WinFlyer, starhide et peut-être pire?

Salut à toi^^
dans l'ordre (^^!!):
> j'ai pu virer winspool.exe, mais pas winspool.drv, que faire? un Moveandboot?
> merci pour la nouvelle java, je l'installerai quand je serai désinfecté
> j'ai viré le dossier Win32
> un petit CLEANMGR en passant
> et voici le rapport suspectfile (ton nouveau lien a fonctionné, merci!):
SystemScan - www.suspectfile.com - ver. 3.1.2

Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 10/06/2007
Time: 11:41:59

Output limited to:
-Recent files
-Registry Run Keys
-Loaded Dlls
-Hidden objects
-Suspicious Files
-Installed Applications

===================== Recent files (30 days old)=====================

----- recent files in C:\
12/05/2007 19:17:54 (DIR) 0 byte 29 days old -- System Volume Information
07/06/2007 15:17:06 (DIR) 0 byte 3 days old -- THX_1138
07/06/2007 16:53:24 (DIR) 0 byte 3 days old -- ANGEL_A
09/06/2007 19:35:21 8927 byte 1 days old -- dnsbak.reg
09/06/2007 19:53:41 (DIR) 0 byte 1 days old -- VundoFix Backups
09/06/2007 19:55:36 824 byte 1 days old -- VundoFix.txt
09/06/2007 20:03:34 485 byte 1 days old -- rapport_clean.txt
09/06/2007 20:47:27 0 byte 1 days old -- AUTOEXEC.BAT
09/06/2007 20:47:27 0 byte 1 days old -- CONFIG.SYS
09/06/2007 21:57:20 (DIR) 0 byte 1 days old -- fixwareout
09/06/2007 23:26:45 (DIR) 0 byte 1 days old -- TEMP
09/06/2007 23:33:58 (DIR) 0 byte 1 days old -- Program Files
09/06/2007 23:45:50 3743 byte 1 days old -- rapport.txt
10/06/2007 11:15:56 (DIR) 0 byte 0 days old -- Config.Msi
10/06/2007 11:15:56 1610612736 byte 0 days old -- pagefile.sys
10/06/2007 11:28:30 (DIR) 0 byte 0 days old -- WINDOWS
10/06/2007 11:41:59 (DIR) 0 byte 0 days old -- suspectfile

----- recent files in C:\WINDOWS\
12/05/2007 19:10:12 6144 byte 29 days old -- Thumbs.db
13/05/2007 18:25:55 (DIR) 0 byte 28 days old -- Adobe Illustrator CS
29/05/2007 03:55:38 (DIR) 0 byte 12 days old -- security
30/05/2007 20:32:38 894 byte 11 days old -- win.ini
05/06/2007 13:59:25 54156 byte 5 days old -- QTFont.qfn
05/06/2007 13:59:25 1409 byte 5 days old -- QTFont.for
05/06/2007 14:05:22 116 byte 5 days old -- NeroDigital.ini
08/06/2007 20:31:11 (DIR) 0 byte 2 days old -- $NtUninstallKB930916$
08/06/2007 20:31:22 (DIR) 0 byte 2 days old -- $NtUninstallKB931768$
08/06/2007 20:31:33 (DIR) 0 byte 2 days old -- $hf_mig$
08/06/2007 20:31:34 (DIR) 0 byte 2 days old -- $NtUninstallKB927891$
08/06/2007 20:31:37 (DIR) 0 byte 2 days old -- inf
09/06/2007 02:07:24 (DIR) 0 byte 1 days old -- CSC
09/06/2007 15:54:05 (DIR) 0 byte 1 days old -- Debug
09/06/2007 20:00:13 0 byte 1 days old -- setuperr.log
09/06/2007 20:16:02 392718 byte 1 days old -- ntbtlog.txt
09/06/2007 21:56:14 0 byte 1 days old -- Sti_Trace.log
10/06/2007 09:44:46 (DIR) 0 byte 0 days old -- Installer
10/06/2007 10:37:51 1266 byte 0 days old -- SchedLgU.Txt
10/06/2007 11:16:01 2048 byte 0 days old -- bootstat.dat
10/06/2007 11:16:02 0 byte 0 days old -- 0.log
10/06/2007 11:16:22 51 byte 0 days old -- iTouch.ini
10/06/2007 11:16:22 25386 byte 0 days old -- WindowsUpdate.log
10/06/2007 11:16:23 50 byte 0 days old -- wiaservc.log
10/06/2007 11:16:50 259 byte 0 days old -- wiadebug.log
10/06/2007 11:29:49 9730 byte 0 days old -- msmqinst.log
10/06/2007 11:29:49 1868 byte 0 days old -- netfxocm.log
10/06/2007 11:30:06 945 byte 0 days old -- setupapi.log
10/06/2007 11:30:10 4499 byte 0 days old -- imsins.log
10/06/2007 11:30:10 46935 byte 0 days old -- iis6.log
10/06/2007 11:30:10 3615 byte 0 days old -- ntdtcsetup.log
10/06/2007 11:30:10 5377 byte 0 days old -- ocgen.log
10/06/2007 11:30:10 6700 byte 0 days old -- tsoc.log
10/06/2007 11:30:10 4273 byte 0 days old -- comsetup.log
10/06/2007 11:36:29 (DIR) 0 byte 0 days old -- Temp
10/06/2007 11:38:39 (DIR) 0 byte 0 days old -- system32
10/06/2007 11:39:20 360 byte 0 days old -- setupact.log

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
12/05/2007 19:17:54 (DIR) 0 byte 29 days old -- Restore
13/05/2007 18:28:49 (DIR) 0 byte 28 days old -- Adobe
07/06/2007 12:27:32 2206 byte 3 days old -- wpa.dbl
08/06/2007 20:31:27 (DIR) 0 byte 2 days old -- dllcache
08/06/2007 21:28:53 47899 byte 2 days old -- geedb.exe
08/06/2007 21:28:55 37437 byte 2 days old -- mqutLut.dll.vir
09/06/2007 22:24:17 (DIR) 0 byte 1 days old -- drivers
09/06/2007 23:45:47 4130 byte 1 days old -- tmp.reg
09/06/2007 23:45:47 0 byte 1 days old -- tmp.txt
10/06/2007 11:16:30 49152 byte 0 days old -- CompiledAdapter
10/06/2007 11:30:02 (DIR) 0 byte 0 days old -- CatRoot2
10/06/2007 11:34:08 (DIR) 0 byte 0 days old -- inetsrv

----- recent files in C:\WINDOWS\system32\drivers\
09/06/2007 22:44:26 (DIR) 0 byte 1 days old -- etc

----- recent files in C:\WINDOWS\temp\
09/06/2007 21:55:58 16384 byte 1 days old -- Perflib_Perfdata_4c8.dat
09/06/2007 21:56:12 16384 byte 1 days old -- Perflib_Perfdata_494.dat
09/06/2007 21:56:15 16384 byte 1 days old -- Perflib_Perfdata_698.dat
09/06/2007 22:24:22 0 byte 1 days old -- tmp_ng_6owsZcKQ5QWAm1R
09/06/2007 22:24:22 0 byte 1 days old -- tmp_ng_5D5iRPtNnlUm2Ow
09/06/2007 22:24:22 0 byte 1 days old -- tmp_ng_zpvgcMikpZvImGi
09/06/2007 23:09:13 16384 byte 1 days old -- Perflib_Perfdata_614.dat
09/06/2007 23:09:27 16384 byte 1 days old -- Perflib_Perfdata_470.dat
09/06/2007 23:16:05 16384 byte 1 days old -- Perflib_Perfdata_fc.dat
10/06/2007 00:33:32 16384 byte 0 days old -- Perflib_Perfdata_34c.dat
10/06/2007 00:33:36 16384 byte 0 days old -- Perflib_Perfdata_8ec.dat
10/06/2007 09:29:38 16384 byte 0 days old -- Perflib_Perfdata_760.dat
10/06/2007 09:29:40 16384 byte 0 days old -- Perflib_Perfdata_21c.dat
10/06/2007 11:16:05 16384 byte 0 days old -- Perflib_Perfdata_42c.dat
10/06/2007 11:16:16 16384 byte 0 days old -- Perflib_Perfdata_3a8.dat
10/06/2007 11:16:24 16384 byte 0 days old -- Perflib_Perfdata_980.dat
10/06/2007 11:40:16 (DIR) 0 byte 0 days old -- _avast4_

----- recent files in C:\Program Files\
13/05/2007 18:27:38 (DIR) 0 byte 28 days old -- InstallShield Installation Information
13/05/2007 18:27:39 (DIR) 0 byte 28 days old -- Adobe
30/05/2007 11:44:36 (DIR) 0 byte 11 days old -- CamStudio
02/06/2007 12:56:40 (DIR) 0 byte 8 days old -- Winamp
02/06/2007 13:01:02 (DIR) 0 byte 8 days old -- Echo
02/06/2007 13:20:33 (DIR) 0 byte 8 days old -- Exact Audio Copy
02/06/2007 14:27:36 (DIR) 0 byte 8 days old -- foobar2000
02/06/2007 15:33:45 (DIR) 0 byte 8 days old -- MediaCoder
02/06/2007 16:24:00 (DIR) 0 byte 8 days old -- CUE Splitter
03/06/2007 22:36:48 (DIR) 0 byte 7 days old -- Monkey's Audio
04/06/2007 10:55:21 (DIR) 0 byte 6 days old -- 7-Zip
08/06/2007 20:31:27 (DIR) 0 byte 2 days old -- Internet Explorer
08/06/2007 23:00:50 (DIR) 0 byte 2 days old -- EMCO Malware Destroyer
09/06/2007 02:09:04 (DIR) 0 byte 1 days old -- Spybot - Search & Destroy
09/06/2007 14:09:16 (DIR) 0 byte 1 days old -- Grisoft
09/06/2007 14:36:59 (DIR) 0 byte 1 days old -- VirtualDJ
09/06/2007 15:47:20 (DIR) 0 byte 1 days old -- DVDFab Decrypter 3
09/06/2007 15:48:22 (DIR) 0 byte 1 days old -- CleanUp!
09/06/2007 15:53:38 (DIR) 0 byte 1 days old -- CCleaner
09/06/2007 16:43:43 (DIR) 0 byte 1 days old -- a-squared Free
09/06/2007 22:23:31 (DIR) 0 byte 1 days old -- MSConfig CleanUp
09/06/2007 23:32:46 (DIR) 0 byte 1 days old -- BitTorrent
10/06/2007 09:44:44 (DIR) 0 byte 0 days old -- Fichiers communs

----- recent files in C:\Program Files\Fichiers communs\
13/05/2007 18:28:49 (DIR) 0 byte 28 days old -- Adobe

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
"MaxtorOneTouch"="C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
@=""
"mxomssmenu"="\"C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe\""
"ATIPTA"="\"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe\""
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe"
"NVMixerTray"="\"C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe\""
"NWEReboot"=""
"MsmqIntCert"="regsvr32 /s mqrt.dll"
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\" -osboot"
"SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe"
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun"
"SysMetrix"="C:\Program Files\SysMetrix\SysMetrix.exe"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"Acrobat Assistant 7.0"="\"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe\""
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg"
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe"
"!AVG Anti-Spyware"="\"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe\" /minimized"
"tcactive"="C:\Program Files\The Cleaner\tca.exe"
"tcmonitor"="C:\Program Files\The Cleaner\tcm.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
"WinFlyer32.dll"="\"rundll32.exe\" C:\WINDOWS\system32\WinFlyer32.dll,Run"
"Win32"="C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local"

[Run\OptionalComponents]

[Run\OptionalComponents\IMAIL]
"Installed"="1"

[Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[Run\OptionalComponents\MSFS]
"Installed"="1"

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe\""
"DS Clock"="\"C:\Program Files\DS Clock\dsclock.exe\""
"MinimizeToTray"="\"C:\Documents and Settings\Administrateur\Bureau\der\minimize-to-tray_minimize_to_tray_1.2_anglais_24657\Minimize to tray.exe\""
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
"SpyEmergency"="\"C:\Program Files\NETGATE\Spy Emergency 2006\SpyEmergency.exe\""

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"%SystemRoot%\system32\webcheck.dll"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
"@="Sans fil"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
"@="Folder Redirection"
"DllName"=expand:"fdeploy.dll"

[Winlogon\GPExtensions\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"@="Quota du disque Microsoft"
"DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
"@="Planificateur de paquets QoS"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
"@="Scripts"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
"@="Mappage de zones Internet Explorer"
"DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"DllName"=expand:"iedkcs32.dll"
"@="Personnalisation de Internet Explorer"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
"@="Microsoft Offline Files"
"DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"@="Installation de logiciel"
"DllName"=expand:"appmgmts.dll"

[Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
"@="S馗urit・IP"
"DllName"=expand:"gptext.dll"

[Winlogon\Notify]

[Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"
"Logoff"="ChainWlxLogoffEvent"

[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"
"Logoff"="CryptnetWlxLogoffEvent"

[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"StartShell"="WinlogonStartShellEvent"

[Winlogon\Notify\mqutLut]

[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001

[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"

[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000
"ASPNET"=dword:00000000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"ParseAutoexec"="1"
"ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
"BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
"BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
"cmdline"=expand:"%SystemRoot%\system32\ntvdm.exe"
"wowcmdline"=expand:"%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr・chargeur Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D駑on de cache des cat馮ories de composant"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
"NoExplorer"=dword:00000001
@=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
#### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
#### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

[Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
#### HKCR\CLSID\{AE7CD045-E861-484f-8273-0445EE161910}\InprocServer32 @="C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll"
@=""

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @=expand:"%SystemRoot%\system32\shdocvw.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder-----

[startupfolder]

-----HKCU\Control Panel\Desktop\-----

[Desktop]
"SCRNSAVE.EXE"="C:\WINDOWS\system32\scrnsave.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
@="\"%1\" /S"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
@="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
@="http://"

[URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]
"Authentication Packages"=multi:"msv1_0\00\00"
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=multi:"kerberos\00msv1_0\00schannel\00wdigest\00\00"
"ImpersonatePrivilegeUpgradeToolHasRun"=dword:00000001
"LsaPid"=dword:0000068c
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nodefaultadminowner"=dword:00000001
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=multi:"scecli\00\00"

[Lsa\AccessProviders]
"ProviderOrder"=multi:"Windows NT Access Provider\00\00"

[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]
@Class="b0d0d1fb"
"Pattern"=hex:5d,5a,14,f6,10,e3,eb,ea,0a,39,1b,f4,8e,30,b1,71,62,30,64,30,64,\
31,66,62,00,fd,07,00,77,49,00,00,34,fa,07,00,56,82,74,75,20,fa,07,00,40,fd,\
07,00,4c,fd,07,00,8b,ee,c9,c7,a5,52,d0,fb,e8,c7,72,b0

[Lsa\GBG]
@Class="8b5280a5"
"GrafBlumGroup"=hex:c8,d8,df,6d,2f,56,ab,0b,33

[Lsa\JD]
@Class="e872c7fb"
"Lookup"=hex:a6,37,5a,06,0e,53

[Lsa\Kerberos]

[Lsa\Kerberos\Domains]

[Lsa\Kerberos\SidCache]

[Lsa\MSV1_0]
"Auth132"="iissuba"
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000

[Lsa\Skew1]
@Class="c9eec770"
"SkewMatrix"=hex:8b,d7,da,9b,d5,ba,81,bd,3d,e5,7e,9c,bd,c8,1e,76

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[Lsa\SspiCache]
"Time"=hex:ac,29,c7,c0,6a,dd,c6,01

[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,10,22,d2,ac,79,c4,01
"Type"=dword:00000031

[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,c4,e6,d6,ac,79,c4,01
"Type"=dword:00000031

[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,f1,17,d8,ac,79,c4,01
"Type"=dword:00000031

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
"DependOnGroup"=multi:"\00"
"DependOnService"=multi:"Netman\00WinMgmt\00\00"
"Description"="Assure la traduction d'adresses de r駸eau, l'adressage, les services de r駸olution de noms et/ou les services de pr騅ention d'intrusion pour un r駸eau de petite entreprise ou un r駸eau domestique."
"DisplayName"="Pare-feu Windows / Partage de connexion Internet"
"ErrorControl"=dword:00000001
"ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[SharedAccess\Epoch]
"Epoch"=dword:00000a16

[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
"DoNotAllowExceptions"=dword:00000000
"DisableNotifications"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Disabled:Nero Home"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Disabled:eMule"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Disabled:Microsoft DirectPlay Helper"
"C:\Micro Machines V3\micro.exe"="C:\Micro Machines V3\micro.exe:*:Enabled:micro"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Pinnacle\MediaCenter\PMC.exe"="C:\Program Files\Pinnacle\MediaCenter\PMC.exe:LocalSubNet:Enabled:Pmc.exe"
"C:\Program Files\Pinnacle\MediaCenter\PMC.Tvtv.Spooler.exe"="C:\Program Files\Pinnacle\MediaCenter\PMC.Tvtv.Spooler.exe:LocalSubNet:Enabled:PMC.Tvtv.Spooler.exe"
"C:\Program Files\Pinnacle\MediaCenter\PSST.exe"="C:\Program Files\Pinnacle\MediaCenter\PSST.exe:LocalSubNet:Enabled:PSST.exe"
"C:\Program Files\Pinnacle\Shared Files\Programs\MediaManager\PMSManager.exe"="C:\Program Files\Pinnacle\Shared Files\Programs\MediaManager\PMSManager.exe:LocalSubNet:Enabled:PMSManager.exe"
"C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSInstallInit.exe"="C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe"
"C:\Program Files\Pinnacle\MediaCenter\PMC.Tvtv.Wizard.exe"="C:\Program Files\Pinnacle\MediaCenter\PMC.Tvtv.Wizard.exe:LocalSubNet:Enabled:PMC.Tvtv.Wizard.exe"
"C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"="C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe:LocalSubNet:Disabled:PMCService"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe"="C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe"="C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP"="1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008"

[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
14,00,00,00,02,00,48,00,03,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
14,00,00,00,02,00,34,00,02,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\
00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,\
00,00,00,00,05,20,00,00,00,20,02,00,00
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
14,00,00,00,02,00,30,00,02,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,\
00,00,05,07,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,01,00,00,\
00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00
"EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

[Ole\NONREDIST]
"System.EnterpriseServices.Thunk.dll"=""

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
"UpdatesDisableNotify"=dword:00000000

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:00000005
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[SystemRestore\Cfg]
"DiskPercent"=dword:00000005
"MachineGuid"="{71C087D4-1054-4646-98B0-D9D3F34A01F6}"

[SystemRestore\SnapshotCallbacks]
@=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

[MountPoints2]

[MountPoints2\C]
"BaseClass"="Drive"

[MountPoints2\D]
"BaseClass"="Drive"

[MountPoints2\E]
"BaseClass"="Drive"

[MountPoints2\F]
"BaseClass"="Drive"

[MountPoints2\G]
"BaseClass"="Drive"

[MountPoints2\H]
"BaseClass"="Drive"

[MountPoints2\{240e88dc-cb3d-11db-8d7b-000129d161c7}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,01,00,00,00,08,07,00,00
"_LabelFromReg"="La Mangouste"

[MountPoints2\{240e88dc-cb3d-11db-8d7b-000129d161c7}\shell]
@="None"

[MountPoints2\{240e88dc-cb3d-11db-8d7b-000129d161c7}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{240e88dc-cb3d-11db-8d7b-000129d161c7}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{240e88dc-cb3d-11db-8d7b-000129d161c7}\_Autorun]

[MountPoints2\{240e88dc-cb3d-11db-8d7b-000129d161c7}\_Autorun\DefaultIcon]
@="G:\.\mxoicon1.ico"

[MountPoints2\{54c8e25a-46a4-11db-adf2-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{60ba8650-495b-11db-80b5-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
5f,cf,cf,cf,5f,5f,5f,cf,cf,cf,5f,5f,cf,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,df,\
df,5f,5f,5f,5f,cf,cf,cf,cf,cf,cf,cf,cf,5f,cf,cf,df,5f,5f,5f,5f,5f,5f,5f,5f,\
5f,5f,00,20,00,00,00,00,00,00,00

[MountPoints2\{60ba8650-495b-11db-80b5-806d6172696f}\_Autorun]

[MountPoints2\{60ba8650-495b-11db-80b5-806d6172696f}\_Autorun\DefaultIcon]
@="D:\pcfriend.ico"

[MountPoints2\{63d53ab6-46a3-11db-8c38-e4f2318e3711}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,01,5f,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,01,00,00,00,08,02,00,00

[MountPoints2\{63d53ab6-46a3-11db-8c38-e4f2318e3711}\shell]
@="None"

[MountPoints2\{63d53ab6-46a3-11db-8c38-e4f2318e3711}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{63d53ab6-46a3-11db-8c38-e4f2318e3711}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{63d53ab6-46a3-11db-8c38-e4f2318e3711}\_Autorun]

[MountPoints2\{63d53ab6-46a3-11db-8c38-e4f2318e3711}\_Autorun\DefaultIcon]
@="G:\.\mxoicon2.ico"

[MountPoints2\{8314e4c2-46ae-11db-8c33-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,01,00,01,01,ee,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,60,00,00,00,09,00,00,00

[MountPoints2\{8314e4c2-46ae-11db-8c33-806d6172696f}\_Autorun]

[MountPoints2\{8314e4c2-46ae-11db-8c33-806d6172696f}\_Autorun\DefaultIcon]
@="D:\SETUP.ICO"

[MountPoints2\{8314e4c3-46ae-11db-8c33-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,cf,cf,cf,cf,cf,cf,cf,cf,5f,cf,cf,cf,5f,5f,5f,5f,5f,5f,5f,5f,\
5f,5f,00,00,10,00,00,00,00,00,00

[MountPoints2\{8314e4c3-46ae-11db-8c33-806d6172696f}\shell]
@="None"

[MountPoints2\{8314e4c3-46ae-11db-8c33-806d6172696f}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{8314e4c3-46ae-11db-8c33-806d6172696f}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{a88baefa-5bc8-11db-80f0-000129d161c7}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
5f,cf,01,01,00,5f,5f,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,20,00,00,00,0c,00,00,00

[MountPoints2\{a88baefa-5bc8-11db-80f0-000129d161c7}\_Autorun]

[MountPoints2\{a88baefa-5bc8-11db-80f0-000129d161c7}\_Autorun\DefaultIcon]
@="F:\setup/EUV10.ico"

[MountPoints2\{bf1f690e-d33f-11db-8d93-000129d161c7}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,06,00,00

[MountPoints2\{bf1f690e-d33f-11db-8d93-000129d161c7}\shell]
@="None"

[MountPoints2\{bf1f690e-d33f-11db-8d93-000129d161c7}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{bf1f690e-d33f-11db-8d93-000129d161c7}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{d1dd65ef-4c82-11db-80c6-000129d161c7}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,01,5f,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,04,00,00

[MountPoints2\{dc7cf8ba-4959-11db-8c3e-b4dde01e5d14}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,02,00,00

[MountPoints2\{dc7cf8ba-4959-11db-8c3e-b4dde01e5d14}\shell]
@="None"

[MountPoints2\{dc7cf8ba-4959-11db-8c3e-b4dde01e5d14}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{dc7cf8ba-4959-11db-8c3e-b4dde01e5d14}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{e4db1623-4ce7-11db-80c9-000129d161c7}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,cf,cf,cf,cf,cf,cf,cf,cf,5f,cf,cf,cf,5f,5f,5f,5f,5f,5f,5f,5f,\
5f,5f,00,00,10,00,00,00,00,00,00

[MountPoints2\{f22bc0b6-851c-11db-8141-000129d161c7}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,01,00,00,00,08,07,00,00

[MountPoints2\{f22bc0b6-851c-11db-8141-000129d161c7}\shell]
@="None"

[MountPoints2\{f22bc0b6-851c-11db-8141-000129d161c7}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{f22bc0b6-851c-11db-8141-000129d161c7}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{fd0b6698-aed0-11db-8d44-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
5f,cf,01,01,00,5f,5f,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,20,00,00,00,0c,00,00,00

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
"@="Microsoft Windows Media Player"
"ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
"@="Personnalisation du navigateur"
"ComponentID"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{04BB5038-A945-CA88-190A-E4EFE2053ED1}]
"@="Outlook Express"
"ComponentID"="OEACCESS"

[Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}]
"@="Security Update for Microsoft .NET Framework 2.0 (KB922770)"
"ComponentID"="KB922770"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
"@="Rendu VML (Vector Graphics Rendering)"
"ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="NetShow"
"StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"=""
"@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
#### HKCR\CLSID\{283807B5-2C60-11D0-A31D-00AA00B92C03}\InprocServer32 @="C:\WINDOWS\system32\danim.dll"
"@="DirectAnimation"
"ComponentID"="DirectAnimation"

[Installed Components\{2A513F84-3D6E-02DF-2A59-FEB7A2A12A9E}]
"@="Outlook Express"
"ComponentID"="OEACCESS"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"@="Themes Setup"
"ComponentID"="Theme Component"
"StubPath"=expand:"%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
"@="Liaison de donn馥s Dynamic HTML pour Java"
"ComponentID"="TridataJava"

[Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
"@="Logiciel de navigation hors connexion"
"ComponentID"="MobilePk"

[Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
"@="Uniscribe"
"ComponentID"="USP10"

[Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
"ComponentID"="S867460"
"@="Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)"

[Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}]
"@="Cr饌tion avanc馥"
"ComponentID"="AdvAuth"

[Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"@="Microsoft Outlook Express 6"
"ComponentID"="MailNews"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install"

[Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
"@="DirectShow"
"ComponentID"="activemovie"

[Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
"@="DirectDrawEx"
"ComponentID"="DirectDrawEx"

[Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
"@="Aide sur Internet Explorer"
"ComponentID"="HelpCont"

[Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
"@="Classes Java DirectAnimation"
"ComponentID"="DAJava"

[Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
"@="Microsoft Windows Script 5.6"
"ComponentID"="MSVBScript"

[Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
"(Default)"="Internet Connection Wizard"
"ComponentID"="ICW"

[Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
"@="Outils d'installation Internet Explorer"
"ComponentID"="GenSetup"

[Installed Components\{6058B4B6-7EF1-4A19-DD4D-CD2B5D1BC0E4}]
"@="DirectAnimation"
"ComponentID"="DirectAnimation"

[Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
"@="Am駘iorations pour la navigation"
"ComponentID"="ExtraPack"
"KeyFileName"="C:\WINDOWS\system32\msieftp.dll"

[Installed Components\{67041002-47E4-F31D-B892-4504FDD92572}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"

[Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
#### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll"
"@="Microsoft Windows Media Player"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub"

[Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
"@="Acc鑚 au site MSN"
"ComponentID"="MSN_Auth"

[Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

[Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
"@="Dossiers Web"
"ComponentID"="WebFolders"
"StubPath"=""

[Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"@="Carnet d'adresses 6"
"ComponentID"="WAB"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
"@="Mise ・jour du Bureau Windows"
"ComponentID"="IE4Shell_NT"
"StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
"@="Internet Explorer 6"
"ComponentID"="BASEIE40_W2K"
"StubPath"=expand:"%SystemRoot%\system32\ie4uinit.exe"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix]

[Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
"ComponentID"="DOTNETFRAMEWORKS"
"StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install"

[Installed Components\{8EFA4753-7169-4CC3-A28B-0A1643B8A39B}]
"ComponentID"="M886903"
"@="Microsoft .NET Framework 1.1 Hotfix (KB886903)"

[Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
"@="Liaison de donn馥s Dynamic HTML"
"ComponentID"="Tridata"

[Installed Components\{967B098A-042D-4367-BAC9-8BC11684174F}]
"@="Security Update for Microsoft .NET Framework 2.0 (KB917283)"
"ComponentID"="KB917283"

[Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]

[Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
"@="Polices de base Internet Explorer"
"ComponentID"="Fontcore"

[Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

[Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
"@="Planificateur de t稍hes"
"ComponentID"="MSTASK"

[Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
"ComponentID"="Windows Movie Maker v2.0"

[Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

[Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
"@="Aide HTML"
"ComponentID"="HTMLHelp"

[Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
"@="Active Directory Service Interface"
"ComponentID"="ADSI"

[Installed Components\{EFD4B018-BF70-E4A0-5419-4C3A2EBBACA3}]
"@="Lecteur Windows Media Microsoft 6.4"
"ComponentID"="Microsoft Windows Media Player"

[Installed Components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

-----Comparing registry keys CCS1 vs CCS2 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\.NET CLR Data
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\.NET CLR Networking
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\.NET Data Provider for Oracle
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\.NET Data Provider for SqlServer
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\.NETFramework
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\3xHybrid
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\61883
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\a2free
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Aavmker4
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Abiosdsk
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\abp480n5
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ACPI
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ACPIEC
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Adobe LM Service
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\adpu160m
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aec
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AFD
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Aha154x
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aic78u2
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aic78xx
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Alerter
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ALG
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AliIde
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services

"Le rapport est incomplet ;-) " > qu'est-ce que je peux faire?

- geedb.exe
- mqutLut.dll.vir
- fixwareout
- VundoFix (dossier, rapport)
- Clean (dossier, rapport)
- dnsbak.reg
>supprim¨¦s en mode sans ¨¦chec, red¨¦marr¨¦ en mode normal, ils ont disparu

winspool.drv
>(dans le system32) > impossible ¨¤ supprimer (prot¨¦g¨¦ en ¨¦criture ou [...] je-sais-plus-quoi, le message habituel!)

registre nettoy¨¦ avec cc cleaner
red¨¦marrage en mode normal

toujours le message d'erreur:
erreur de chargement C:/WINDOWS/system32/Winflyer32.dll
WinFlyer est toujours dans ajout/suppression des programes mais impossible ¨¤ supprimer, puisqu'il est introuvable sur l'ordi, SAUF QUE:
hijackthis:
toujours winflyer, toujours starhide...
je m'en remets encore ¨¤ tes precieux conseils!!
++: mon ordi fait un bip comme celui du démarrage toutes les demi-heures à peu près, sinon pas de bu en dehors de celui de départ
++: est-ce que supprimer le contenu de mon dossier RESTORE pourrait changer quelque chose?

RE: voici un nouveau log hijackthis apr¨¨s red¨¦marrage en mode normal:
Logfile of HijackThis v1.99.1
Scan saved at 14:22:26, on 10/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
c:\program files\a-squared free\a2service.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\DS Clock\dsclock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\D-Link\AirPlusG+\AirPlus.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\All Users\Documents\ordinateur\softwares\protection\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SysMetrix] C:\Program Files\SysMetrix\SysMetrix.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DS Clock] "C:\Program Files\DS Clock\dsclock.exe"
O4 - HKCU\..\Run: [MinimizeToTray] "C:\Documents and Settings\Administrateur\Bureau\der\minimize-to-tray_minimize_to_tray_1.2_anglais_24657\Minimize to tray.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2006\SpyEmergency.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ContrúÍeur dµÛtat.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: D-Link AirPlus G+ Wireless Utility.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sñ~ection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sñ~ection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sñ~ectionnñŸ en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sñ~ectionnñŸ en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mqutLut - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe

Alors,
> j'ai coché tout ce que tu m'as dit dans Hijackthis, puis fixchecked:
> unexpected error owned error#52 (bad file or number) in Sub get log file path (?exe)
> je viens de finir le log de dss, je te le poste aussitôt...

voilà!:
Deckard's System Scanner v20070603.47
Run by Administrateur on 2007-06-10 at 15:06:28
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2007-06-10 13:06:31 UTC - RP21 - Deckard's System Scanner Restore Point
1: 2007-06-10 07:44:35 UTC - RP20 - Supprim・J2SE Runtime Environment 5.0 Update 6


Backed up registry hives.

Performed disk cleanup.


-- HijackThis (run as Administrateur.exe) --------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 15:07:33, on 10/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
c:\program files\a-squared free\a2service.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\D-Link\AirPlusG+\AirPlus.exe
C:\Documents and Settings\Administrateur\Bureau\dss.exe
C:\DOCUME~1\ALLUSE~1\DOCUME~1\ORDINA~1\SOFTWA~1\PROTEC~1\HIJACK~1\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - Global Startup: D-Link AirPlus G+ Wireless Utility.lnk = ?
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la s駘ection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la s駘ection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens s駘ectionn駸 en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens s駘ectionn駸 en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mqutLut - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\RpcSandraSrv.exe


-- HijackThis Fixed Entries (C:\DOCUME~1\ALLUSE~1\DOCUME~1\ORDINA~1\SOFTWA~1\PROTEC~1\HIJACK~1\backups\) --------------------------------------------------------------------------------

backup-20070505-151357-324 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070505-152546-101 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070609-012113-693 O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
backup-20070609-012113-913 O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll (file missing)
backup-20070609-012113-996 O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll (file missing)
backup-20070609-232939-392 O2 - BHO: (no name) - {8036D4D7-AAD3-4793-AB49-329E437155A8} - (no file)
backup-20070609-232939-620 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070609-232939-652 O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2006\SpyEmergency.exe"
backup-20070609-232939-829 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
backup-20070609-232939-840 O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll (file missing)
backup-20070610-093514-840 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070610-093514-985 O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
backup-20070610-130112-572 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070610-130112-605 O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
backup-20070610-130112-750 O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll (file missing)
backup-20070610-130112-967 O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2006\SpyEmergency.exe"
backup-20070610-141613-778 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070610-141613-998 O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
backup-20070610-150314-113 O4 - HKLM\..\Run: [SysMetrix] C:\Program Files\SysMetrix\SysMetrix.exe
backup-20070610-150314-117 O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
backup-20070610-150314-139 O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
backup-20070610-150314-178 O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
backup-20070610-150314-184 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
backup-20070610-150314-205 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
backup-20070610-150314-209 O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
backup-20070610-150314-253 O4 - Global Startup: Contreur d帝tat.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
backup-20070610-150314-269 O4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -local
backup-20070610-150314-287 O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
backup-20070610-150314-292 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
backup-20070610-150314-312 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
backup-20070610-150314-348 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
backup-20070610-150314-402 O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
backup-20070610-150314-451 O4 - HKCU\..\Run: [MinimizeToTray] "C:\Documents and Settings\Administrateur\Bureau\der\minimize-to-tray_minimize_to_tray_1.2_anglais_24657\Minimize to tray.exe"
backup-20070610-150314-464 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
backup-20070610-150314-540 O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
backup-20070610-150314-553 O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
backup-20070610-150314-562 O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
backup-20070610-150314-568 O4 - HKCU\..\Run: [DS Clock] "C:\Program Files\DS Clock\dsclock.exe"
backup-20070610-150314-604 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
backup-20070610-150314-618 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
backup-20070610-150314-746 O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2006\SpyEmergency.exe"
backup-20070610-150314-748 O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
backup-20070610-150314-803 O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
backup-20070610-150314-814 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
backup-20070610-150314-846 O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
backup-20070610-150314-974 O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
backup-20070610-150314-981 O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
backup-20070610-150314-983 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

-- File Associations -----------------------------------------------------------

[COLOR=red].js - JSFile - DefaultIcon - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe",2[/COLOR]


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 AmdAcpi (AmdAcpi Bus Filter Driver) - c:\windows\system32\drivers\amdacpi.sys <Not Verified; Advanced Micro Devices; AMD ACPI Bus Filter Driver>
R0 giveio - c:\windows\system32\giveio.sys
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R2 WIBUKEY (WIBU-KEY Kernel Driver) - c:\windows\system32\drivers\wibukey.sys <Not Verified; WIBU-SYSTEMS AG; WIBU-KEY Software Protection System>
R3 amdtools (AMD Special Tools Driver) - c:\windows\system32\drivers\amdtools.sys <Not Verified; AMD, Inc.; Special Tools Driver>
R3 ASAPIW2k - c:\windows\system32\drivers\asapiw2k.sys <Not Verified; VOB Computersysteme GmbH; asapi>
R3 PCANDIS5 (PCANDIS5 Protocol Driver) - c:\d-link\airplusg+\pcandis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
R3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
R3 TNET1130 (D-Link AirPlus G+ Wireless Adapter) - c:\windows\system32\drivers\gplus.sys <Not Verified; Texas Instruments; TNET1130 WLAN Adapter>

S3 AMDPCI - c:\docume~1\admini~1\locals~1\temp\amdpci.sys (file missing)
S3 C-Dilla - c:\windows\system32\drivers\cdant.sys <Not Verified; Macrovision; Licence Management System>
S3 DSDrv4 - c:\program files\k!tv\plugins\s_bt8x8\dsdrv4.sys
S3 pctvvbi - c:\windows\system32\drivers\pctvvbi.sys <Not Verified; Pinnacle Systems; Pinnacle Systems Product Family>
S3 pwalker (Process Walker Driver) - c:\docume~1\admini~1\locals~1\temp\nsmd.tmp\pwalker.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 C-DillaSrv - c:\windows\system32\drivers\cdantsrv.exe <Not Verified; C-Dilla Ltd; CD-Secure/CD-Compress Windows NT>
R2 IISADMIN (Administration IIS) - c:\windows\system32\inetsrv\inetinfo.exe <Not Verified; Microsoft Corporation; Services Internet (IIS)>
R2 MaxBackServiceInt - "c:\program files\maxtor\maxtor backup\maxbackserviceint.exe" <Not Verified; ; MaxBackServiceInt Module>
R2 MSSQL$PINNACLESYS - c:\program files\pinnacle\mediaserver\microsoft sql server\mssql$pinnaclesys\binn\sqlservr.exe -spinnaclesys <Not Verified; Microsoft Corporation; Microsoft SQL Server>
R2 NTService1 (MaxSyncService) - "c:\program files\maxtor\onetouch\utils\syncservices.exe" <Not Verified; ; SyncServices>
R2 PinnacleSys.MediaServer (Pinnacle Systems Media Service) - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe <Not Verified; Pinnacle Systems; Media Server>
R2 SMTPSVC (Simple Mail Transfer Protocol (SMTP)) - c:\windows\system32\inetsrv\inetinfo.exe <Not Verified; Microsoft Corporation; Services Internet (IIS)>

S3 SQLAgent$PINNACLESYS - c:\program files\pinnacle\mediaserver\microsoft sql server\mssql$pinnaclesys\binn\sqlagent.exe -i pinnaclesys <Not Verified; Microsoft Corporation; Microsoft SQL Server>


-- Files created between 2007-05-10 and 2007-06-10 -----------------------------

2007-06-10 14:11:01 0 dr-h----- C:\Documents and Settings\Administrateur\Recent
2007-06-09 22:23:30 0 d-------- C:\Program Files\MSConfig CleanUp
2007-06-09 15:58:04 4130 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-09 15:53:37 0 d-------- C:\Program Files\CCleaner
2007-06-09 02:07:24 0 d--hs---- C:\WINDOWS\CSC
2007-06-07 16:53:24 0 d-------- C:\ANGEL_A
2007-06-04 10:55:21 0 d-------- C:\Program Files\7-Zip
2007-06-02 16:23:59 0 d-------- C:\Program Files\CUE Splitter
2007-06-02 14:27:39 0 d-------- C:\Documents and Settings\Administrateur\Application Data\foobar2000
2007-06-02 14:27:35 0 d-------- C:\Program Files\foobar2000
2007-06-02 13:20:28 0 d-------- C:\Program Files\Exact Audio Copy
2007-06-02 13:01:01 0 d-------- C:\Program Files\Echo
2007-06-02 12:56:40 0 d-------- C:\Program Files\Winamp
2007-06-02 12:56:13 0 d-------- C:\Program Files\Monkey's Audio
2007-05-30 11:44:35 0 d-------- C:\Program Files\CamStudio
2007-05-13 18:28:49 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-05-13 18:28:49 0 d-------- C:\WINDOWS\system32\Adobe
2007-05-13 18:25:55 0 d-------- C:\WINDOWS\Adobe Illustrator CS


-- Find3M Report ---------------------------------------------------------------

2007-06-10 14:12:49 49152 --a------ C:\WINDOWS\system32\CompiledAdapter
2007-06-10 09:44:44 0 d-------- C:\Program Files\Fichiers communs
2007-06-09 23:32:46 0 d-------- C:\Program Files\BitTorrent
2007-06-09 20:47:27 0 --a------ C:\CONFIG.SYS
2007-06-09 20:47:27 0 --a------ C:\AUTOEXEC.BAT
2007-06-09 16:43:43 0 d-------- C:\Program Files\a-squared Free
2007-06-09 15:47:20 0 d-------- C:\Program Files\DVDFab Decrypter 3
2007-06-09 14:36:59 0 d-------- C:\Program Files\VirtualDJ
2007-06-08 23:00:50 0 d-------- C:\Program Files\EMCO Malware Destroyer
2007-06-03 23:22:08 0 d-------- C:\Documents and Settings\Administrateur\Application Data\dvdcss
2007-06-02 15:33:45 0 d-------- C:\Program Files\MediaCoder
2007-05-30 22:51:08 0 d-------- C:\Documents and Settings\Administrateur\Application Data\Adobe
2007-05-13 18:28:49 0 d-------- C:\Program Files\Fichiers communs\Adobe
2007-05-13 18:27:38 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-05-05 23:48:35 587988 --a------ C:\WINDOWS\system32\perfh00C.dat
2007-05-05 23:48:35 113844 --a------ C:\WINDOWS\system32\perfc00C.dat
2007-05-05 23:20:36 0 d-------- C:\Documents and Settings\Administrateur\Application Data\ATI
2007-05-05 23:17:24 0 d-------- C:\Program Files\ATI Technologies
2007-05-05 22:46:47 0 d-------- C:\Program Files\MSBuild
2007-05-05 22:43:29 0 d-------- C:\Program Files\Reference Assemblies
2007-05-05 22:34:52 0 d-------- C:\Program Files\Microsoft.NET
2007-05-05 22:08:01 0 d-------- C:\Program Files\AMD
2007-05-05 22:07:32 0 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-05-05 21:30:09 0 d-------- C:\Program Files\SiSoftware
2007-05-05 20:13:01 0 d-------- C:\Program Files\HD Tune
2007-05-03 18:24:09 0 d-------- C:\Documents and Settings\Administrateur\Application Data\Lavasoft
2007-05-03 18:23:43 0 d-------- C:\Program Files\Lavasoft
2007-05-01 21:51:59 72848 --a------ C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2007-04-25 13:24:51 0 d-------- C:\Documents and Settings\Administrateur\Application Data\gtopala
2007-04-13 12:51:34 0 d-------- C:\Program Files\NSIS
2007-04-10 11:01:29 0 d-------- C:\Documents and Settings\Administrateur\Application Data\Skype
2007-04-10 01:20:12 0 d-------- C:\Program Files\Skype
2007-04-10 01:20:12 0 d-------- C:\Program Files\Fichiers communs\Skype
2007-04-08 18:10:49 4096 --a------ C:\WINDOWS\d3dx.dat
2007-03-22 21:05:00 520192 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
2007-03-22 20:25:02 124928 -----n--- C:\WINDOWS\system32\prntvpt.dll <Not Verified; Microsoft Corporation; Microsoftｮ Windowsｮ Operating System>


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AE7CD045-E861-484f-8273-0445EE161910} C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"MaxtorOneTouch"="C:\\Program Files\\Maxtor\\OneTouch\\utils\\Onetouch.exe"
@=""
"mxomssmenu"="\"C:\\Program Files\\Maxtor\\OneTouch Status\\maxmenumgr.exe\""
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
"NVMixerTray"="\"C:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe\""
"NWEReboot"=""
"MsmqIntCert"="regsvr32 /s mqrt.dll"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=dword:00000001
"NoSMHelp"=dword:00000001
"NoCDBurning"=dword:00000001
"ClearRecentDocsOnExit"=dword:00000040
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=dword:00000001
"NoSMHelp"=dword:00000001

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mqutLut

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0



-- End of Deckard's System Scanner: finished at 2007-06-10 at 15:07:50 ---------

un rapport de dss en extra que j'avais pas vu, désolé:
Deckard's System Scanner v20070603.47
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professionnel (build 2600) SP 2.0
Architecture: X86; Language: French

CPU 0: AMD Athlon(tm) 64 Processor 3200+
Percentage of Memory in Use: 22%
Physical Memory (total/avail): 2047.48 MiB / 1582.84 MiB
Pagefile Memory (total/avail): 3432.84 MiB / 3136.19 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1979.92 MiB

C: is Fixed (NTFS) - 189.91 GiB total, 17.75 GiB free.
D: is CDROM (No Media)
E: is Removable (No Media)
F: is CDROM (No Media)


-- Security Center -------------------------------------------------------------

AUOptions is set to notify before download.
Windows Internal Firewall is enabled.

Unable to create WMI object; error code: 0x8004100E


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Administrateur\Application Data
CLASSPATH=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=LSDBOT-II
ComSpec=C:\WINDOWS\system32\cmd.exe
DEVMGR_SHOW_DETAILS=1
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Administrateur
LOGONSERVER=\\LSDBOT-II
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\Fichiers communs\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\AMD\MCat\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f00
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
SAN_DIR=C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
USERDOMAIN=LSDBOT-II
USERNAME=Administrateur
USERPROFILE=C:\Documents and Settings\Administrateur
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Administrateur [I](admin)[/I]


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
--> C:\WINDOWS\NuNInst.exe /UNINSTALL
--> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
--> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
--> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
--> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
--> C:\WINDOWS\UNRecode.exe /UNINSTALL
7-Zip 4.47 beta --> "C:\Program Files\7-Zip\Uninstall.exe"
a-squared Free 3.0 --> "C:\Program Files\a-squared Free\unins000.exe"
Ad-Aware SE Personal --> MsiExec.exe /X{78CC3BAB-DE2A-4FB4-8FBB-E4DADDC26747}
Adobe Acrobat 7.0 Professional - English, Fran軋is, Deutsch --> msiexec /I {AC76BA86-1033-F400-7760-000000000002}
Adobe After Effects 7.0 --> msiexec /I {DD362256-A7A2-4524-9457-213DDC2AFC2A}
Adobe Bridge 1.0 --> MsiExec.exe /I{AE3D38A6-13B1-40B3-9423-D1FA9982FB6A}
Adobe Common File Installer --> MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5102}
Adobe Download Manager 2.2 (Supprimer uniquement) --> "C:\Program Files\Fichiers communs\Adobe\ESD\uninst.exe"
Adobe Encore DVD 1.5 Tryout --> RunDll32 "C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{6BD31B80-7E9E-4FAF-B911-0AC31FB94BF6}\setup.exe" -l0x040c
Adobe Encore DVD 2.0 --> msiexec /I {2ECE7ECE-D15B-4999-8B8D-01C998F489D5}
Adobe ExtendScript Toolkit 1.0 --> MsiExec.exe /I{B74D4E10-0000-0000-0000-EDED00000102}
Adobe Help Center 2.0 --> MsiExec.exe /I{8FFC924C-ED06-44CB-8867-3CA778ECE903}
Adobe Illustrator CS --> RunDll32 "C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe"
Adobe InDesign CS2 --> msiexec /I{7F4C8163-F259-49A0-A018-2857A90578BC}
Adobe Photoshop CS --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x40c
Adobe Premiere Pro 2.0 --> msiexec /I {FA17A726-B229-4116-B793-A2AB1A4EAE2E}
Adobe Reader 8 - Fran軋is --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A80000000002}
Adobe Stock Photos 1.0 --> MsiExec.exe /I{786C5747-1437-443D-B06E-79A00FE45110}
Adobe SVG Viewer 3.0 --> C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
AMD CPUInfo --> MsiExec.exe /X{6B619ED4-492F-4AD2-BCA7-563AFC938B0F}
AMD Power Monitor --> MsiExec.exe /X{9DD3BF8E-0399-4B15-878B-CE48CE4961F9}
ArchiCAD 9 FRA --> C:\Program Files\Graphisoft\ArchiCAD 9\Uninstall.AC\uninstaller.exe
Archiveur WinRAR --> C:\Program Files\WinRAR\uninstall.exe
ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x9
ATI Control Panel --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.4 --> "C:\Program Files\Audacity\unins000.exe"
avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
AxCrypt (D駸installer uniquement) --> "C:\Program Files\Axon Data\AxCrypt\AxCryptU.exe"
Brother MFL-Pro Suite --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BB9AC6BF-71B6-42A4-9689-C17D9F44E79A}\Setup.exe" -l0x40c Brunin03.dllBrunin03.dll
C-Dilla Licence Management System --> C:\C_DILLA\setup\cdunin16.exe
CamStudio 2.0 Fr --> "C:\Program Files\CamStudio\unins000.exe"
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CleanUp! --> C:\Program Files\CleanUp!\uninstall.exe
ConvertXtoDVD 2.0.9 --> "C:\Program Files\vso\ConvertXtoDVD\unins000.exe"
Correctif Windows XP - KB885835 --> C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Correctif Windows XP - KB885836 --> C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Correctif Windows XP - KB885884 --> C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
Correctif Windows XP - KB886185 --> C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Correctif Windows XP - KB888302 --> C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Correctif Windows XP - KB890859 --> "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Correctif Windows XP - KB891781 --> C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
CUE Splitter --> MsiExec.exe /I{12B60D3B-90B4-4175-BB90-FCE19ACD9B02}
D-Link AirPlus G+ Wireless LAN Adapter --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5A2BE5CA-0E67-4062-B5EF-BE9C6485C745}\Setup.exe" -l0x9
DS Clock --> "C:\Program Files\DS Clock\unins000.exe"
DVD Decrypter 3.5.4.0 Fr --> C:\Program Files\DVD Decrypter\UnInstall_DVDdecrypt.exe
DVD Shrink 3.2 --> "C:\Program Files\DVD Shrink\unins000.exe"
DVDFab Decrypter 3.0.3.5 --> "C:\Program Files\DVDFab Decrypter 3\unins000.exe"
Echo --> MsiExec.exe /I{9E3ABF72-AC65-4A40-933B-B9D5056F224B}
EMCO Malware Destroyer --> "C:\Program Files\EMCO Malware Destroyer\unins000.exe"
EMCO MoveOnBoot --> "C:\Program Files\EMCO MoveOnBoot\unins000.exe"
eMule --> "C:\Program Files\eMule\Uninstall.exe"
Exact Audio Copy 0.95b4 --> C:\Program Files\Exact Audio Copy\uninst.exe
Flash Movie Player 1.4 --> C:\Program Files\Flash Movie Player\uninst.exe
FLV Player --> C:\Program Files\FLV Player\uninstall.exe
foobar2000 v0.9.4.3 --> "C:\Program Files\foobar2000\uninstall.exe"
Fraps (remove only) --> "C:\Fraps\uninstall.exe"
Google Video Player --> "C:\Program Files\Google\Google Video Player\Uninstall.exe"
HD Tune 2.53 --> "C:\Program Files\HD Tune\unins000.exe"
HijackThis 1.99.1 --> C:\Documents and Settings\All Users\Documents\ordinateur\softwares\protection\hijackthis\HijackThis.exe /uninstall
IrfanView (remove only) --> C:\Program Files\IrfanView\iv_uninstall.exe
K-Lite Codec Pack 2.77 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe"
K!TV --> C:\Program Files\K!TV\UninstKTV.exe
Language pack for Ad-Aware SE --> C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\INSTALL.LOG
Logiciel iTouch de Logitech --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{036AA4D4-6D32-11D4-9875-00105ACE7734}\Setup.exe" -l0x40c UNINSTALL
Machine Check Analysis Tool --> MsiExec.exe /X{ADC2809F-E3E7-487D-9684-D71452186FD3}
Macromedia Dreamweaver 8 --> MsiExec.exe /I{5FD788ED-1A37-4496-9BDD-463F493B27FA}
Macromedia Extension Manager --> MsiExec.exe /I{3C8C9FB3-5FDF-40B4-B314-EAD722728C76}
Maxtor Backup --> C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{9C3F9580-F5CF-4288-894E-9FF0EB24A21C} /l1036
Maxtor OneTouch III --> C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{60EEB642-E9E0-45A2-A676-B9D8FE17C4A9} /l1036
Media Library Management Wizard --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplibwiz.inf,DefaultUninstall
MediaCoder 0.5.1 --> C:\Program Files\MediaCoder\uninst.exe
Microsoft Office XP Professional avec FrontPage --> MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft SQL Server Desktop Engine (PINNACLESYS) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Mise ・jour de s馗urit・pour Lecteur Windows Media (KB911564) --> "C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Lecteur Windows Media 6.4 (KB925398) --> "C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Lecteur Windows Media 9 (KB917734) --> "C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB899589) --> "C:\WINDOWS\$NtUninstallKB899589$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB917537) --> "C:\WINDOWS\$NtUninstallKB917537$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB925454) --> "C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB926247) --> "C:\WINDOWS\$NtUninstallKB926247$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB928090) --> "C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB929969) --> "C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB931768) --> "C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise ・jour de s馗urit・pour Windows XP (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise ・jour pour Windows XP (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Monkey's Audio --> "C:\Program Files\Monkey's Audio\unins000.exe"
Movie Maker Background Music Files --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\mmmusic.inf,DefaultUninstall
Movie Maker Sound Effects --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\mmsounds.inf,DefaultUninstall
Movie Maker Title Images --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\mmtitle.inf,DefaultUninstall
MSConfig CleanUp 1.2 --> "C:\Program Files\MSConfig CleanUp\UninsHs.exe"
MSXML 6.0 Parser (KB927977) --> MsiExec.exe /I{5A710547-B58E-488B-828D-CA9A25A0533C}
Nero 7 Premium --> MsiExec.exe /I{9DAA3F6E-0B56-A762-02CF-F9D80D8F1036}
Nullsoft Install System --> "C:\Program Files\NSIS\uninst-nsis.exe"
NVIDIA Drivers --> C:\WINDOWS\system32\NVUNINST.EXE UninstallGUI
NvMixer --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7A6C517-11F2-419F-B5BB-27772B939698}\Setup.exe" -uninstall
PCTV --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3C02ED4F-46B0-4E9E-87F7-47AEBA4031C8}\Setup.exe" -l0x40c
Pinnacle MediaCenter --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}\Setup.exe" -l0x40c UNINSTALL
Pinnacle MediaServer --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{460CE8B9-6EC2-458A-90D4-691631ECE9D9}\setup.exe" -l0x40c UNINSTALL
Plus! MP3 Audio Converter LE --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\audcle.inf,DefaultUninstall
QuickTime --> C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083} /l1036
RealPlayer --> C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
San Andreas Radio B3 --> "C:\Program Files\San Andreas Radio\unins000.exe"
SiSoftware Sandra Lite XI.SP2 (Win64/32/CE) --> "C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP2\unins000.exe"
Skype 3.1 --> "C:\Program Files\Skype\Phone\unins000.exe"
Skype Plugin Manager --> MsiExec.exe /I{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}
SnIco Edit 2.2 --> "C:\Program Files\SnIco Edit\unins000.exe"
SpeedFan (remove only) --> "C:\Program Files\SpeedFan\uninstall.exe"
Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Swiff Player 1.1 --> "C:\Program Files\GlobFX Technologies\Swiff Player\unins000.exe"
Tetris --> "C:\Program Files\Tetris\unins000.exe"
Tweakui Powertoy for Windows XP --> MsiExec.exe /I{C7793EE8-F666-4E6B-9827-76468679480E}
Universalis 10 --> C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Universalis\Universalis 10\Uninst.isu"
VideoLAN VLC media player 0.8.5 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Virtual DJ - Atomix Productions --> C:\PROGRA~1\VIRTUA~1\UNWISE.EXE C:\PROGRA~1\VIRTUA~1\INSTALL.LOG
WIBU-KEY Setup (WIBU-KEY Remove) --> C:\Program Files\WIBUKEY\Setup\Setup32.exe /R:{00060000-0000-1004-8002-0000C06B5161}
Win32 --> MsiExec.exe /I{A47CC380-5C96-4542-98EA-23884ECB42C6}
WinAVI Video Converter 5.8 --> "C:\Program Files\WinAVI Video Converter\unins000.exe"
Windows Communication Foundation --> MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger --> MsiExec.exe /I{E22885AB-B503-46E2-8437-73BBC6BC5487}
Windows Live Sign-in Assistant --> MsiExec.exe /I{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}
Windows Media Bonus Pack for Windows XP --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmbonus.inf,DefaultUninstall
Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Presentation Foundation Language Pack (FRA) --> MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Workflow Foundation --> MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows Workflow Foundation FR Language Pack --> MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
WinFlyer --> "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,UnInstall
XML Paper Specification Shared Components Language Pack 1.0 --> "C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Pack 1.0 -->


-- End of Deckard's System Scanner: finished at 2007-06-10 at 15:07:50 ---------

si ça peux t'indiquer quelque chose d'interressant! Merci encore de t'occuper de mon cas!
@+

Salut Boulepate62,
tu as visiblement décroché du sujet (ce n'est pas une critique, hein, loin de là, n'interprète pas mal mes propos, hein?), et je suis en passe de clore ce sujet.
EXPLICATION
> après t'avoir posté les deux rapports dss, comme j'avais du boulot, j'ai pas laché l'affaire.
> les problèmes étaient: le message d'erreur du chargement de Winflyer était persistant, Winflyer était toujours présent dans la liste ajout/suppression de programmes, malgré qu'il est été supprimé en mode sans échec. (cf plus haut)
> malgré l'erreur #52 (cf plus haut) de hijackthis, tout ce que tu m'as donné à supprimer (j'ai cherché) l'a été.
> j'ai refait un hijackthis, et rien...
> je redemarre, et plus de message d'erreur Winflyer au demarrage, mais Winflyer tjs dans la liste d'ajout/suppression...
> en revanche, à raison d'environ 1h, un bip de l'ordi, d'où?, DVDFabdecrypter 3.exe a disparu, mais pas ses dll, pourquoi? et j'ai désormais un deuxième hijackthis qui se nomme Administrateur.exe (je pense que c'est une conséquence de dss?!), bref:
> j'ai utilisé RegCleaner pour virer WinFlyer de la liste d'ajout/suppression des programmes, je nettoie, je redemarre > un problème de réglé!
> je bosse, du temps passe, pas de problèmes (pas de symptomes, pas deproblème?), tjs pas de nouvelles de toi, je décide de vérifier en attendant, voir si je peux faire un truc tout seul:
> a-squarred me dit qu'il a deux trucs à risque faible dans Smitfraudfix > je supprime le dossier et nettoie
> a-squarred me dit aussi que j'ai un truc dans System volume information, je vérifie chez vous, je vois que c'est un virus qui s'infiltre dedans, je modifie le dossier pour y avoir accès, et le vide avec EMCO Move and boot
> je redemarre avec un scan avast (rien), je refais un scan hijack (rien de louche, rien de ce qui posait problème auparavant)+ un scan a-squarred, plus rien, pourtant le systeme de restauration a un nouveau point de crée, sauf que celui-ci semble clean
> EMCO malware destroyer, ok
> Search and destroy, ok
Il ne me restera plus qu'à installer la dernière java
Tu as donc réglé mon problème avec une deux étapes un peu différées, pourquoi, va savoir, mais bon...
Je vais donc copier tout le sujet, le clore et si mes problèmes, finalement, réapparaissent, je le collerai.
Si, par curiosité, il semblerait que ce soit un de tes traits de caractère marqué :), dis-moi!
Bon, faut qu'j'y aille, le Foyalais (c'est le pire jeu de mots que j'ai jamais fait, excuse-moi :]> )
Encore merci pour tout!

presque retour à la case départ.
hijacjkthis detecte:
>mario toolbar (qui ne m'enbete pas pourtant),
>Winflyer, qui est introuvable
>Win32 starhide, idem
et l'erreur de chargement de Winflyer au demarrage...
donc je rouvre le dossier!
Merci d'avance!

Salut Boulepate62
1: je viens de lancer ta procédure, je te tiens au courant
2: voici ce que c'est passé hier, j'ai pas eu le temps de le poster:
> après le comboscan, j'ai un hijackthis supplémentaire nommé administrateur. La curiosité est un vilain défaut, avant de le supprimer, je le lance pour voir la différence. Lui me trouve la mario tool bar, starhide et Winflyer. Je "fix checked" le tout, nettoie (corbeille, cccleaner, CLEANMGR) et refait un moveandboot sur le system volume information au cas où il m'aurait aussi remis le virus dedans. Je redemarre en mode normal. Tout est carrément comme avant le hijackthis avant le comboscan, celui où tu m'as grosso modo fait virer tous les global startup. DSclock est de retour (cool), le message d'erreur de chargement de Winflyer qyu n'esxiste plus depuis belle lurette, et surtout le tea timer de s&d qui m'envoie autant de messages de modif de registre que de trucs virés dans hijack.
> d'où l'idée suivante. La première fois que j'ai vu Winflyer, c'était Avast, il le localisait dans un vieux dossier. J'ai supposé que le trojan avait pioncé tout ce temps là et s'était réveillé (pourquoi cette fois-ci?) pendant ma mise à jour de sécurité Windows. Or j'ai installé S&D bien plus tard que le dossier, et quand on installe, S&D, il crée une sauvegarde de registre qui n'est pas néttoyée par cccleaner ni les autres. Je l'ai désintallé, démarré en mode sans échec, fait un hijackthis et "fix checked" tout ce qui était mauvais, néttoyé, move and boot sur le system volume information. Redemarrage: tous les global startup virés ont de nouveau disparu, pas de message d'erreur Winflyer au demarrage... a priori plus de problèmes. Reste seulement un bip de l'ordi (pas un défaut de démarrage) à peu près toutes heures ou les deux heures. Pas de surchauffe, pas de processus anormal. Pas de problème de mémoire vive.
Que penses-tu de tout ça (tu peux me rappeler que j'ai fait une connerie en lançant administrateur.exe (le second hijackthis-autrement-nommé, mais j'en suis déjà bien conscient!)
AVG tourne, quand j'ai tout fini, je poste les rapports.
Merci à toi.
@+

le rapport AVG:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

A V G A n t i - S p y w a r e - R a p p o r t d ' a n a l y s e

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



+ C r : 1 2 : 0 7 : 4 0 1 1 / 0 6 / 2 0 0 7



+ R s u l t a t d e l ' a n a l y s e :







R i e n s i g n a l e r .







F i n d u r a p p o r t

(ça prend de la place pour rien:))
le rapport regsearch:
REGEDIT4
; RegSrch.vbs ｩ Bill James

; Registry search results for string "WinFlyer" 11/06/2007 12:10:50

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinFlyer32.dll]
ça n'a rien donné pour mario tool bar, voici le dernier rapport lopxp:
Rapport lopxpMH2 version 2.0 fait ・12:13:22,98 le 11/06/2007
C:\Documents and Settings\All Users\Documents\ordinateur\softwares\protection\lopxpMH2

******************************************
## R駱ertoires Application Data

Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\Administrateur\Application Data

18/09/2006 00:56 <REP> .
18/09/2006 00:56 <REP> ..
21/09/2006 19:56 <REP> Adobe
25/09/2006 14:29 <REP> AdobeUM
21/09/2006 17:17 <REP> Ahead
22/09/2006 19:17 <REP> Apple Computer
05/05/2007 23:20 <REP> ATI
17/10/2006 21:30 <REP> BitTorrent
26/09/2006 00:34 <REP> Brother
06/01/2007 19:15 <REP> dvdcss
28/11/2006 22:34 <REP> eu
02/06/2007 14:27 <REP> foobar2000
21/09/2006 22:25 <REP> Graphisoft
11/06/2007 11:36 <REP> Grisoft
25/04/2007 13:24 <REP> gtopala
25/09/2006 09:33 <REP> Help
18/09/2006 00:57 <REP> Identities
03/05/2007 18:24 <REP> Lavasoft
21/09/2006 22:52 <REP> Macromedia
18/09/2006 00:56 <REP> Microsoft
28/11/2006 22:33 <REP> Mozilla
06/01/2007 20:39 <REP> Opera
21/09/2006 20:07 <REP> Real
10/04/2007 01:20 <REP> Skype
13/10/2006 20:17 <REP> SmartBarXP
21/09/2006 22:40 <REP> Sun
18/11/2006 18:17 <REP> vlc
26/09/2006 09:47 <REP> Vso
31/01/2007 23:18 949 AdobeDLM.log
18/09/2006 00:56 62 desktop.ini
31/01/2007 23:18 796 dm.ini
01/05/2007 21:51 72848 GDIPFONTCACHEV1.DAT
4 fichier(s) 74655 octets
28 R駱(s) 18725650432 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\Administrateur\Local Settings\Application Data

18/09/2006 00:56 <REP> .
18/09/2006 00:56 <REP> ..
21/09/2006 22:11 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150060}
21/09/2006 19:56 <REP> Adobe
21/09/2006 17:20 <REP> Ahead
03/12/2006 12:56 <REP> ApplicationHistory
05/05/2007 23:20 <REP> ATI
22/09/2006 10:42 <REP> Google
21/09/2006 22:25 <REP> Graphisoft
18/09/2006 09:49 <REP> Help
24/09/2006 20:51 <REP> Identities
03/12/2006 14:24 <REP> IsolatedStorage
18/09/2006 00:56 <REP> Microsoft
27/09/2006 00:43 <REP> WMTools Downloaded Files
18/09/2006 01:22 139776 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
03/12/2006 12:56 137 fusioncache.dat
22/09/2006 10:47 72848 GDIPFONTCACHEV1.DAT
23/09/2006 14:00 2106898 IconCache.db
4 fichier(s) 2319659 octets
14 R駱(s) 18725650432 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\All Users\Application Data

18/09/2006 02:42 <REP> .
18/09/2006 02:42 <REP> ..
21/09/2006 19:49 <REP> Adobe
14/10/2006 23:33 <REP> Adobe Systems
21/09/2006 22:12 <REP> Apple Computer
22/09/2006 14:34 <REP> Brother
21/09/2006 17:23 <REP> DVD Shrink
17/11/2006 20:14 <REP> Macromedia
18/09/2006 01:17 <REP> Maxtor
18/09/2006 02:42 <REP> Microsoft
03/12/2006 12:52 <REP> Pinnacle
23/03/2007 22:44 <REP> Skype
03/05/2007 18:42 <REP> Spybot - Search & Destroy
18/09/2006 02:43 62 desktop.ini
05/05/2007 21:30 32456 xmlB.tmp
05/05/2007 21:30 0 xmlC.tmp
05/05/2007 21:30 3556 xmlD.tmp
4 fichier(s) 36074 octets
13 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\Default User\Application Data

18/09/2006 02:42 <REP> .
18/09/2006 02:42 <REP> ..
18/09/2006 02:42 <REP> Microsoft
18/09/2006 02:43 62 desktop.ini
1 fichier(s) 62 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\Default User\Local Settings\Application Data

18/09/2006 02:43 <REP> .
18/09/2006 02:43 <REP> ..
18/09/2006 00:55 <REP> Microsoft
0 fichier(s) 0 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\LocalService\Application Data

18/09/2006 00:56 <REP> .
18/09/2006 00:56 <REP> ..
18/09/2006 00:56 <REP> Microsoft
0 fichier(s) 0 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data

18/09/2006 00:56 <REP> .
18/09/2006 00:56 <REP> ..
18/09/2006 00:56 <REP> Microsoft
05/05/2007 22:46 2272 FontCache3.0.0.0.dat
1 fichier(s) 2272 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\NetworkService\Application Data

18/09/2006 00:56 <REP> .
18/09/2006 00:56 <REP> ..
18/09/2006 00:56 <REP> Microsoft
0 fichier(s) 0 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data

18/09/2006 00:56 <REP> .
18/09/2006 00:56 <REP> ..
18/09/2006 00:56 <REP> Microsoft
0 fichier(s) 0 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\WINDOWS\system32\config\systemprofile\Application Data

18/09/2006 00:55 <REP> .
18/09/2006 00:55 <REP> ..
18/09/2006 00:55 <REP> Microsoft
18/09/2006 00:55 62 desktop.ini
1 fichier(s) 62 octets
3 R駱(s) 18725646336 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

18/09/2006 00:55 <REP> .
18/09/2006 00:55 <REP> ..
18/09/2006 00:55 <REP> Microsoft
0 fichier(s) 0 octets
3 R駱(s) 18725646336 octets libres

******************************************
Recherche des taches planifi馥s dans C:\WINDOWS\tasks

******************************************
## R駱ertoires de C:\Program Files

Le volume dans le lecteur C n'a pas de nom.
Le num駻o de s駻ie du volume est D460-E148

R駱ertoire de C:\Program Files

10/06/2007 20:10 <REP> .
10/06/2007 20:10 <REP> ..
04/06/2007 10:55 <REP> 7-Zip
13/05/2007 18:27 <REP> Adobe
18/09/2006 01:04 <REP> Alwil Software
05/05/2007 22:08 <REP> AMD
09/06/2007 16:43 <REP> a-squared Free
05/05/2007 23:17 <REP> ATI Technologies
21/09/2006 22:50 <REP> Audacity
09/03/2007 12:01 <REP> Axon Data
09/06/2007 23:32 <REP> BitTorrent
26/09/2006 00:39 <REP> Brother
30/05/2007 11:44 <REP> CamStudio
09/06/2007 15:53 <REP> CCleaner
09/06/2007 15:48 <REP> CleanUp!
26/09/2006 00:39 <REP> Common Files
18/09/2006 00:52 <REP> ComPlus Applications
02/06/2007 16:24 <REP> CUE Splitter
14/10/2006 23:12 <REP> DAEMON Tools
13/10/2006 21:31 <REP> DS Clock
21/09/2006 17:10 <REP> DVD Decrypter
21/09/2006 17:23 <REP> DVD Shrink
09/06/2007 15:47 <REP> DVDFab Decrypter 3
02/06/2007 13:01 <REP> Echo
08/06/2007 23:00 <REP> EMCO Malware Destroyer
18/12/2006 00:09 <REP> EMCO MoveOnBoot
13/12/2006 18:19 <REP> eMule
02/06/2007 13:20 <REP> Exact Audio Copy
11/06/2007 01:59 <REP> Fichiers communs
13/10/2006 08:10 <REP> Flash Movie Player
15/10/2006 10:26 <REP> FLV Player
02/06/2007 14:27 <REP> foobar2000
15/10/2006 10:20 <REP> GlobFX Technologies
21/09/2006 22:52 <REP> Google
21/09/2006 22:15 <REP> Graphisoft
09/06/2007 14:09 <REP> Grisoft
08/04/2007 19:13 <REP> Guirao
05/05/2007 20:13 <REP> HD Tune
13/10/2006 20:31 <REP> Horloge
08/06/2007 20:31 <REP> Internet Explorer
15/10/2006 10:01 <REP> IrfanView
11/06/2007 01:59 <REP> Java
03/12/2006 02:47 <REP> K!TV
29/09/2006 23:12 <REP> K-Lite Codec Pack
03/05/2007 18:23 <REP> Lavasoft
18/09/2006 03:10 <REP> Logitech
17/11/2006 20:14 <REP> Macromedia
18/09/2006 01:16 <REP> Maxtor
02/06/2007 15:33 <REP> MediaCoder
21/09/2006 21:58 <REP> Microsoft Office
03/12/2006 13:00 <REP> Microsoft SQL Server
05/05/2007 22:34 <REP> Microsoft.NET
03/06/2007 22:36 <REP> Monkey's Audio
27/09/2006 00:33 <REP> Movie Maker
05/05/2007 22:46 <REP> MSBuild
09/06/2007 22:23 <REP> MSConfig CleanUp
21/09/2006 22:54 <REP> MSN Messenger
21/11/2006 23:48 <REP> MSXML 4.0
23/01/2007 08:56 <REP> Nero
13/04/2007 12:51 <REP> NSIS
21/09/2006 12:17 <REP> NVIDIA Corporation
13/12/2006 14:18 <REP> Outlook Express
11/01/2007 21:59 <REP> PCFriendly
03/12/2006 13:00 <REP> Pinnacle
22/10/2006 13:10 <REP> QuickTime
21/09/2006 20:08 <REP> Real
05/05/2007 22:43 <REP> Reference Assemblies
10/06/2007 20:14 <REP> RegCleaner
21/09/2006 22:52 <REP> San Andreas Radio
18/09/2006 00:54 <REP> Services en ligne
05/05/2007 21:30 <REP> SiSoftware
10/04/2007 01:20 <REP> Skype
13/10/2006 20:27 <REP> SmartBarXP BETA4.91
21/11/2006 17:45 <REP> SnIco Edit
15/10/2006 21:43 <REP> SpeedFan
11/06/2007 02:06 <REP> Spybot - Search & Destroy
08/04/2007 19:33 <REP> Tetris
28/11/2006 22:22 <REP> Universalis
17/11/2006 19:21 <REP> VideoLAN
09/06/2007 14:36 <REP> VirtualDJ
22/09/2006 21:52 <REP> vso
21/09/2006 22:17 <REP> WIBUKEY
21/09/2006 22:17 <REP> WIBU-SYSTEMS
02/06/2007 12:56 <REP> Winamp
29/09/2006 22:48 <REP> WinAVI Video Converter
21/09/2006 22:51 <REP> Windows Media Bonus Pack for Windows XP
22/09/2006 16:30 <REP> Windows Media Player
18/09/2006 00:51 <REP> Windows NT
18/09/2006 00:57 <REP> WinRAR
0 fichier(s) 0 octets
89 R駱(s) 18725629952 octets libres

******************************************
## Popups autoris馥s

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
fr.playstation.com REG_BINARY
www.allsportauto.com REG_BINARY
visibleearth.nasa.gov REG_BINARY
www.memoclic.com REG_BINARY
forum.hardware.fr REG_BINARY
toowam.france3.fr REG_BINARY
www.01net.com REG_BINARY
www.supercarfrance.com REG_BINARY
www.radioblogclub.com REG_BINARY
www.microsoft.com REG_BINARY

* Mozilla Firefox (1 autoris・ 2 interdit)

******************************************
## Registre

* [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]
Search Bar REG_SZ http://www.google.com/toolbar/ie8/sidebar.html

******************************************
## Zones de s馗urit・

* HKCU Domains (4)

* P3P History (5)

******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"


*************** Fin du rapport ****************
voilà pour les rapports!
Sinon ça craint pas réparer les erreurs cccleaner?

tu avais vu juste, voici:
REGEDIT4
; RegSrch.vbs ｩ Bill James

; Registry search results for string "Mario Forever Toolbar" 11/06/2007 14:38:30

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Buziol Games\Mario Forever Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C79FCD3C-C688-4B9B-B184-29A81E2C0130}\1.0\0\win32]
@="C:\\Program Files\\Mario Forever Toolbar\\v2.0.0.4\\Mario_Forever_Toolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C79FCD3C-C688-4B9B-B184-29A81E2C0130}\1.0\HELPDIR]
@="C:\\Program Files\\Mario Forever Toolbar\\v2.0.0.4\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Mario Forever Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mario Forever Toolbar]

[HKEY_USERS\S-1-5-21-1844237615-152049171-725345543-500\SOFTWARE\Buziol Games\Mario Forever Toolbar]

[HKEY_USERS\S-1-5-21-1844237615-152049171-725345543-500\SOFTWARE\Buziol Games\Mario Forever Toolbar\History]

Salut Boulepate62!
Plus de problèmes.
AVG, S&D, hijackthis, rien.
avast! non plus (scan avant boot) :]
Il me reste juste quelques questions:
> faut-il supprimer le log hijackthis et ses backups? Que se passe-t-il , si dans un mois ou deux, je le vire par inadvertance?
> comme je ne savais pas où le mettre le reg à fusionner, il est "rangé". Faut-il que je le mette à un endroit précis? D'ailleurs est-il déplaçable? Et pour finir: risque-t-il de disparaitre si j'utilises CCcleaner par exemple, ou fait-il partie désormais de la normalité de mon registre?
Voilà!
Un peu chiant comme type, dsl
@+

S'il y a un test particulier pour vérifier, dis-moi
Sinon, pas de problèmes donc un GRAND MERCI :¤)

Bonsoir Boulepate62
J'ai juste le pare-feu Windows, activé.
Comme je disais en début de post, je ne me connecte que pour les mises à jour de programmes, je pensais que c'était suffisant?!
Mais si c'est necessaire, je peux en installer un autre (que'que chose me dit que tu mes proposerais Kerio, hein?) :)

OK
Eh bien, encore merci beaucoup pour tout!
On se croisera peut-être sur le site un de ces quatre, j'espere juste que ce sera pas pour moi.
Si je calcules bien tu viens de démarrer ton aprèm, donc bonne journée!
je clos le sujet!
encore merci :)