Variables
%AppData%=%USERPROFILE%\AppData\Roaming
%LocalAppData%=%USERPROFILE%\AppData\Local
%StartMenu%=%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 63 Go of 136 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Hard drive, Flash drive, Thumb drive (Free 5 Go of 13 Go)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK

---\\ Recherche particulière de fichiers génériques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 07:27:36.) -- C:\Windows\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 03:33:13.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368]
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.11/04/2009 07:32:26.) -- C:\Windows\System32\drivers\atapi.sys [19944]
[MD5.6A4A98CEE84CF9E99564510DDA4BAA47] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.11/04/2009 07:32:49.) -- C:\Windows\System32\drivers\ntfs.sys [1083880]

---\\ Processus lancés
[MD5.0D392EDE3B97E0B3131B2F63EF1DB94E] - (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe [1008184]
[MD5.7355E57B18A66C76FAD46895D86613EE] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6711840]
[MD5.9F5F2F0FB0A7F5AA9F16B9A7B6DAD89F] - (.Google - Google Desktop.) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192]
[MD5.7E58AF88F1A9928CDA415F4E09BF834F] - (.Acer Incorporated - ePowerTray.) -- C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe [686624]
[MD5.D26EE901029CC6C18A0C0A42FA41B5C2] - (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1418536]
[MD5.2AC7F8B8BF0D5D327A3A2A00453222C4] - (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe [200704]
[MD5.33C014C1709F7222CEFF61B780EDC967] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [49152]
[MD5.B2994EC6452DBD04E57828EEFEDFB93C] - (.Realtek Semiconductor Corp. - Realtek HD Audio Data Rerouter.) -- C:\Users\Bastien\AppData\Local\Temp\RtkBtMnt.exe [204800]
[MD5.BA7D56C1F3DD385EE58ADDA14C6FFB54] - (.ATI Technologies Inc. - Catalyst Control Centre: Host application.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [49152]
[MD5.7CC0E22980F9BEAE09B7D710FF69A6B3] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files\Launch Manager\LManager.exe [862728]
[MD5.9AEF1107109189F955192D4B714B516C] - (.France Telecom SA - Pas de description.) -- C:\Program Files\OrangeHSS\Systray\SystrayApp.exe [90112]
[MD5.A7810B302294793DE88542AAE177D1B1] - (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424]
[MD5.68A553BDFA855C4F1074696682FCDEB6] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [141600]
[MD5.E0D6538B62C79FCBF0B27F95FAF3208B] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [246504]
[MD5.6C1B31F5C16E03153F0037AC6C451FFD] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2838912]
[MD5.E616A6A6E91B0A86F2F6217CDE835FFE] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856]
[MD5.ABC2C67DFD48930F846934B907C3D606] - (.OpenOffice.org - OpenOffice.org 3.2.) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe [7424000]
[MD5.15D982E21248E9BE337D9B40247AF30E] - (.OpenOffice.org - OpenOffice.org 3.2.) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin [7418368]
[MD5.F400694D7D2785F60133C20F7F2F4F7A] - (.ArcSoft Inc. - ArcSoft Connect Notifier.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac [309824]
[MD5.A8986E339A9215B9410484814224531E] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\ieuser.exe [299520]
[MD5.2C5168C856455CC43C4B4E1CC1920001] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe [636080]
[MD5.8B4022226C18FA378C324C11CBADDA36] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe [304304]
[MD5.203E1017A55F82E4E79F2172BF13A6CB] - (.Synaptics, Inc. - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [103720]
[MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120]
[MD5.6DD9034E180D448453C889AB040753CC] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [622592]

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2)
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Pas de propriétaire - Pas de description.) -- C:\Windows\system32\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
P2 - FPN: [HKLM] [@Google.com/GoogleEarthPlugin] - (.Google - GEPlugin.) -- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8081.0709] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=8] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.babylon.com
G2 - GCE: Preference [User Data\Default] [dhkplhfnhceodhffomolpfigojocbpcb] Babylon Chrome OCR v.1.0 (Activé)

---\\ Internet Explorer, Démarrage,Recherche,URSearchHook (R0,R1,R3)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shareware-fr.com/fr/index.php?rvs=hompag
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.shareware-fr.com/fr/index.php?rvs=hompag
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer-group.com/selection.html?b=ACEW&l=040c&s=2&o=vb32&d=0309&m=e625
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.shareware-fr.com/fr/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer-group.com/selection.html?b=ACEW&l=040c&s=2&o=vb32&d=0309&m=e625
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} . (.Pas de propriétaire - Pas de description.) (No version) -- C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (7.00.6000.16386 (vista_rtm.061101-2205)) -- C:\Windows\system32\ieframe.dll
R3 - URLSearchHook: (no name) - {ef79f67a-6ad7-4715-a0f8-932fca442023} Clé orpheline

---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} . (.ArcSoft, Inc. - ArcURLRecord Module.) -- C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} . (.Microsoft Corporation - Search Helper for Internet Explorer.) -- C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} . (.Ask.com - Ask.com Toolbar.) -- C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} . (.Microsoft Corporation - Windows Live Toolbar Core.) -- C:\Program Files\Windows Live\Toolbar\wltcore.dll

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} . (.Microsoft Corporation - Windows Live Toolbar Core.) -- C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} . (.Ask.com - Ask.com Toolbar.) -- C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] . (.Google - Google Desktop.) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O4 - HKLM\..\Run: [Acer ePower Management] . (.Acer Incorporated - ePowerTray.) -- C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PLFSetI] . (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [WarReg_PopUp] . (.eMachines - WR_PopUp.) -- C:\Program Files\eMachines\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SystrayORAHSS] . (.France Telecom SA - Pas de description.) -- C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] . (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Skytel] . (.Realtek Semiconductor Corp. - Realtek Voice Manager.) -- C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [NPSStartup] Clé orpheline
O4 - HKLM\..\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\avastUI.exe
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [OfferBox] . (.Secure Digital Services - OfferBox.) -- C:\Program Files\OfferBox\OfferBox.exe
O4 - HKCU\..\Run: [AutoStartNPSAgent] . (.Samsung Electronics Co., Ltd. - NPSAgent.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-3842582366-2694432248-3862308139-1002-3842582366-2694432248-3862308139-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-21-3842582366-2694432248-3862308139-1002-3842582366-2694432248-3862308139-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-3842582366-2694432248-3862308139-1002-3842582366-2694432248-3862308139-1000\..\Run: [conhost] C:\Users\Bastien\AppData\Roaming\Microsoft\conhost.exe (.not file.)

---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Documents And Settings\Christine\Desktop\Format Factory.lnk . (.Free Time.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe
O4 - Global Startup: C:\Documents And Settings\Christine\Desktop\Free M4a to MP3 Converter.lnk . (.ManiacTools.) -- C:\Program Files\Free M4a to MP3 Converter\m4a_converter.exe
O4 - Global Startup: C:\Documents And Settings\Christine\Desktop\Installation du Contrôle Parental.lnk . (.InstallShield Software Corporation.) -- C:\Securitoo\Contrôle Parental\securitoo_controle_parentalv41.exe
O4 - Global Startup: C:\Documents And Settings\Christine\Desktop\My Music Tools.lnk . (.Pas de propriétaire.) -- C:\Program Files\Free M4a to MP3 Converter\mymusictools.url
O4 - Global Startup: C:\Documents And Settings\Christine\Desktop\Video Converter.lnk . (.Pas de propriétaire.) -- C:\Program Files\VideoConverter\VideoConverter.exe
O4 - Global Startup: C:\Documents And Settings\Christine\Desktop\Xilisoft Audio Converter.lnk . (.Pas de propriétaire.) -- C:\Program Files\Xilisoft\Audio Converter\audioenc.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Mail\WinMail.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - Global Startup: C:\Users\Christine\Desktop\Format Factory.lnk . (.Free Time.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe
O4 - Global Startup: C:\Users\Christine\Desktop\Free M4a to MP3 Converter.lnk . (.ManiacTools.) -- C:\Program Files\Free M4a to MP3 Converter\m4a_converter.exe
O4 - Global Startup: C:\Users\Christine\Desktop\Installation du Contrôle Parental.lnk . (.InstallShield Software Corporation.) -- C:\Securitoo\Contrôle Parental\securitoo_controle_parentalv41.exe
O4 - Global Startup: C:\Users\Christine\Desktop\My Music Tools.lnk . (.Pas de propriétaire.) -- C:\Program Files\Free M4a to MP3 Converter\mymusictools.url
O4 - Global Startup: C:\Users\Christine\Desktop\Video Converter.lnk . (.Pas de propriétaire.) -- C:\Program Files\VideoConverter\VideoConverter.exe
O4 - Global Startup: C:\Users\Christine\Desktop\Xilisoft Audio Converter.lnk . (.Pas de propriétaire.) -- C:\Program Files\Xilisoft\Audio Converter\audioenc.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free M4a to MP3 Converter.lnk . (.ManiacTools.) -- C:\Program Files\Free M4a to MP3 Converter\m4a_converter.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk . (.Google Inc..) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QUICKMEDIACONVERTER.lnk . (.Actecom.) -- C:\Program Files\QuickMediaConverter\QMC.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Samsung New PC Studio.lnk . (.Samsung Electronics Co., Ltd..) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSGuide.exe
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - Clé orpheline
O4 - Global Startup: C:\Users\Christine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - Clé orpheline

---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xporter vers Microsoft Excel . (.Microsoft Corporation - Microsoft Office Excel.) -- C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.exe
O8 - Extra context menu item: Google Sidewiki... . (.Google Inc. - Google Toolbar for Internet Explorer.) -- C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (.Pas de propriétaire - Pas de description.) -- C:\PROGRA~1\MICROS~2\OFFICE11\REFBARH.ICO

---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32\napinsp.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files\Bonjour\mdnsNSP.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} () - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/mjss/MJSS.cab109791.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{54FCB1C2-F1EC-48F4-94F6-56DBD73417DE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C523A511-4DC8-408D-9FC1-F32A4D5CF48F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{54FCB1C2-F1EC-48F4-94F6-56DBD73417DE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{C523A511-4DC8-408D-9FC1-F32A4D5CF48F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.Google - Google Desktop.) - C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.dll

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Contrôleur de site Web.) -- C:\Windows\System32\webcheck.dll

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\system32\browseui.dll

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (ACDaemon) . (.ArcSoft Inc. - ArcSoft Connect Service.) - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: (Apple Mobile Device) . (.Apple Inc. - Apple Mobile Device Service.) - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: (Ati External Event Utility) . (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) - C:\Windows\system32\Ati2evxx.exe
O23 - Service: (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: (ePowerSvc) . (.Acer Incorporated - ePowerSvc.) - C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
O23 - Service: (FsUsbExService) - Clé orpheline
O23 - Service: (FTRTSVC) . (.France Telecom SA - Pas de description.) - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: (IviRegMgr) . (.InterVideo - RegMgr Module.) - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: (NTISchedulerSvc) . (.NewTech Infosystems, Inc. - NTI Backup Now 5 SchedulerSvc NT Service.) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) - (.not file.)

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.93AFD3331755D8340E230F8D6D57AC9A] [APT] [Scheduled Update for Ask Toolbar] (.Pas de propriétaire.) -- C:\Program Files\Ask.com\UpdateTask.exe
[MD5.7B43567B4C32AD7ADED537CD3B1342B9] [APT] [AppleSoftwareUpdate] (.Apple Inc..) -- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: (DritekPortIO) . (.Dritek System Inc. - General Port I/O.) - C:\PROGRA~1\LAUNCH~1\DPortIO.sys
O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\Windows\System32\DRIVERS\i8042prt.sys
O41 - Driver: (kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\Windows\System32\DRIVERS\kbdclass.sys
O41 - Driver: (mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\Windows\System32\DRIVERS\mouclass.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys
O41 - Driver: (netbt) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys
O41 - Driver: (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (PSched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\Windows\System32\DRIVERS\rasacd.sys
O41 - Driver: (rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\Windows\System32\DRIVERS\rdbss.sys
O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: (RDPENCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys
O41 - Driver: C:\Windows\system32\tcpipcfg.dll (Smb) . (.Microsoft Corporation - SMB Transport driver.) - C:\Windows\System32\DRIVERS\smb.sys
O41 - Driver: C:\Windows\system32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys

---\\ Logiciels installés (O42)
O42 - Logiciel: 7-Zip 4.65 - (.Pas de propriétaire.) [HKLM] -- 7-Zip
O42 - Logiciel: Adobe AIR - (.Adobe Systems Inc..) [HKLM] -- Adobe AIR
O42 - Logiciel: Adobe AIR - (.Adobe Systems Inc..) [HKLM] -- {A2BCA9F1-566C-4805-97D1-7FDC93386723}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Reader 9 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A90000000001}
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM] -- {3FA365DF-2D68-45ED-8F83-8C8A33E65143}
O42 - Logiciel: Apple Mobile Device Support - (.Apple Inc..) [HKLM] -- {AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM] -- {6956856F-B6B3-4BE0-BA0B-8F495BE32033}
O42 - Logiciel: Ask Toolbar - (.Ask.com.) [HKLM] -- {86D4B82A-ABED-442A-BE86-96357B70F4FE}
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
O42 - Logiciel: Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver - (.Atheros Communications Inc..) [HKLM] -- {3108C217-BE83-42E4-AE9E-A56A2A92E549}
O42 - Logiciel: AviSynth 2.5 - (.Pas de propriétaire.) [HKLM] -- AviSynth
O42 - Logiciel: BitTorrent - (.BitTorrent, Inc.) [HKCU] -- BitTorrent
O42 - Logiciel: Bonjour - (.Apple Inc..) [HKLM] -- {07287123-B8AC-41CE-8346-3D777245C35B}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: CopyTrans Suite désinstallation uniquement - (.Pas de propriétaire.) [HKLM] -- CopyTrans Suite
O42 - Logiciel: EPSON Logiciel imprimante - (.Pas de propriétaire.) [HKLM] -- EPSON Printer and Utilities
O42 - Logiciel: FormatFactory 2.30 - (.Free Time.) [HKLM] -- FormatFactory
O42 - Logiciel: Free M4a to MP3 Converter 6.1 - (.ManiacTools.com.) [HKLM] -- Free M4a to MP3 Converter_is1
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {B131E59D-202C-43C6-84C9-68F0C37541F1}
O42 - Logiciel: Google Chrome - (.Google Inc..) [HKLM] -- Google Chrome
O42 - Logiciel: Google Desktop - (.Google.) [HKLM] -- Google Desktop
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {18455581-E099-4BA8-BC6B-F34B2F06600C}
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Google Earth - (.Google.) [HKLM] -- {4286E640-B5FB-11DF-AC4B-005056C00008}
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {46ABBC54-1872-4AA3-95E2-F2C063A63F31}
O42 - Logiciel: InterVideo WinDVD 8 - (.InterVideo Inc..) [HKLM] -- InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}
O42 - Logiciel: Java(TM) 6 Update 18 - (.Sun Microsystems, Inc..) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216018FF}
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {E2DFE069-083E-4631-9B6C-43C48E991DE5}
O42 - Logiciel: Launch Manager - (.eMachines.) [HKLM] -- LManager
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: MediaConverter 2.5 for Philips - (.ArcSoft.) [HKLM] -- {8D8B167A-ED0F-43F1-AC10-3F4379F7CBBB}
O42 - Logiciel: Messenger Plus! Live - (.Patchou.) [HKLM] -- Messenger Plus! Live
O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack SP1 - fra - (.Microsoft Corporation.) [HKLM] -- {3E31821C-7917-367E-938E-E65FC413EA31}
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
O42 - Logiciel: Microsoft Office PowerPoint Viewer 2007 (French) - (.Microsoft Corporation.) [HKLM] -- {95120000-00AF-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Professional Edition 2003 - (.Microsoft Corporation.) [HKLM] -- {9011040C-6000-11D3-8CFE-0150048383C9}
O42 - Logiciel: Microsoft Office Suite Activation Assistant - (.Microsoft Corporation.) [HKLM] -- {E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Search Enhancement Pack - (.Microsoft Corporation.) [HKLM] -- {4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
O42 - Logiciel: Microsoft Sync Framework Runtime Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {8A74E887-8F0F-4017-AF53-CBA42211AAA5}
O42 - Logiciel: Microsoft Sync Framework Services Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 - (.Microsoft Corporation.) [HKLM] -- {770657D0-A123-3C07-8E44-1C83EC895118}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {A49F249F-0C91-497F-86DF-B2585E8E76B7}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Microsoft Works - (.Microsoft Corporation.) [HKLM] -- {0214A441-A4AB-43A8-8DEF-2F73C5364673}
O42 - Logiciel: Module de compatibilité pour Microsoft Office System 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0020-040C-0000-0000000FF1CE}
O42 - Logiciel: Module linguistique Microsoft .NET Framework 3.5 SP1- fra - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 Language Pack SP1 - fra
O42 - Logiciel: NTI Backup Now 5 - (.NewTech Infosystems.) [HKLM] -- InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}
O42 - Logiciel: NTI Media Maker 8 - (.NewTech Infosystems.) [HKLM] -- InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}
O42 - Logiciel: Navigateur Orange - (.Pas de propriétaire.) [HKLM] -- {ORAHSS}.Browser
O42 - Logiciel: OfferBox - (.Secure Digital Services.) [HKLM] -- {2C8574B5-6935-4FCE-860E-F4E8602378FF}
O42 - Logiciel: OpenOffice.org 3.2 - (.OpenOffice.org.) [HKLM] -- {4EE2EF4B-25D3-4D44-8384-A2B96F811F55}
O42 - Logiciel: Orange - Logiciels Internet - (.Pas de propriétaire.) [HKLM] -- {ORAHSS}.UninstallSuite
O42 - Logiciel: Outil de téléchargement Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}
O42 - Logiciel: Player - (.Pas de propriétaire.) [HKCU] -- QUICKMEDIACONVERTER
O42 - Logiciel: QuickTime - (.Apple Inc..) [HKLM] -- {1451DE6B-ABE1-4F62-BE9A-B363A17588A2}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: Realtek USB 2.0 Card Reader - (.Realtek Semiconductor Corp..) [HKLM] -- {DC24971E-1946-445D-8A82-CE685433FA7D}
O42 - Logiciel: SAMSUNG USB Driver for Mobile Phones - (.SAMSUNG Electronics Co., Ltd..) [HKLM] -- {D0795B21-0CDA-4a92-AB9E-6E92D8111E44}
O42 - Logiciel: Samsung New PC Studio - (.Samsung Electronics Co., Ltd..) [HKLM] -- InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}
O42 - Logiciel: Samsung New PC Studio - (.Samsung Electronics Co., Ltd..) [HKLM] -- {F193FC0E-9E18-40FC-A974-509A1BDD240A}
O42 - Logiciel: Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB2416473
O42 - Logiciel: Synaptics Pointing Device Driver - (.Synaptics.) [HKLM] -- SynTPDeinstKey
O42 - Logiciel: Update for Microsoft .NET Framework 3.5 SP1 (KB963707) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707
O42 - Logiciel: VDownloader 1.13 - (.Vitzo Limited.) [HKLM] -- {CA567AD5-33A4-403D-86D1-EE2D38251951}_is1
O42 - Logiciel: VLC media player 1.1.4 - (.VideoLAN.) [HKLM] -- VLC media player
O42 - Logiciel: Video Web Camera - (.SuYin.) [HKLM] -- {A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}
O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3B4E636E-9D65-4D67-BA61-189800823F52}
O42 - Logiciel: Windows Live FolderShare - (.Microsoft Corporation.) [HKLM] -- {2075CB0A-D26F-4DAA-B424-5079296B43BA}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {5DD76286-9BE7-4894-A990-E905E91AC818}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {770F1BEC-2871-4E70-B837-FB8525FFA3B1}
O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {53B20C18-D8D4-4588-8737-9BBFE303C354}
O42 - Logiciel: Windows Live Toolbar - (.Microsoft Corporation.) [HKLM] -- {F7D27C70-90F5-49B9-B188-0A133C0CE353}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {4634B21A-CC07-4396-890C-2B8168661FEA}
O42 - Logiciel: avast! Free Antivirus - (.Alwil Software.) [HKLM] -- avast5
O42 - Logiciel: eMachines Games - (.WildTangent.) [HKLM] -- WildTangent emachines Master Uninstall
O42 - Logiciel: eMachines Power Management - (.eMachines.) [HKLM] -- {3DB0448D-AD82-4923-B305-D001E521A964}
O42 - Logiciel: eMachines Recovery Management - (.Acer Incorporated.) [HKLM] -- {7F811A54-5A09-4579-90E1-C93498E230D9}
O42 - Logiciel: eMachines ScreenSaver - (.eMachines.) [HKLM] -- eMachines Screensaver
O42 - Logiciel: iTunes - (.Apple Inc..) [HKLM] -- {A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}

---\\ HKCU & HKLM Software Keys
[HKCU\Software\7-Zip]
[HKCU\Software\ALWIL Software]
[HKCU\Software\ATI Technologies Inc.]
[HKCU\Software\ATI]
[HKCU\Software\Actecom]
[HKCU\Software\Adobe]
[HKCU\Software\AppDataLow\AskBarDis]
[HKCU\Software\AppDataLow\AskHomepage]
[HKCU\Software\AppDataLow\Software\AskToolbar]
[HKCU\Software\AppDataLow\Software\BittorrentBar_FR]
[HKCU\Software\AppDataLow\Software\Conduit]
[HKCU\Software\AppDataLow\Software\Google]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software\conduitEngine]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\Apple Computer, Inc.]
[HKCU\Software\ArcSoft]
[HKCU\Software\Ask.com]
[HKCU\Software\Awsdata]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\EPSON]
[HKCU\Software\FDRLab]
[HKCU\Software\FreeTime]
[HKCU\Software\GNU]
[HKCU\Software\Gabest]
[HKCU\Software\Google]
[HKCU\Software\Haali]
[HKCU\Software\IM Providers]
[HKCU\Software\JavaSoft]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\ManiacTools]
[HKCU\Software\Mobileleader]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Mozilla]
[HKCU\Software\Netscape]
[HKCU\Software\Norton]
[HKCU\Software\ODBC]
[HKCU\Software\OfferBox]
[HKCU\Software\OpenOffice.org]
[HKCU\Software\PC SOFT]
[HKCU\Software\Patchou]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\SEIKO EPSON]
[HKCU\Software\Safer Networking Limited]
[HKCU\Software\Samsung]
[HKCU\Software\Sonix]
[HKCU\Software\Synaptics]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\Xilisoft]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\acer]
[HKLM\Software\ALWIL Software]
[HKLM\Software\AMD]
[HKLM\Software\ATI Technologies]
[HKLM\Software\ATI]
[HKLM\Software\Acer Incorporated]
[HKLM\Software\Acer]
[HKLM\Software\Adobe]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\ArcSoft]
[HKLM\Software\Atheros Communications Inc.]
[HKLM\Software\Awsdata]
[HKLM\Software\BrowserChoice]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Compal]
[HKLM\Software\Conduit]
[HKLM\Software\Cyberlink]
[HKLM\Software\Digital River]
[HKLM\Software\Dofus 2]
[HKLM\Software\EPSON]
[HKLM\Software\FRANCE TELECOM]
[HKLM\Software\GEAR Software]
[HKLM\Software\GNU]
[HKLM\Software\Gateway]
[HKLM\Software\Google]
[HKLM\Software\HaaliMkx]
[HKLM\Software\InstalledOptions]
[HKLM\Software\Intel]
[HKLM\Software\InterVideo]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MarkAny]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\NewTech Infosystems]
[HKLM\Software\Norton]
[HKLM\Software\ODBC]
[HKLM\Software\OemSetup]
[HKLM\Software\OpenOffice.org]
[HKLM\Software\Patchou]
[HKLM\Software\Piriform]
[HKLM\Software\Policies]
[HKLM\Software\Realtek Semiconductor Corp.]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SAMSUNG]
[HKLM\Software\SRS Labs]
[HKLM\Software\Safer Networking Limited]
[HKLM\Software\SuYin]
[HKLM\Software\Sun Microsystems]
[HKLM\Software\Symantec]
[HKLM\Software\Synaptics]
[HKLM\Software\Thomson]
[HKLM\Software\Trolltech]
[HKLM\Software\VideoLAN]
[HKLM\Software\Volatile]
[HKLM\Software\WOW6432Node]
[HKLM\Software\Waves Audio]
[HKLM\Software\WildTangent]
[HKLM\Software\Windows]
[HKLM\Software\eMachines]
[HKLM\Software\instinno]

---\\ Contenu des dossiers ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 13/06/2010 - 16:25:50 ----D- C:\Program Files\7-Zip
O43 - CFD: 03/03/2009 - 14:45:16 ----D- C:\Program Files\Adobe
O43 - CFD: 13/12/2010 - 10:26:36 ----D- C:\Program Files\Alwil Software
O43 - CFD: 22/09/2009 - 18:47:32 ----D- C:\Program Files\Apple Software Update
O43 - CFD: 28/09/2009 - 09:41:04 ----D- C:\Program Files\ArcSoft
O43 - CFD: 17/10/2009 - 21:13:34 ----D- C:\Program Files\Ask.com
O43 - CFD: 22/03/2009 - 10:49:30 ----D- C:\Program Files\ATI
O43 - CFD: 22/03/2009 - 10:50:50 ----D- C:\Program Files\ATI Technologies
O43 - CFD: 09/03/2010 - 17:18:00 ----D- C:\Program Files\AviSynth 2.5
O43 - CFD: 04/10/2010 - 16:49:52 ----D- C:\Program Files\Babylon
O43 - CFD: 10/12/2010 - 09:35:54 ----D- C:\Program Files\BitTorrent
O43 - CFD: 22/09/2009 - 18:52:54 ----D- C:\Program Files\Bonjour
O43 - CFD: 11/01/2011 - 22:33:22 ----D- C:\Program Files\CCleaner
O43 - CFD: 08/04/2010 - 17:17:14 ----D- C:\Program Files\Common Files
O43 - CFD: 01/09/2010 - 09:37:26 ----D- C:\Program Files\Dofus
O43 - CFD: 21/09/2009 - 09:15:44 ----D- C:\Program Files\eMachines
O43 - CFD: 03/03/2009 - 14:56:54 ----D- C:\Program Files\eMachines Games
O43 - CFD: 24/09/2009 - 15:07:22 ----D- C:\Program Files\epson
O43 - CFD: 26/09/2009 - 14:34:10 ----D- C:\Program Files\FDRLab
O43 - CFD: 21/09/2009 - 09:14:22 -SH-D- C:\Program Files\Fichiers communs
O43 - CFD: 17/10/2009 - 21:31:12 ----D- C:\Program Files\Free M4a to MP3 Converter
O43 - CFD: 23/06/2010 - 15:05:46 ----D- C:\Program Files\FreeTime
O43 - CFD: 12/01/2011 - 14:20:52 ----D- C:\Program Files\GIMP-2.0
O43 - CFD: 11/01/2011 - 22:32:52 ----D- C:\Program Files\Google
O43 - CFD: 20/11/2010 - 18:39:06 --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD: 27/10/2009 - 14:02:18 ----D- C:\Program Files\Internet Explorer
O43 - CFD: 22/03/2009 - 11:02:54 ----D- C:\Program Files\InterVideo
O43 - CFD: 21/09/2009 - 09:26:38 ----D- C:\Program Files\Inventel
O43 - CFD: 21/01/2010 - 21:15:08 ----D- C:\Program Files\iPod
O43 - CFD: 21/01/2010 - 21:15:52 ----D- C:\Program Files\iTunes
O43 - CFD: 13/11/2009 - 20:50:40 ----D- C:\Program Files\Java
O43 - CFD: 10/03/2010 - 14:52:40 ----D- C:\Program Files\JRE
O43 - CFD: 22/03/2009 - 10:58:56 ----D- C:\Program Files\Launch Manager
O43 - CFD: 11/01/2011 - 21:27:18 ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD: 18/07/2010 - 11:39:52 ----D- C:\Program Files\MarkAny
O43 - CFD: 04/10/2009 - 11:26:46 ----D- C:\Program Files\Messenger Plus! Live
O43 - CFD: 21/09/2009 - 17:30:34 ----D- C:\Program Files\Microsoft
O43 - CFD: 02/11/2006 - 13:35:52 ----D- C:\Program Files\Microsoft Games
O43 - CFD: 21/09/2009 - 11:29:30 ----D- C:\Program Files\Microsoft Office
O43 - CFD: 03/03/2009 - 14:41:42 ----D- C:\Program Files\Microsoft Office Suite Activation Assistant
O43 - CFD: 03/03/2009 - 14:40:08 ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD: 21/09/2009 - 17:36:30 ----D- C:\Program Files\Microsoft Sync Framework
O43 - CFD: 15/12/2010 - 18:09:46 ----D- C:\Program Files\Microsoft Works
O43 - CFD: 25/06/2010 - 14:49:36 ----D- C:\Program Files\Microsoft.NET
O43 - CFD: 13/08/2010 - 08:02:22 ----D- C:\Program Files\Movie Maker
O43 - CFD: 02/11/2006 - 13:35:52 ----D- C:\Program Files\MSBuild
O43 - CFD: 03/03/2009 - 13:51:28 ----D- C:\Program Files\MSXML 4.0
O43 - CFD: 03/03/2009 - 14:44:08 ----D- C:\Program Files\NewTech Infosystems
O43 - CFD: 09/02/2010 - 11:14:38 ----D- C:\Program Files\OfferBox
O43 - CFD: 10/03/2010 - 14:52:40 ----D- C:\Program Files\OpenOffice.org 3
O43 - CFD: 21/09/2009 - 09:36:20 ----D- C:\Program Files\OrangeHSS
O43 - CFD: 17/10/2009 - 20:35:44 ----D- C:\Program Files\QuickMediaConverter
O43 - CFD: 21/01/2010 - 21:10:02 ----D- C:\Program Files\QuickTime
O43 - CFD: 03/03/2009 - 14:15:44 ----D- C:\Program Files\Realtek
O43 - CFD: 02/11/2006 - 13:35:52 ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 18/07/2010 - 11:42:30 ----D- C:\Program Files\Samsung
O43 - CFD: 11/01/2011 - 17:45:10 ----D- C:\Program Files\Spybot - Search & Destroy
O43 - CFD: 22/03/2009 - 10:57:32 ----D- C:\Program Files\Synaptics
O43 - CFD: 03/03/2009 - 14:16:34 --H-D- C:\Program Files\Temp
O43 - CFD: 02/11/2006 - 13:58:20 --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 08/04/2010 - 17:17:10 ----D- C:\Program Files\VDownloader 1.13
O43 - CFD: 04/10/2010 - 16:48:56 ----D- C:\Program Files\VideoConverter
O43 - CFD: 05/09/2010 - 10:16:16 ----D- C:\Program Files\VideoLAN
O43 - CFD: 26/10/2009 - 18:07:32 ----D- C:\Program Files\Windows Calendar
O43 - CFD: 26/10/2009 - 18:07:32 ----D- C:\Program Files\Windows Collaboration
O43 - CFD: 26/10/2009 - 18:07:28 ----D- C:\Program Files\Windows Defender
O43 - CFD: 21/09/2009 - 17:41:08 ----D- C:\Program Files\Windows Live
O43 - CFD: 03/03/2009 - 14:38:16 ----D- C:\Program Files\Windows Live SkyDrive
O43 - CFD: 15/12/2010 - 19:51:48 ----D- C:\Program Files\Windows Mail
O43 - CFD: 16/10/2010 - 09:36:08 ----D- C:\Program Files\Windows Media Player
O43 - CFD: 21/09/2009 - 09:14:22 ----D- C:\Program Files\Windows NT
O43 - CFD: 26/10/2009 - 18:07:30 ----D- C:\Program Files\Windows Photo Gallery
O43 - CFD: 17/11/2009 - 12:58:40 ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 26/10/2009 - 18:07:32 ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 07/10/2009 - 12:25:38 ----D- C:\Program Files\WindSolutions
O43 - CFD: 17/10/2009 - 21:03:54 ----D- C:\Program Files\Xilisoft
O43 - CFD: 12/01/2011 - 14:54:20 ----D- C:\Program Files\ZHPDiag
O43 - CFD: 13/07/2010 - 15:10:08 ----D- C:\Program Files\Common Files\Adobe
O43 - CFD: 17/02/2010 - 15:28:56 ----D- C:\Program Files\Common Files\Adobe AIR
O43 - CFD: 21/01/2010 - 21:15:06 ----D- C:\Program Files\Common Files\Apple
O43 - CFD: 28/09/2009 - 09:41:16 ----D- C:\Program Files\Common Files\ArcSoft
O43 - CFD: 03/03/2009 - 14:22:32 ----D- C:\Program Files\Common Files\DESIGNER
O43 - CFD: 21/09/2009 - 09:32:00 ----D- C:\Program Files\Common Files\France Telecom
O43 - CFD: 24/09/2009 - 14:22:32 ----D- C:\Program Files\Common Files\InstallShield
O43 - CFD: 22/03/2009 - 11:02:54 ----D- C:\Program Files\Common Files\InterVideo
O43 - CFD: 11/02/2010 - 22:04:08 ----D- C:\Program Files\Common Files\Java
O43 - CFD: 15/07/2010 - 08:20:12 ----D- C:\Program Files\Common Files\microsoft shared
O43 - CFD: 02/11/2006 - 12:18:34 ----D- C:\Program Files\Common Files\Services
O43 - CFD: 02/11/2006 - 12:18:34 ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 26/10/2009 - 18:07:30 ----D- C:\Program Files\Common Files\System
O43 - CFD: 03/03/2009 - 14:36:46 ----D- C:\Program Files\Common Files\Windows Live
O43 - CFD: 17/02/2010 - 15:28:58 ----D- C:\ProgramData\Adobe
O43 - CFD: 13/12/2010 - 10:26:36 ----D- C:\ProgramData\Alwil Software
O43 - CFD: 22/09/2009 - 21:08:54 ----D- C:\ProgramData\Apple
O43 - CFD: 22/09/2009 - 18:54:52 ----D- C:\ProgramData\Apple Computer
O43 - CFD: 02/11/2006 - 13:59:46 -SH-D- C:\ProgramData\Application Data
O43 - CFD: 20/11/2010 - 18:39:16 ----D- C:\ProgramData\ArcSoft
O43 - CFD: 22/03/2009 - 10:55:36 ----D- C:\ProgramData\ATI
O43 - CFD: 21/09/2009 - 09:14:22 -SH-D- C:\ProgramData\Bureau
O43 - CFD: 02/11/2006 - 13:59:46 -SH-D- C:\ProgramData\Desktop
O43 - CFD: 02/11/2006 - 13:59:46 -SH-D- C:\ProgramData\Documents
O43 - CFD: 21/09/2009 - 09:14:22 -SH-D- C:\ProgramData\Favoris
O43 - CFD: 02/11/2006 - 13:59:46 -SH-D- C:\ProgramData\Favorites
O43 - CFD: 21/09/2009 - 09:48:06 ----D- C:\ProgramData\Google
O43 - CFD: 11/02/2010 - 14:12:06 ----D- C:\ProgramData\InterVideo
O43 - CFD: 11/01/2011 - 21:27:14 ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 21/09/2009 - 09:14:22 -SH-D- C:\ProgramData\Menu Démarrer
O43 - CFD: 16/10/2009 - 20:58:02 ----D- C:\ProgramData\Messenger Plus!
O43 - CFD: 13/12/2010 - 09:57:08 ----D- C:\ProgramData\MFAData
O43 - CFD: 21/09/2009 - 17:36:10 -S--D- C:\ProgramData\Microsoft
O43 - CFD: 21/09/2009 - 11:29:56 ----D- C:\ProgramData\Microsoft Help
O43 - CFD: 21/09/2009 - 09:14:22 -SH-D- C:\ProgramData\Modèles
O43 - CFD: 21/11/2009 - 16:58:50 ----D- C:\ProgramData\Norton
O43 - CFD: 03/03/2009 - 14:45:58 ----D- C:\ProgramData\NortonInstaller
O43 - CFD: 18/07/2010 - 11:42:18 ----D- C:\ProgramData\Samsung
O43 - CFD: 11/01/2011 - 17:44:12 ----D- C:\ProgramData\Spybot - Search & Destroy
O43 - CFD: 02/11/2006 - 13:59:46 -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 11/02/2010 - 22:04:12 ----D- C:\ProgramData\Sun
O43 - CFD: 23/09/2009 - 07:45:40 ----D- C:\ProgramData\Symantec
O43 - CFD: 02/11/2006 - 13:59:46 -SH-D- C:\ProgramData\Templates
O43 - CFD: 24/09/2009 - 14:22:38 ----D- C:\ProgramData\UDL
O43 - CFD: 28/11/2009 - 18:33:46 ----D- C:\ProgramData\WildTangent
O43 - CFD: 07/10/2009 - 12:25:32 ----D- C:\ProgramData\WindSolutions
O43 - CFD: 17/02/2010 - 15:28:58 ----D- C:\Users\Christine\AppData\Roaming\Adobe
O43 - CFD: 17/02/2010 - 17:52:10 ----D- C:\Users\Christine\AppData\Roaming\app
O43 - CFD: 06/05/2010 - 12:10:00 ----D- C:\Users\Christine\AppData\Roaming\Apple Computer
O43 - CFD: 05/10/2009 - 17:30:08 ----D- C:\Users\Christine\AppData\Roaming\ArcSoft
O43 - CFD: 21/09/2009 - 09:17:46 ----D- C:\Users\Christine\AppData\Roaming\ATI
O43 - CFD: 09/12/2010 - 10:34:38 ----D- C:\Users\Christine\AppData\Roaming\BitTorrent
O43 - CFD: 07/10/2009 - 12:34:54 ----D- C:\Users\Christine\AppData\Roaming\CopyTransDoctor
O43 - CFD: 17/02/2010 - 18:06:08 ----D- C:\Users\Christine\AppData\Roaming\Dofus 2
O43 - CFD: 17/02/2010 - 17:51:58 ----D- C:\Users\Christine\AppData\Roaming\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
O43 - CFD: 10/05/2010 - 14:54:52 ----D- C:\Users\Christine\AppData\Roaming\FreeFLVConverter
O43 - CFD: 09/02/2010 - 11:25:08 ----D- C:\Users\Christine\AppData\Roaming\freeTVRadio
O43 - CFD: 21/09/2009 - 09:47:06 ----D- C:\Users\Christine\AppData\Roaming\Google
O43 - CFD: 21/09/2009 - 09:17:12 ----D- C:\Users\Christine\AppData\Roaming\Identities
O43 - CFD: 07/10/2009 - 12:32:26 ----D- C:\Users\Christine\AppData\Roaming\iLibs
O43 - CFD: 21/09/2009 - 09:16:06 ----D- C:\Users\Christine\AppData\Roaming\Macromedia
O43 - CFD: 11/01/2011 - 21:27:30 ----D- C:\Users\Christine\AppData\Roaming\Malwarebytes
O43 - CFD: 02/09/2010 - 17:05:20 -S--D- C:\Users\Christine\AppData\Roaming\Microsoft
O43 - CFD: 09/03/2010 - 17:20:06 ----D- C:\Users\Christine\AppData\Roaming\Mozilla
O43 - CFD: 12/01/2011 - 07:50:18 ----D- C:\Users\Christine\AppData\Roaming\OfferBox
O43 - CFD: 17/02/2010 - 17:52:10 ----D- C:\Users\Christine\AppData\Roaming\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
O43 - CFD: 18/07/2010 - 11:40:52 ----D- C:\Users\Christine\AppData\Roaming\Samsung
O43 - CFD: 07/10/2009 - 12:40:20 ----D- C:\Users\Christine\AppData\Roaming\WindSolutions

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.B0ED12005489477700FCFD7F84EE1200] - 12/01/2011 - 14:47:08 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\WindowsUpdate.log [1143570]
O44 - LFC:[MD5.3FFB3005DED6050EEE97F346652CB936] - 11/01/2011 - 23:24:32 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\MEMORY.DMP [268802643]
O44 - LFC:[MD5.7A348C0EC99F4FEE3952A5D0AEF5AA0F] - 11/01/2011 - 22:55:53 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\cleannavi.txt [1475]
O44 - LFC:[MD5.E74DC2F3F9675A6025A4AA020EDD4341] - 11/01/2011 - 21:27:14 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\System32\drivers\mbamswissarmy.sys [38224]
O44 - LFC:[MD5.9B5CC6C481BDD00A963829B892623247] - 11/01/2011 - 21:27:10 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\System32\drivers\mbam.sys [20952]
O44 - LFC:[MD5.44536E4662DFF6A203B192F9818C510B] - 11/01/2011 - 17:14:13 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\GDIPFONTCACHEV1.DAT [91712]
O44 - LFC:[MD5.E2F9B8B42733FBE4EAE62380480364BC] - 15/12/2010 - 19:59:22 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\FNTCACHE.DAT [373720]
O44 - LFC:[MD5.87C5B568279AD7D311C22CB6CB5BBC21] - 15/12/2010 - 17:05:13 ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\Windows\System32\atmlib.dll [34304]
O44 - LFC:[MD5.EFA645847B66BF9FBD7DB06B4EBC80D6] - 15/12/2010 - 17:05:13 ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\Windows\System32\atmfd.dll [292352]

---\\ Export de clé d'application autorisée (ECAA) (O47)
O47 - AAKE:Key Export SP - "C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) (.not file.) --

---\\ MountPoints2 Shell Key (MPSK) (O51)
O51 - MPSK:{23a05c84-16c7-11de-af90-806e6f6e6963}\Shell\AutoRun\command - Clé orpheline

---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Codec Cinepak®.) -- C:\Windows\System32\iccvid.dll
O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

---\\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TS Single Sign On Security Package.) -- C:\Windows\system32\credssp.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TS Single Sign On Security Package.) -- C:\Windows\system32\credssp.dll

---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=2
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1
O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0

---\\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "BindDirectlyToPropertySetStorage"=0

---\\ Liste des Drivers Système (SDL) (O58)